PREPARATION – DELETE BEFORE MEETING Fill in the following: Slide 2: Enter the “Presented By: Name, Title, Company” with your information Replace the “Your Logo Here” logo with your company logo Slide 3: Fill this slide out with your personal information as well as your Company information TIPS: PRACTICE – run through the deck multiple times Focus on the impact to their business, not the stats or the technology Be relatable and have talking points Don’t read right off the slides.

EMPLOYEES ARE HUMAN IT ONLY TAKES ONE TO MAKE A MISTAKE PRESENTED BY: [NAME, TITLE, COMPANY]

WHO AM I? [Your name and job title] [Company Name] [Brief speaker biography] [Note some personal tidbits, get personal and real with your prospects] One hobby or activity [Company Name] [Brief company biography] Security-focused We pride ourselves on helping small to mid-size businesses strengthen their security posture and protect them from cybertheft.

YOUR EMPLOYEE SECURE SCORE OVERALL RISK LEVEL: [LOW RISK] [MEDIUM RISK] or [HIGH RISK] NUMBER OF AT RISK EMPLOYEES: [NUMBER] Your company has an ESS of [A], meaning you are in [RISK LEVEL] of experiencing an incident. A Your average phishing rate is [B%]. Compare to Industry. B% Use this slide if your prospect’s Company ESS is in the HIGH RISK or MEDIUM RISK A: Enter the “Company Overall Employee Secure Score (ESS). This is based on their employees’ performance. B: Enter the “Average Phishing Fail Rate” Let’s compare your phishing rate to the industry standard. Across all industries, the average baseline phishing fail rate for an organization with (the below) is: 1-249 employees: 30.9% fail rate 250-999 employees: 29% fail rate 1000+ employees: 25% fail rate - For further breakdown of specific industry fail rate totals, visit: https://www.knowbe4.com/press/knowbe4-unveils-new-phishing-benchmark-data-and- showcases-most-at-risk-industries C: Enter the number of medium & high-risk employees. You will want to combine the total number of medium and high-risk employees together. - Make sure the prospect knows that increased encouragement and discussing their employees’ struggles with you will allow you to help them. Be sure to tailor this message based on the improvement or regression of this score. Improvement: focus on how routine phishing and education allows for this phishing fail rate to continue to decrease Regression: Either due to whitelisting issues on baseline campaign, difficulty of campaigns, or it’s too soon to see improvement Have the names of the high and medium-risk employees ready so you can go over them with the prospect You have [C] employees that are medium and risk. C% All it takes is one employee, low risk today doesn’t mean no risk.

BENEFITS OF KEEPING UP WITH EVA Keep up the good work and continue to watch the progress your employees, yourself, and your organization make together. Continuous training and phishing turns employee weaknesses into strengths Employee Secure Score analytics keep security top of mind. Continuous Dark Web Monitoring alerts employees of potential new threats. But what happens if one of your employees still makes a mistake? 1. TechTarget https://searchsecurity.techtarget.com/definition/social-engineering 2. Symantec 2018 Internet Security Threat Report https://interactive.symantec.com/ISTR?CID=70138000001MD17AAG 3. The 2018 Black Report by Nuix https://www.nuix.com/black-report/black-report-2018

01 02 DO YOU KNOW YOUR SECURITY BLIND SPOTS? Why 3rd party is best Technology can keep us safe when humans make mistakes. Humans are just that, human. All it takes is one click. 3rd Party Security Risk Assessment (SRA) An SRA evaluates your current security posture and identifies risks to your sensitive data. Lower your Security Risks We recommend steps you can take to lower those risks. 01 02 Why 3rd party is best Don’t want the same company building the house to inspect their own work Accountability Second opinion Evaluates security gaps and weaknesses. The SRA identifies where data is resides in the organization, the current security measures in place to protect that data , and any threats posed to the organization. The final report contains recommendations based on the risks discovered during the process and ways to lower those levels of risk.

NEXT STEPS 3rd Party Security Risk Assessment What I need from you: Let’s make sure you’ve got the right tools in place to ensure you’re protected. I will: Provide a complementary Security Risk Assessment Find the gaps in your current security posture Present you with a report that shows the risks to your company and steps you can take to lower those risks. What I need from you: Return the signed proposal by [DATE] Assign an internal contact for me to work with directly – this should only take two hours Keep up the encouragement with EVA! Note: We suggest offering the SRA for free to your prospect as it is included in the Breach Prevention Platform and lowers the friction of getting them to agree to the proposal. Feel free to upcharge for the SRA – but make sure you turn that tile off for your client prior to enrolling them on EVA! Another suggestion is to give them a discount and charge them only for labor. The Risk Assessment looks at the current Administrative, Physical, and Technical safeguards in place for your client. This allows us to identify where the appropriate security measures are lacking and allows us to create recommendations for remediating the risks associated with those gaps.