05 Enterprise FAD v25-FINAL2 · Top 5 unpatched for 295 days 24 Healthcare + 37% Retail +11%...

24
ENTERPRISE SECURITY 1 Enterprise Security: Markets, Strategy, Roadmap, GotoMarket Jeff Scheel, SVP, Corporate Development, Alliances, and Strategy Balaji Yelamanchili, EVP & GM, Enterprise Security Business Unit Amit Mital, EVP, CTO & Emerging Endpoints Forward Looking Statements This presentation contains statements regarding our projected financial and business results, which may be considered forwardlooking within the meaning of the U.S. federal securities laws, including statements regarding our financial guidance and targets (as a combined company and by business segment); our proposed separation into two publicly traded companies; the projected market growth rates and margin expansion opportunities for the security business and the information management business; statements regarding our competitive advantages in security and information management; statements with respect to the proposed timing of the separation; and statements with respect to proposed capital allocation strategies for both Symantec and Veritas. These statements are subject to known and unknown risks, uncertainties and other factors that may cause our actual results, levels of activity, performance or achievements to differ materially from results expressed or implied in this presentation. Such risk factors include those related to: risks related to the separation of the company into the security business and the information management business; general economic conditions; maintaining customer and partner relationships; the anticipated growth of certain market segments, particularly with regard to security and information management; the competitive environment in the industries in which we operate; changes to operating systems and product strategy by vendors of operating systems; fluctuations in currency exchange rates; the timing and market acceptance of new product releases and upgrades; the successful development of new products; and the degree to which these products and businesses gain market acceptance. Actual results may differ materially from those contained in the forwardlooking statements in this presentation. We assume no obligation, and do not intend, to update these forwardlooking statements as a result of future events or developments. Additional information concerning these and other risks factors is contained in the Risk Factors sections of our Form 10K for the year ended March 28, 2014 and our Form 10Q for the quarter ended January 2, 2015. Any information regarding prerelease of Symantec offerings, future updates or other planned modifications is subject to ongoing evaluation by Symantec and therefore subject to change. This information is provided without warranty of any kind, express or implied. Customers who purchase Symantec offerings should make their purchase decision based upon features that are currently available. We assume no obligation to update any forwardlooking information contained in this presentation. 2

Transcript of 05 Enterprise FAD v25-FINAL2 · Top 5 unpatched for 295 days 24 Healthcare + 37% Retail +11%...

Page 1: 05 Enterprise FAD v25-FINAL2 · Top 5 unpatched for 295 days 24 Healthcare + 37% Retail +11% Education +10% Government +8% Financial +6% Source: Symantec Internet Security Threat

ENTERPRISE SECURITY 1

Enterprise Security: Markets, Strategy, Roadmap, Go‐to‐Market

Jeff Scheel, SVP, Corporate Development, Alliances, and Strategy 

Balaji Yelamanchili, EVP & GM, Enterprise Security Business Unit

Amit Mital, EVP, CTO & Emerging Endpoints 

Forward Looking Statements This presentation contains statements regarding our projected financial and business results, which may be considered forward‐looking within the meaning of the U.S. federal securities laws, including statements regarding our financial guidance and targets (as acombined company and by business segment); our proposed separation into two publicly traded companies; the projected marketgrowth rates and margin expansion opportunities for the security business and the information management business; statementsregarding our competitive advantages in security and information management; statements with respect to the proposed timing ofthe separation; and statements with respect to proposed capital allocation strategies for both Symantec and Veritas. Thesestatements are subject to known and unknown risks, uncertainties and other factors that may cause our actual results, levels ofactivity, performance or achievements to differ materially from results expressed or implied in this presentation. Such risk factorsinclude those related to: risks related to the separation of the company into the security business and the information managementbusiness; general economic conditions; maintaining customer and partner relationships; the anticipated growth of certain marketsegments, particularly with regard to security and information management; the competitive environment in the industries in whichwe operate; changes to operating systems and product strategy by vendors of operating systems; fluctuations in currency exchangerates; the timing and market acceptance of new product releases and upgrades; the successful development of new products; andthe degree to which these products and businesses gain market acceptance. Actual results may differ materially from thosecontained in the forward‐looking statements in this presentation. We assume no obligation, and do not intend, to update theseforward‐looking statements as a result of future events or developments. Additional information concerning these and other risksfactors is contained in the Risk Factors sections of our Form 10‐K for the year ended March 28, 2014 and our Form 10‐Q for thequarter ended January 2, 2015.

Any information regarding pre‐release of Symantec offerings, future updates or other planned modifications is subject to ongoingevaluation by Symantec and therefore subject to change. This information is provided without warranty of any kind, express orimplied. Customers who purchase Symantec offerings should make their purchase decision based upon features that are currentlyavailable.

We assume no obligation to update any forward‐looking information contained in this presentation.

2

Page 2: 05 Enterprise FAD v25-FINAL2 · Top 5 unpatched for 295 days 24 Healthcare + 37% Retail +11% Education +10% Government +8% Financial +6% Source: Symantec Internet Security Threat

ENTERPRISE SECURITY 2

Use of GAAP and Non‐GAAP Financial InformationOur results of operations have undergone significant change due to a series of acquisitions, the impact of stock‐based compensation,impairment charges and other corporate events. To help our readers understand our past financial performance and our futureresults, we supplement the financial results that we provide in accordance with generally accepted accounting principles, or GAAP,with non‐GAAP financial measures. The method we use to produce non‐GAAP results is not computed according to GAAP and maydiffer from the methods used by other companies. Our non‐GAAP results are not meant to be considered in isolation or as asubstitute for comparable GAAP measures and should be read only in conjunction with our consolidated financial statementsprepared in accordance with GAAP.

Our management regularly uses our supplemental non‐GAAP financial measures internally to understand, manage and evaluate ourbusiness and make operating decisions. These non‐GAAP measures are among the primary factors management uses in planning forand forecasting future periods. Investors are encouraged to review the reconciliation of our non‐GAAP financial measures to thecomparable GAAP results, which can be found, along with other financial information, on the investor relations’ page of our websiteat www.symantec.com/invest.

Reconciliations for our financial results and guidance can be found on Symantec’s investor relations website.

3

Agenda

4

1 Market Opportunity

2 Product Strategy

3 Roadmap & Go‐To‐Market

Page 3: 05 Enterprise FAD v25-FINAL2 · Top 5 unpatched for 295 days 24 Healthcare + 37% Retail +11% Education +10% Government +8% Financial +6% Source: Symantec Internet Security Threat

ENTERPRISE SECURITY 3

Enterprise Threat Landscape 

5

Attackers Moving Faster Digital extortion 

on the riseMalware gets 

smarter

Zero‐Day Threats Many Sectors Under Attack

5 of 6 large companies attacked

317M new malware created

1M new threats daily

60% of attacks 

targeted SMEs

113% increase in ransomware

45Xmore devices held 

hostage 

28% of malware was Virtual 

Machine Aware

24 all‐time high

Top 5 unpatched for 

295 days

24 

Healthcare+ 37% 

Retail+11% 

Education +10%

Government+8%

Financial+6%

Source: Symantec Internet Security Threat Report 2015

Key Trends Reshaping the Enterprise Security Market

RESURGENCE OF ENDPOINT Rapid shift to mobile and IoT

DISAPPEARING PERIMETER Decreasingly relevant with “fuzzy” perimeter

RAPID CLOUD ADOPTION Enterprise data and applications moving to cloud

SERVICES Security as a Service; box fatigue

CYBERSECURITY Governments and regulators playing ever larger role

6

Page 4: 05 Enterprise FAD v25-FINAL2 · Top 5 unpatched for 295 days 24 Healthcare + 37% Retail +11% Education +10% Government +8% Financial +6% Source: Symantec Internet Security Threat

ENTERPRISE SECURITY 4

Symantec Enterprise Security | STRONG FRANCHISES

7

#1 share; AAArating

nine quarters in a row

Endpoint Security

#1 share; 100% uptime with 

<0.0003% FPs 5 years in a row

Email Security

#1  DLP share;100% of Fortune 100

Data Protection

#1 share6B certificate lookups/day

TrustServices

13B validations every day100% uptime last 5 years

Authentication & Authorization

ManagedSecurity Services

12 Yrs Gartner MQ leader

30B logs analyzed/day 

Symantec Enterprise Security | UNIQUE VISIBILITY

8

57M attack sensors in 157 countries

175M endpoints

182M web attacks blocked last year

3.7Trows of telemetry

100 Billion more/month

9threat response centers

500+rapid security response team

30% of world’s enterprise email traffic scanned/day

1.8 Billion web requests

Page 5: 05 Enterprise FAD v25-FINAL2 · Top 5 unpatched for 295 days 24 Healthcare + 37% Retail +11% Education +10% Government +8% Financial +6% Source: Symantec Internet Security Threat

ENTERPRISE SECURITY 5

Symantec Enterprise Security | GROWTH DRIVERS

9

Source: IDC Security forecast, Gartner, Harbor Research, Ovum, and Symantec Analyses

Threat Protection• With Advanced Threat Protection (ATP) and Cloud Workload 

Protection, our addressable market expands 50% by CY 2018

Information Protection• With Cloud Information Protection and Identity as a Service, 

our addressable market expands 35% by CY 2018

Cyber Security Services• With expanded Cyber Security Services offerings, our 

addressable market expands 50%+ by CY 2018

Symantec Opportunity

Expanded

Current

Addressable Market Size ($B)

18.7

24.6

12.0

CY15 CY18

CAGR

9.6%

Symantec Enterprise Security | GROWTH DRIVERS

10

Source: IDC Security forecast, Gartner, Harbor Research, Ovum, and Symantec Analyses

Threat Protection• With Advanced Threat Protection (ATP) and Cloud Workload 

Protection, our addressable market expands 50% by CY 2018

Information Protection• With Cloud Information Protection and Identity as a Service, 

our addressable market expands 35% by CY 2018

Cyber Security Services• With expanded Cyber Security Services offerings, our 

addressable market expands 50%+ by CY 2018

Symantec Opportunity

11.713.8

3.2 4.3 3.96.5

6.9

1.5

3.6

CY15 CY18 CY15 CY18 CY15 CY18Threat Protection Information Protection Cyber Security Services

Expanded

Current

Addressable Market Size ($B)

+35%TAM

+50%TAM

+50%TAM

Page 6: 05 Enterprise FAD v25-FINAL2 · Top 5 unpatched for 295 days 24 Healthcare + 37% Retail +11% Education +10% Government +8% Financial +6% Source: Symantec Internet Security Threat

ENTERPRISE SECURITY 6

Agenda

11

1 Market Opportunity

2 Product Strategy

3 Roadmap & Go‐To‐Market

Enterprise Security | PRODUCT STRATEGY

12

Threat Protection

ENDPOINTS DATA CENTER GATEWAYS

• Advanced Threat Protection Across All Control Points• Built‐In Forensics and Remediation Within Each Control Point• Integrated Protection of Server Workloads: On‐Premise, Virtual, and Cloud• Cloud‐based Management for Endpoints, Datacenter, and Gateways

Unified Security Analytics Platform

Log andTelemetryCollection

Unified IncidentManagement and Customer Hub

Inline Integrationsfor Closed‐loopActionable Intelligence

Regional and Industry Benchmarking

Integrated Threatand BehavioralAnalysis

Information Protection

DATA IDENTITIES

• Integrated Data and Identity Protection• Cloud Security Broker for Cloud and Mobile Apps• User and Behavioral Analytics• Cloud‐based Encryption and Key Management

Users

Data

Apps

Cloud

Endpoints

Gateways

Data Center

Cyber Security ServicesMonitoring, Incident Response, Simulation, Adversary Threat Intelligence

Page 7: 05 Enterprise FAD v25-FINAL2 · Top 5 unpatched for 295 days 24 Healthcare + 37% Retail +11% Education +10% Government +8% Financial +6% Source: Symantec Internet Security Threat

ENTERPRISE SECURITY 7

Cyber Security Services

Unified Security Analytics Platform

Information ProtectionDATA IDENTITIES

Threat ProtectionDATA CENTER GATEWAYSENDPOINTS

THREAT PROTECTION

13

Threat Protection Requirements | FULL THREAT LIFE‐CYCLE

14

Source: Gartner

PREDICT Proactive risk analysis

Predict attacks

Baseline systems Prevent issues

Divert attackers

Harden and isolate systems

Contain issues

Confirm and prioritize risk

Detect issuesRemediate/ Make change

Design/Model change

RESPOND

PREVENT

DETECTInvestigate/ Forensics

Advanced Threat 

Protection

Page 8: 05 Enterprise FAD v25-FINAL2 · Top 5 unpatched for 295 days 24 Healthcare + 37% Retail +11% Education +10% Government +8% Financial +6% Source: Symantec Internet Security Threat

ENTERPRISE SECURITY 8

Symantec Threat Protection | STRATEGY

• Advanced Threat Protection AcrossControl Points

• Built‐in Forensics and Remediation Within Each Control Point

• Integrated Protection of Server Workloads across On‐Premise, Virtual, and Cloud

• Cloud‐based Management for Endpoints, Datacenter, and Gateways

15

AdvancedThreat

Protection

Network/Gateways

DataCenter

Endpoints

Symantec Threat Protection | ADVANCED THREAT PROTECTION

• Single detection platform across endpoint, network, and email

• Cross correlation and incident prioritization

• Cloud‐based payload detonation

• Closed‐loop remediation

• Unified incident management

• Key differentiator: high efficacy with least false positives and low TCO

16

AdvancedThreat Protection

Global Intelligence Exported Data

Advanced Threat Protection

Cloud Sandbox Correlation Prioritization

Endpoint Network Email 3rd party offerings

Page 9: 05 Enterprise FAD v25-FINAL2 · Top 5 unpatched for 295 days 24 Healthcare + 37% Retail +11% Education +10% Government +8% Financial +6% Source: Symantec Internet Security Threat

ENTERPRISE SECURITY 9

Symantec Threat Protection | FORENSICS & REMEDIATION 

17

Next Gen Forensics and Remediation

Endpoint Protection (SEP)

Flight Recorder

IoCSearch

Repair and Remediation

Proactive Exploit Protection

Global Intelligence Targeted Attack Visualization

• Extensions built within existing agent technology

• Granular flight recorder

• Fine‐grained remediation policies

• Common management console with centralized activity logs

• Known and unknown exploit detection 

• Key differentiator: no new agent, easy to upgrade

Symantec Threat Protection | INTEGRATED SERVER WORKLOAD PROTECTION

18

• Integrated protection across on premise, virtualized, and cloud‐based workloads

• Consistent enforcement of app control, lockdown, and other hardening policies

• Common management and orchestration as workloads move to and from cloud

• Support for VMWare (NSX/ESX) and Amazon, Azure, and OpenStack Clouds

Server Workload Protection

Data Center Security (DCS) 

File Integrity Monitoring

ApplicationHardening

Control &Compliance

Page 10: 05 Enterprise FAD v25-FINAL2 · Top 5 unpatched for 295 days 24 Healthcare + 37% Retail +11% Education +10% Government +8% Financial +6% Source: Symantec Internet Security Threat

ENTERPRISE SECURITY 10

Symantec Threat Protection | SUMMARY OF KEY CAPABILITIES

19

Next Gen Forensicsand Remediation

• Granular flight recorder

• Fine‐grained remediation policies

• Known and unknown exploit detection 

• Common management console with centralized activity logs

• Closed‐loop remediation

• No new agent (easy upgrade)

AdvancedThreat Protection

• Single platform

• Cloud‐based payload detonation

• Cross‐control point correlation and incident prioritization

• Closed‐loop remediation

• Unified incident management

Cloud‐based management with single extendable agent technology,self‐service BYOD provisioning, and native encryption & key management

ServerWorkload Protection 

• Integrated protection across on premise, virtualized, and cloud‐based workloads

• Consistent application of lockdown, app control, and lockdown policies

• Common Management/orchestration as workloads move to and from cloud

• Support for VMWare (NSX/ESX) and Amazon, Azure, and OpenStack

Symantec Threat Protection | KEY REVENUE OPPORTUNITIES

20

Installed Base 

• Endpoint customers: Endpoint ATP and Forensics & Remediation add‐ons

• Email customers: Email ATP add‐on

• Both: Full ATP including Endpoint, Email, and Network

Net New Customers

• ATP with cross‐correlation value proposition

• Replacement of manual IR projects with automated tools for Forensics and Remediation

Customers moving to Cloud and BYOD

• Protection for Cloud workloads (e.g. Amazon, Azure)

• Cloud‐based management of endpoint, server, and BYOD devices with self‐service capabilities

$11.7B$13.8B

$6.9B

CY15 CY18

+50%TAM

Expanded

Current

Source: IDC Security forecast, Harbor Research, Ovum, and Symantec Analyses

Page 11: 05 Enterprise FAD v25-FINAL2 · Top 5 unpatched for 295 days 24 Healthcare + 37% Retail +11% Education +10% Government +8% Financial +6% Source: Symantec Internet Security Threat

ENTERPRISE SECURITY 11

Cyber Security Services

Unified Security Analytics Platform

Information ProtectionDATA IDENTITIES

Threat ProtectionDATA CENTER GATEWAYSENDPOINTS

INFORMATION PROTECTION

21

Information Protection Requirements | CLOUD AND MOBILE FOCUS

22

With the advent of mobile and BYOD devices, more users are accessing and consuming information when outside the firewalls

USERS ARE MOVING 

DATA AND APPS ARE MOVING 

With more data in cloud and more mobile users, information protection across cloud and mobile, combined with behavioral analytics, is a critical imperative

Historically data was created and consumed on premise; most users would create and consume this data from inside firewalls

With more applications and workloads migrating to public clouds, more and more data is created and consumed on cloud

Page 12: 05 Enterprise FAD v25-FINAL2 · Top 5 unpatched for 295 days 24 Healthcare + 37% Retail +11% Education +10% Government +8% Financial +6% Source: Symantec Internet Security Threat

ENTERPRISE SECURITY 12

Symantec Information Protection | STRATEGY

• Extend Data and Identity protection regardless of where data resides: On Premise, On Mobile, In the Cloud

• Common SSO and Access Management regardless of where applications reside: On Premise, On Mobile, In the Cloud

• Integrated user and behavioral analytics to detect and prevent insider and outsider (APT) threats

23

Data Access

Identities

CloudSecurityBroker

Symantec Information Protection | CLOUD SECURITY BROKER

24

Cloud Security Broker

Identity &Access Control

• Visibility• Compliance

CloudSecurityBroker

• Control• Compliance

DLP Encryption MAM

• A new cloud‐based control point that integrates DLP, Identity, and Analytics

• Ensures identity and data protection between mobile users and cloud apps, independent of perimeter

• Highly contextual protection by connecting user, device, location, and data loss prevention policies

• Cloud‐based SSO with biometric authorization

• Scan and remediation of data already in cloud apps

SSO

Page 13: 05 Enterprise FAD v25-FINAL2 · Top 5 unpatched for 295 days 24 Healthcare + 37% Retail +11% Education +10% Government +8% Financial +6% Source: Symantec Internet Security Threat

ENTERPRISE SECURITY 13

Symantec Information Protection | USER AND BEHAVIORAL ANALYTICS

25

Behavioral Analytics

Integrated ThreatVisualization &

Modeling

DLPLogs

IdentityData

AccessLogs

• Integrated analytics to trackand profile behaviors and data flow

• Content, Context, and Identity aware

• Pre‐built threat models and big‐data analytics to quickly detect and prevent incidents 

• Prioritized incident management based on risk profile, risk timeline, and risk comparison 

• Industry and global intel correlation to detect coordinated attacks

Global Intelligence

Symantec Information Protection | SUMMARY OF KEY CAPABILITIES

26

Cloud Security Broker

• Data and identity protection between mobile and cloud, with no perimeter

• Highly contextual protection by connecting user, device, location, and data loss prevention policies

• Cloud‐based SSO with biometric authorization

• Scan and remediation of data already in cloud apps

User andBehavioral Analytics

• Integrated analytics to trackand profile behaviors and data flow

• Prioritized incident management

• Pre‐built threat models and big‐data analytics to quickly flag and detect incidents 

• Industry and global intel correlation to detect coordinated attacks

Page 14: 05 Enterprise FAD v25-FINAL2 · Top 5 unpatched for 295 days 24 Healthcare + 37% Retail +11% Education +10% Government +8% Financial +6% Source: Symantec Internet Security Threat

ENTERPRISE SECURITY 14

$3.2B

$4.3B

$1.5B

CY15 CY18

+35%TAM

Symantec Information Protection | KEY REVENUE OPPORTUNITIES

27

Installed Base 

• Cloud Security Broker combing identity, DLP, analytics (increasing ARPU )

• Individuals add‐ons such as DLP for Cloud apps, Cloud SSO, and Behavioral Analytics

Net New Customers moving to Cloud

• Cloud Security Broker combing identity, DLP, analytics

• Individual solutions: DLP for Cloud apps, Cloud SSO, and Behavioral Analytics

Expanded

Current

Source: IDC Security forecast and Symantec Analyses

Cyber Security Services

Unified Security Analytics Platform

Information ProtectionDATA IDENTITIES

Threat ProtectionDATA CENTER GATEWAYSENDPOINTS

CYBER SECURITY PROTECTION

28

Page 15: 05 Enterprise FAD v25-FINAL2 · Top 5 unpatched for 295 days 24 Healthcare + 37% Retail +11% Education +10% Government +8% Financial +6% Source: Symantec Internet Security Threat

ENTERPRISE SECURITY 15

SIMULATION

Cyber Security Services Market | PRIORITY ON FULL LIFECYCLE

29

LIFECYCLE

Ongoing

Monitoring

Reactive

Incident Response

TECHNOLOGY• Collection• Analytics• Dissemination

PEOPLE• Identify• Interpret• Manage

Proactive

Intelligence

Symantec Cyber Security Services | STRATEGY

Expanded services• Incident Response and Forensics services• Security Simulation Services for security preparedness and overall health checks

Scale up of existing and new services with core tech• Big Data‐based streaming & batch analytics• High speed ingestion of large and ever growing log data

Expanded global footprint• Expansion of number of SOCs globally to address demand as well as regulatory requirements

30

SECURITY SERVICE NEED SYMANTEC OFFERING

EXISTING

NEW

Adversary Threat Intelligence Service

Security Monitoring Service

Incident Response and Forensics Service

Security Simulation Service

Track & AnalyzeKey Events & Trends

Monitor Threats & Campaigns

Respond to BreachesQuickly & Effectively

Assess Security ReadinessUnder Different Scenarios

Page 16: 05 Enterprise FAD v25-FINAL2 · Top 5 unpatched for 295 days 24 Healthcare + 37% Retail +11% Education +10% Government +8% Financial +6% Source: Symantec Internet Security Threat

ENTERPRISE SECURITY 16

Symantec Cyber Security Services | SUMMARY OF KEY CAPABILITIES

31

Threat Intelligence Services

• Global Intelligence Network

• Early warning Portal

• Adversary threat intelligence

• Integrated IoCs from internal and external feeds

IR and Simulation Services

• Global team with extensive experience in forensics investigation

• Emergency/Retained/Managed options

• Integrated with SOCs to provide end to end service

• Realistic live fire training missions delivered as a SaaS solution

Security Monitoring Services

• Key technology IP for log collection, analytics, and incident investigation

• Tailored to customer maturity/industry

• High‐touch 24x7 service model

• Integration with next gen security infrastructure to detect advanced threats

Global team of 500+ threat and intel experts with unique knowledge of attack actors; Supported by Cloud‐based Big Data analytics infrastructure

$3.9B

$6.5B

$3.6B

CY15 CY18

+50%TAM

Symantec Cyber Security Services | KEY REVENUE OPPORTUNITIES

32

Net New Customers

• Integrated suite of services covering monitoring, IR, threat intelligence, and security simulation

Installed Base 

• Cross‐selling of IR and Simulation Services into Monitoring service installed base

Specific opportunities within Public Sector

• Security best practices and solutions tailored for agencies

Data residency and regulatory compliance enables expansion into new geographies

Expanded

Current

Source: Gartner and Symantec Analyses

Page 17: 05 Enterprise FAD v25-FINAL2 · Top 5 unpatched for 295 days 24 Healthcare + 37% Retail +11% Education +10% Government +8% Financial +6% Source: Symantec Internet Security Threat

ENTERPRISE SECURITY 17

Cyber Security Services

Unified Security Analytics Platform

Information ProtectionDATA IDENTITIES

Threat ProtectionDATA CENTER GATEWAYSENDPOINTS

UNIFIED SECURITY ANALYTICS

33

Security Platforms Market | FOCUS SHIFTING TO ANALYTICS

34

ATTACKS ARE INCREASINGLY SOPHISTICATED

• Micro‐targeted

• New techniques and zero day attacks

• Stealthy to remain undetected

EXISTING TECHNOLOGY CAN’T KEEP UP

• Reactive methods

• Insufficient data to findsubtle trends and patterns

• Isolated approacheswithout broader context

ANALYST FATIGUE IS RAMPANT

• Too many alerts andfalse positives

• Slow and manual detection, forensics,and remediation

RISE OF SECURITYBIG DATA ANALYTICS

Big data, analytics, and machine learning techniques needed to 

address these challenges

Page 18: 05 Enterprise FAD v25-FINAL2 · Top 5 unpatched for 295 days 24 Healthcare + 37% Retail +11% Education +10% Government +8% Financial +6% Source: Symantec Internet Security Threat

ENTERPRISE SECURITY 18

Symantec Unified Security in a Nutshell

35

WHAT IT DOES:

WHAT IT IS:

Brings in dataand events from all sources

Provides a platform to manage, store, and 

analyze the aggregated data

Enables a new breed of applications that leverages the 

aggregated intelligenceCreates a virtuous cycle

3 part ecosystem

A comprehensive Big Data Analytics platform for collecting vast security telemetry, analyzing it for local and global threats and converting the insights into secure outcomes

Unified Security Analytics Platform

Standard set of interfaces and APIs, supplied by Symantec and 3rd party security products, for contributing rich telemetry to the platform

Telemetry & APIs

Data and analytic applications built on the platform by Symantec and 3rd party ecosystem for a variety of security use cases

Unified Security Applications1 2 3

Unified Security Platform

PRESENTATION

SERVICES LAYER

DATA LAYER

CustomerPortal

Reports & Dashboards Interactive VisualizationsUnified

Incident Hub

Collection &Enrichment Services

Analytics Services(Batch & Real‐Time)

Integration Services(with Detect/Protect Engines)

CUSTOMER DATA(NON‐ANONYMIZED)

GLOBAL DATA(ANONYMIZED)

Unified Security Analytics Blueprint

36

Unified Security Applications

SYMC Unified Security offerings & apps 3rd‐party offerings & apps Managed Services (SYMC or 3rd party)

ATP: Endpoint

ATP: Network

SymGauge

ATP:Email

UIM/UII

3rd party products(e.g. Firewalls)

SYMC on‐prem products(e.g. SEP, DLP, DCS)

SYMC hosted security(e.g. Email, Web)

Cloud security(e.g. for AWS)

3rd party clouds

Telemetry & APIs

AttackDetection

Collectors and control APIs

Page 19: 05 Enterprise FAD v25-FINAL2 · Top 5 unpatched for 295 days 24 Healthcare + 37% Retail +11% Education +10% Government +8% Financial +6% Source: Symantec Internet Security Threat

ENTERPRISE SECURITY 19

Scale Drives Unified Security Analytics

37

Enables solving a whole new class of customer use cases:• Identify attacks through richer 

analytics and algorithms

• Increased visibility by connecting the dots across global telemetry

• Realization of better security outcomes

Changes the basis of competition:• Scale of security data we collect 

across endpoints, gateways, applications, and users

• Ecosystem that is difficult to replicate

• Uniquely differentiated offerings

• We already operate the largest civilian threat intelligence network on the planet

Accelerant for continued  innovation:• Platform and telemetry 

• Robust set of services with cloud‐scale architecture 

• Enablement of 3rd parties to innovate on our platform

Value Created Through Scale

38

Unified Security Analytics Applications

Unified Security Analytics Platform

Telemetry & APIs

HowWe’ll Monetize

AdditionalValue We Capture

• Access to the platform

• Encourages new analytics applications built on our vast intelligence

• More effective detecting, blocking, and remediating of attacks than anyone else

• Drive cross‐sell through increased value of all of our offerings

• Revenue share from 3rd parties

• Increased telemetry from our product drives synergy across the ecosystem

Page 20: 05 Enterprise FAD v25-FINAL2 · Top 5 unpatched for 295 days 24 Healthcare + 37% Retail +11% Education +10% Government +8% Financial +6% Source: Symantec Internet Security Threat

ENTERPRISE SECURITY 20

Sample Unified Security Analytics Applications

39

SymGauge

• Risk Advisor and Benchmarking App

• Measures and benchmarks security health, including risks arising from compromised end‐users

Targeted Attack Detection

• Crawls through global telemetry to find targeted attack IOCs and detect brand‐new targeted attacks

• Ex: find all emails sent from a given address, all files attached to those emails, all events associated with those files, etc.

Incident Investigation

• Drill into incidents to get all associated events across security control points, building out the full attack chain

• Ex: Discover when and how a threat first entered the environment

Moneyball

• Correlate security outcomes across customers with differing security controls, policies, and settings

• Quantify ROI for potential new security investments

SymGauge (“Taste Test”) Application

40

SymGaugeAutomated Taste Test

• Taste Test took 2 analysts > 6 weeks…this doesn’t scale

• Solution: automate!

• Now developing SymGauge, an automated Risk Advisor and Benchmarking application

• Narus acquisition accelerating implementation

“Taste Test” Experiment with a Large Bank

Analyzed our global SEP telemetry Found targeted attack activity

Provided analysis of exploits in use

Calculated security ranking

Analyzed our global Norton data Identified active phishing campaigns

Found “spoofed” banking apps

Showed “hygiene” of customersaccessing the bank’s site

Result: “Shocked” CISO and landed multi‐million dollar deal with a suite of offerings

Validating Our Unified Security Hypothesis 

Three questions to answer

• How useful is our data?

• Can we analyze the data to find significant threats?

• What’s the best way to monetize?

Page 21: 05 Enterprise FAD v25-FINAL2 · Top 5 unpatched for 295 days 24 Healthcare + 37% Retail +11% Education +10% Government +8% Financial +6% Source: Symantec Internet Security Threat

ENTERPRISE SECURITY 21

Agenda

41

1 Market Opportunity

2 Product Strategy

3 Roadmap & Go‐To‐Market

Symantec Enterprise Security | RAPID RELEASE CYCLES

42

Enhanced ProductNew Product

THREATPROTECTION

INFORMATIONPROTECTION

CYBERSECURITYSERVICES

UNIFIEDSECURITY ANALYTICS

Email Securitywith DLP

ATP(Network)

Cloud EndpointManagement

EndpointRemediation

Cloud Workload Protection

BiometricAuthentication

DLP/Office365

CloudSecurity Broker

User Behavioral Analytics

IdentityAs a Service

Cloud basedKey Management

IR RetainerService

ATP MonitoringService

IR Readiness Assessment

MSS Self‐Service Admin Portal

SimulationService IR Managed Service

MSS Log MgmtAs a Service

Incident Investigation App

Targeted Attack Detection App

Analytics PlatformGen. Availability

SymGaugeApp (TasteTest)

Analytics Platform Customer Preview

Analytics Platform Internal Preview

Analytics Platform3rd Party SDK

ATP(Email, Endpoint)

EndpointForensics

Datacenter SecurityAs a Service

DLP/Box.Net

DLP/SFDC & WDAY

MoneyballApp

DLPAs a Service

18 MONTH ROADMAP

Preview Releases

Page 22: 05 Enterprise FAD v25-FINAL2 · Top 5 unpatched for 295 days 24 Healthcare + 37% Retail +11% Education +10% Government +8% Financial +6% Source: Symantec Internet Security Threat

ENTERPRISE SECURITY 22

Symantec Enterprise Security | FOCUSED GO TO MARKET

43

40%More 

Quota Carrying Field Reps

MORE FEET ON THE STREET

3XMore

SolutionArchitects

MORE SECURITY EXPERTS

3XIncrease

in Coverage forGlobal Key Accounts

KEY ACCOUNT PROGRAM

1,750Strong

Enterprise Security Sales Team 

DEDICATED SALES

Complemented by Partner and Channel ecosystem with rewards re‐aligned to growth;Commercial growth through Inside Sales, with focus on SaaS, Subscriptions, and Renewals

Symantec Enterprise Security

44

Large market with 35%‐50% increase in TAM driven by new product pipeline targeting growth segments

Increasing momentum through dedicated sales focus and more quota carrying reps 

Leverage from large installed base in key segments will accelerate growth 

Unrivalled threat intelligence and telemetry drives innovative platform, products, and services 

Page 23: 05 Enterprise FAD v25-FINAL2 · Top 5 unpatched for 295 days 24 Healthcare + 37% Retail +11% Education +10% Government +8% Financial +6% Source: Symantec Internet Security Threat

ENTERPRISE SECURITY 23

Q&A

45

Jeff Scheel, SVP, Corporate Development, Alliances and Strategy 

Balaji Yelamanchili, EVP & GM, Enterprise Security Business Unit

Amit Mital, EVP, CTO & Emerging Endpoints 

Appendix

Page 24: 05 Enterprise FAD v25-FINAL2 · Top 5 unpatched for 295 days 24 Healthcare + 37% Retail +11% Education +10% Government +8% Financial +6% Source: Symantec Internet Security Threat

ENTERPRISE SECURITY 24

Protection EnginesDetection Engines

Symantec Threat Protection | PROVEN AND INNOVATIVE TECHNOLOGIES

47

Reputational

Determines the safety of files & websites using the “wisdom of the 

crowd”

Insight

Predictive Analysis

Uses predictive analysis, heuristics, and link followingto find targeted threats

Skeptic

Detonation

Cloud based sandboxing and detonation engine for malware analysis

CynicCorrelation

Correlates security events across the control points

Synapse

Blocking Exploits

Blocks exploits of known & unknown vulnerabilities

PEP

Behavior Analysis

Finely tuned and highly performant engine that 

enables flight recorder‐like system monitoring

SONAR

Symantec Info Protection | PROVEN AND INNOVATIVE TECHNOLOGIES

48

Validation EnginesContent Engines

ExactData Matching

Precise detection technology with high precision match 

and eliminate all FPs

IndexedData Matching

Fuzzy matching of indexed files (office, PDF, etc..) based on templates

VirtualizedIdentity

Maps identities from any directory, database, or user store to create a virtual 

identity

CryptoCloud

Cloud vault for all types of crypto keys (asymmetric and 

symmetric)

Cert ValidationEngine

Verifies wide range of digital identities, including website identities (SSL) and user credentials (PKI, VIP)

Vector Machine Learning

Supervised learning classifier; “zero‐day protection” for 

confidential data