Ponemon Institute© Private & Confidential ReportPage 1 State of the Endpoint Survey Analysis of Global Results Briefing for Lumension October 30, 2009

Ponemon Institute© Private & Confidential ReportPage 2 About our study The survey was fielded in five countries: US, Germany, Australia & New Zealand (combined), and UK. Project launched in September 2009 and all data was collected in October The survey instrument was developed with input from experts at Lumension. The survey instrument was validated by panel of Ponemon Fellows. A total of 3,009 respondents provided usable surveys, representing a 5.6% response rate for IT security and a 5.3% response rate for IT operations. Country SamplesIT SecurityIT Operations United States (US) Germany (DE) Australia & New Zealand (ANZ) United Kingdom (UK) Total1,4271,582

Ponemon Institute© Private & Confidential ReportPage 3 Attributions about endpoint security

Ponemon Institute© Private & Confidential ReportPage 4 Q1a. My organization has sufficient resources to achieve compliance with data security policies and best practices.

Ponemon Institute© Private & Confidential ReportPage 5 Q1b. My organization’s CEO is a strong supporter of security and data protection efforts.

Ponemon Institute© Private & Confidential ReportPage 6 Q1c. My organization views data security as a strategic initiative across the enterprise.

Ponemon Institute© Private & Confidential ReportPage 7 Q1d. My organization is proactive in managing privacy and data protection risks.

Ponemon Institute© Private & Confidential ReportPage 8 Q1e. Laptops and other mobile data-bearing devices are secure and do not present a significant security risk to our organization’s networks or enterprise systems.

Ponemon Institute© Private & Confidential ReportPage 9 Q2a. Does your organization use the following technologies? Percentage Yes response.

Ponemon Institute© Private & Confidential ReportPage 10 Q2a. Does your organization use the following technologies? Four technologies by country.

Ponemon Institute© Private & Confidential ReportPage 11 Q2a. Does your organization use the following technologies? Four technologies by country.

Ponemon Institute© Private & Confidential ReportPage 12 Q2b. Please state whether the use of this technology will increase over the next 12 to 24 months. Percentage Yes response.

Ponemon Institute© Private & Confidential ReportPage 13 Q3. Approximately how many software agents does your organization typically have installed on each endpoint to perform management, security and/or other operations?

Ponemon Institute© Private & Confidential ReportPage 14 Q3. More than five installed software agents by country.

Ponemon Institute© Private & Confidential ReportPage 15 Q4. On a typical day, how many different or distinct software management consoles does your organization use to manage endpoint operations & security functions?

Ponemon Institute© Private & Confidential ReportPage 16 Q4. More than five distinct management consoles by country.

Ponemon Institute© Private & Confidential ReportPage 17 Q5a. Does your organization allow employees to connect their own computing devices to its network or enterprise systems? Percentage Yes response.

Ponemon Institute© Private & Confidential ReportPage 18 Q5a. Yes response by country.

Ponemon Institute© Private & Confidential ReportPage 19 Q5b. Does your organization subsidize the employee’s purchase and use of their own computing devices (such as laptops, smart phones or PDAs)?

Ponemon Institute© Private & Confidential ReportPage 20 Q5b. Yes response by country.

Ponemon Institute© Private & Confidential ReportPage 21 Q5c. Does your organization have a policy that permits employees to connect their own computing devices to the organization’s network or enterprise systems? Percentage Yes Response.

Ponemon Institute© Private & Confidential ReportPage 22 Q5c. Yes response by country.

Ponemon Institute© Private & Confidential ReportPage 23 Q6. Why does your organization invest in endpoint security solutions? Please select your top three choices.

Ponemon Institute© Private & Confidential ReportPage 24 Q6. Choice = endpoint TCO by country.

Ponemon Institute© Private & Confidential ReportPage 25 Q7a. Do you believe your IT network is more secure now than it was a year ago? Percentage Yes response.

Ponemon Institute© Private & Confidential ReportPage 26 Q7b, If yes, why it is more secure today? Please check all that apply.

Ponemon Institute© Private & Confidential ReportPage 27 Q7b. Choice = Improving control procedures by country.

Ponemon Institute© Private & Confidential ReportPage 28 Q8. Does your organization have one company-wide IT security policy? Percentage Yes response.

Ponemon Institute© Private & Confidential ReportPage 29 Q9. Does your organization’s IT security budget support business objectives and priorities?

Ponemon Institute© Private & Confidential ReportPage 30 Q10a. What statement best describes how IT operations and IT security work together to support planning, communications and information sharing functions?

Ponemon Institute© Private & Confidential ReportPage 31 Q10b. Has the level of collaboration improved over the past year? Percentage Yes response.

Ponemon Institute© Private & Confidential ReportPage 32 Q11. What do you perceive to be the main difficulties in managing endpoint operations and security? Please select your top two reasons.

Ponemon Institute© Private & Confidential ReportPage 33 Q12. Does your organization have a PC life cycle management solution (such as asset management, configuration management, patch management or others)? Percentage Yes response.

Ponemon Institute© Private & Confidential ReportPage 34 Q13. Does your organization have an integrated endpoint security suite (vulnerability assessment, DLP, anti-virus, anti-malware or others)? Percentage Yes response.

Ponemon Institute© Private & Confidential ReportPage 35 Q14. What features are important in an integrated endpoint management suite (combining operations and security functions)? Please use the following five-point scale to rate each feature from very important to irrelevant. Each bar is the 1=very important & 2=important response.

Ponemon Institute© Private & Confidential ReportPage 36 Q14. What features are important in an integrated endpoint management suite (combining operations and security functions)? Please use the following five-point scale to rate each feature from very important to irrelevant. Each bar is the 1=very important & 2=important response.

Ponemon Institute© Private & Confidential ReportPage 37 Q15. What do you believe are the most important benefits of an integrated endpoint management suite (combining operations and security functions)? Please select your top three choices.

Ponemon Institute© Private & Confidential ReportPage 38 Q16. Which of the following technologies does your organization currently use?

Ponemon Institute© Private & Confidential ReportPage 39 Q17. During the past year, have any of the following incidents occurred in your organization? Select all that apply.

Ponemon Institute© Private & Confidential ReportPage 40 Q18. In the coming year (2010), which of the following IT security risks are of most concern to you? Please select the top five risks.

Ponemon Institute© Private & Confidential ReportPage 41 Q19b. How do these regulations affect your organization’s endpoint security? Choice = improves endpoint security.

Ponemon Institute© Private & Confidential ReportPage 42 Q19c. Why does compliance improve your organization’s endpoint security? Please check all that apply.

Ponemon Institute© Private & Confidential ReportPage 43 Q20a. On average, how much does it cost your organization to comply with privacy and data security compliance per year? Budget values converted into US$ for comparison purposes.

Ponemon Institute© Private & Confidential ReportPage 44 Q21. How does your organization’s 2009 IT security budget compare to 2008?

Ponemon Institute© Private & Confidential ReportPage 45 Q IT security budget increased from 2008 IT security budget by country?

Ponemon Institute© Private & Confidential ReportPage 46 Q22. How will your organization’s IT security budget for 2010 compare to 2009?

Ponemon Institute© Private & Confidential ReportPage 47 Q IT security budget will increase from 2009 IT security budget by country?

Ponemon Institute© Private & Confidential ReportPage 48 Q23. Approximately what percentage of your overall IT budget is dedicated to each of the following areas?

Ponemon Institute© Private & Confidential ReportPage 49 Organizational Characteristics

Ponemon Institute© Private & Confidential ReportPage 50 Respondent’s organizational levels and reporting lines. D1. What organizational level best describes your current position?ITSITO Vice President/Executive1% Director15%14% Manager/Supervisor27% Associate/Staff23%21% Technician26%29% Contractor7%6% Other2% Total100% D2. Check the Primary Person you or your IT organization reports into within the organization.ITSITO Chief Information Officer43%75% Chief Information Security Officer18%0% Chief Security Officer13%0% Chief Technology Officer9%18% Chief Risk Officer6%2% Compliance/Ethics Officer5%0% Chief Financial Officer3%0% Other (please specify)2%4% Total100%

Ponemon Institute© Private & Confidential ReportPage 51 What industry best describes your organization’s industry focus?

Ponemon Institute© Private & Confidential ReportPage 52 What is the worldwide headcount of your organization? D5. What is the worldwide headcount of your organization?ITSITO Less than 500 people14%15% 500 to 1,000 people20% 1,001 to 5,000 people23% 5,001 to 25,000 people20%19% 25,001 to 75,000 people16%15% More than 75,000 people8% Total100%

Ponemon Institute© Private & Confidential ReportPage 53 Next Steps Ponemon Institute LLC Tel: Toll Free: US 31 N. Traverse City, MI USA