Sophos Group plc Capital Markets Day June 29, 2016

Safe Harbour The following presentation is being made only to, and is only directed at, persons to whom such presentation may lawfully be communicated (“relevant persons”). Any person who is not a relevant person should not act or rely on this presentation or any of its contents. Information in the following presentation relating to the price at which relevant investments have been bought or sold in the past or the yield on such investments cannot be relied upon as a guide to the future performance of such investments. This presentation does not constitute an offering of securities or otherwise constitute an invitation or inducement to any person to underwrite, subscribe for or otherwise acquire securities in Sophos Group plc (the “Company”) or any company which is a subsidiary of the Company. The release, publication, or distribution of this presentation in certain jurisdictions may be restricted by law, and therefore persons in such jurisdictions into which this presentation is released, published or distributed should inform themselves about, and observe, such restrictions. Certain statements contained in this presentation constitute forward-looking statements. All statements other than statements of historical facts included in this presentation, including, without limitation, those regarding the Company’s financial condition, business strategy, plans and objectives, are forward-looking statements. These forward-looking statements can be identified by the use of forward-looking terminology, including the terms “believes”, “estimates”, “anticipates”, “expects”, “intends”, “may”, “will”, or “should” or, in each case, their negative or other variations or comparable terminology. Such forward-looking statements involve known and unknown risks, uncertainties and other factors, which may cause the actual results, performance or achievements of the Company, or industry results, to be materially different from any future results, performance or achievements expressed or implied by such forward-looking statements. Such forward-looking statements are based on numerous assumptions regarding the Company’s present and future business strategies and the environment in which the Company will operate in the future. Such risks, uncertainties and other factors include, among others: inherent difficulty in predicting customer behaviour; customers may not respond as we expected to our sales and marketing activities; the competitive environment; our ability to adapt to technological change; business interruption or failure of our systems architecture and communication systems; problems with implementing upgrades to our applications and supporting information technology infrastructure; any failure to properly use and protect personal customer information and data; our ability to manage and maintain third party business partnerships; increased regulation of our businesses; any failure to process transactions effectively; any failure to adequately protect against potential fraudulent activities; any significant quality problems or delays; the global macro-economic environment; our inability to attract, retain and develop talented people; our ability to repurchase shares; our inability to adequately protect our intellectual property rights; disruptions, expenses and risks associated with any acquisitions and divestitures; amortisation of acquired intangible assets and impairment charges; our use of debt to finance acquisitions or other activities; and the cost of, and potential adverse results in, litigation involving intellectual property, competition authority, shareholder and other matters. These forward-looking statements speak only as at the date of this presentation. Except as required by the Financial Conduct Authority, or by law, the Company does not undertake any obligation to update or revise publicly any forward-looking statement, whether as a result of new information, future events, or otherwise.

2

Agenda Strategy Product Overview Sophos Central Enduser Network Strategy and Product Q&A session Break Go-To-Market Channel strategy Marketing GTM Q&A session Finance Finance Q&A Summary and Wrap Up

Kris Hagerman

20

Joe Levy Bill Lucchini John Shaw Bryan Barney Kris, Joe, Bill, John, Bryan

20 15 20 20 20 20

Mike Valentine Matt Fairbanks Mike and Matt Nick Bray Nick Bray Kris Hagerman

10 10 15 25 20 10 3

Today’s Presenting Team Kris Hagerman

Joe Levy

Bill Lucchini

Chief Executive Officer

Chief Technology Officer

SVP & GM, Cloud Security Group

John Shaw

Bryan Barney

VP of PM, Endpoint Security

SVP, Network Security

Matt Fairbanks

Nick Bray

Chief Marketing Officer

Chief Financial Officer

Mike Valentine SVP, Worldwide Sales

4

Strategy Kris Hagerman Chief Executive Officer

Sophos Snapshot Scale, above-market growth, healthy profitability, visibility and sustainability FY16

Compelling Industry Fundamentals

+19.7%

Security consistently is the top priority for corporate IT spend

$38B

Like-for-like billings growth(2)

7%

TAM (1)

CAGR (1)

$534.9M Reported billings(3)

Complete CloudEnabled Security Offering for MidMarket

Only player focused on the mid-market with a comprehensive endpoint and network offering

Large (5)

18%

50% Network

56%

Mid-Market

26%

SMB

+13.4%

5% Other 45% Enduser

Enduser like-for-like billings growth(2)

+27.5%

Integrated through Sophos Central

Network like-for-like billings growth(2)

101.9% Highly Efficient Sales Model

100% “channel first” approach delivers scale and operating leverage

800+ Sophos Partner Reps & Sales Engineers

Work with

20,000+ Partners

175,000+ Who deliver

Sales Reps

65,000+ Sales Engineers

Renewal rate including up-sell and cross-sell

22.6% Cash EBITDA margin(4)

6

Mission

Strategy Security only

To be the best in the world at delivering complete IT security to mid-market enterprises and the channel that serves them

Focus on mid-market enterprises Complete security – Made simple Managed and delivered through the cloud Integrated Next Gen endpoint and network security ‘Channel First’ sales model

7

Synchronized Security Platform and Strategy Admin | Manage All Sophos Products

Self Service | User Customizable Alerts

Partner | Management of Customer Installations

Sophos Central In Cloud

On Prem

UTM/Next-Gen Firewall

Endpoint/Next-Gen Endpoint

Wireless

Mobile

Email

Server

Web

Encryption

Cloud Intelligence Analytics | Analyze data across all of Sophos’ products to create simple, actionable insights and automatic resolutions Sophos Labs | 24x7x365, multi-continent operation |

URL Database | Malware Identities | File Look-up | Genotypes | Reputation | Behavioural Rules | APT Rules Apps | Anti-Spam | Data Control | SophosID | Patches | Vulnerabilities | Sandboxing | API Everywhere

8

Robust Innovation Pipeline for FY17 ENDPOINT

• Next Gen Endpoint: Exploit Prevention, Anti-Ransomware, Root Cause Analysis • Sophos Clean • Role-based Administration in Sophos Central

MOBILE

• • • •

Unified Endpoint Management Security Heartbeat Sophos Central managed Full EMM iOS Mobile Security

SERVER

• • • •

Hyper-V protection AWS Auto-scaling MTD for Linux, Windows Security Heartbeat

ENCRYPTION

UTM/NGFW

WIRELESS

EMAIL

• Synchronized Encryption • Sophos Central managed Full Disk Encryption • Multiple Key Support WEB

• • • •

Sophos UTM 9.5 XG Firewall and Firewall Manager v16 New Synchronized Security Use Cases New XG Series Appliances

• Sophos Central managed Wireless • New Sophos Secure Access Points • New XG 1x Series Wireless Appliances • • • •

Sophos Central managed Sophos Email Time of Click Protection New Anti-Spam Engine New Sophos Email Appliances

• • • •

Global Sophos Central managed SWG Next-Gen Web Protection Hybrid On-Prem and Cloud Model Simplified licensing and pricing 9

Competitor Landscape Mid Market Centric

Mid Market Centric

Mid Market Centric

Mid Market Centric

Mid Market Centric

Network Leader

Network Leader

Network Leader

Network Leader

Network Leader

Endpoint Leader

Endpoint Leader

Endpoint Leader

Endpoint Leader

Endpoint Leader

Sync Security

Sync Security

Sync Security

Sync Security

Sync Security

Channel First

Channel First

Channel First

Channel First

Channel First

Mid Market Centric

Mid Market Centric

Mid Market Centric

Mid Market Centric

Mid Market Centric

Network Leader

Network Leader

Network Leader

Network Leader

Network Leader

Endpoint Leader

Endpoint Leader

Endpoint Leader

Endpoint Leader

Endpoint Leader

Sync Security

Sync Security

Sync Security

Sync Security

Sync Security

Channel First

Channel First

Channel First

Channel First

Channel First 10

Multiple Growth Drivers • Large and rapidly growing market o o o o

$38B market growing at 7% per year Sophos addressable market $15B+ growing at 7%+ Approximately 60% of this market is SMB and mid-market Over 60M small and mid-market enterprises worldwide

• Market share expansion o

Appx. 5% share of enduser security market and 5% share of network security market: plenty of “running room”

• Continued global expansion o

Growth opportunities in multiple underpenetrated regions, including US, LatAm, Asia Pacific and others

• Innovation and disciplined M&A to drive new sales opportunities with existing customers and enter new, adjacent markets o

Next-Gen Endpoint, cloud-managed Wi-Fi, cloud-managed Email security, cloud-managed Web security, analytics

• Continue to leverage Channel First sales model o o o

Recruit more partners Turn more of the existing partner base into “Blue Chip” partners Drive greater productivity, share of customers, and share of customer IT security wallet among Blue Chip partners

• Significant up-sell and cross-sell opportunities o

Leverage Sophos Central platform across entire portfolio to help partners drive up-sell and cross-sell 11

Product Overview Joe Levy Chief Technology Officer

Top Security Trends Megatrends

Paradox of Encryption

Cloud, Mobile and IaaS driving CASB, EMM, and data protection

Pervasive SSL inhibits network decryption, requiring collaboration with endpoints for content visibility

Public/Private Sector Encryption Tensions

Ransomware and Cryptoware

Apple/FBI, GDPR mandates, #nobackdoors

IoT Expands Attack Surfaces

A $325M “business”, demands NGEP solutions

Common-mode Failures

Devices need protections at the network level

The Internet is built on common components, vulnerabilities must be mitigated before patching can occur

Lack of Defender Coordination

Cybersecurity Skills Gap

Analytics showing promise as it matures from novelty to utility

Enterprises increasingly cite a shortage of security professionals, driving the need for simplicity

C-level Spear Phishing (“Whaling”)

Risk-Based Approach to Security

Increasing attack professionalism requires better training and detection tools

Enterprises are learning to quantify risk, and are beginning to match controls to attack surface 14

Security Automation / Risk Quantification

CONTROLS

RISK BASED ROI

Endpoint AV

User Behavior Analytics

URL Filtering

Encryption Email Security

NextGen Firewall

WAF

Threat Intel SIEM

Sandboxing NextGen EP

DLP CASB

1%

THREATS

THE 99%

Off the shelf Exploit Kits

COMPLEXITY

Executable Malware

Doc / Script Malware

Deception Networks / DDW monitoring

Data Leakage

Bespoke 0days Targeted Injection Phishing Malware Attacks

Long dwell Campaigns Insider movement PTH, Skeleton Key, Golden Ticket

Critical Infrastructure / Nation-State Attacks

Supply Chain Integrity Compromises

TIME 15

Security Automation / Risk Quantification

CONTROLS

RISK BASED ROI

Endpoint AV

User Behavior Analytics

URL Filtering

Encryption Email Security

NextGen Firewall

WAF

Complete

CASB

System

Threat Intel SIEM

Sandboxing NextGen EP Simple

1%

THREATS

THE 99%

Off the shelf Exploit Kits

COMPLEXITY

Executable Malware

Deception Networks / DDW monitoring

Doc / Script Malware

Data Leakage

Bespoke 0days Targeted Injection Phishing Malware Attacks

Long dwell Campaigns Insider movement PTH, Skeleton Key, Golden Ticket

Critical Infrastructure / Nation-State Attacks

Supply Chain Integrity Compromises

TIME 16

Synchronized Security Platform and Strategy Admin | Manage All Sophos Products

Self Service | User Customizable Alerts

Partner | Management of Customer Installations

Sophos Central In Cloud

On Prem

UTM/Next-Gen Firewall

Endpoint/Next-Gen Endpoint

Wireless

Mobile

Email

Server

Web

Encryption

Cloud Intelligence Analytics | Analyze data across all of Sophos’ products to create simple, actionable insights and automatic resolutions Sophos Labs | 24x7x365, multi-continent operation |

URL Database | Malware Identities | File Look-up | Genotypes | Reputation | Behavioural Rules | APT Rules Apps | Anti-Spam | Data Control | SophosID | Patches | Vulnerabilities | Sandboxing | API Everywhere

17

Synchronized Security Platform and Strategy Admin | Manage All Sophos Products

Self Service | User Customizable Alerts

Partner | Management of Customer Installations

Sophos Central In Cloud

UTM/Next-Gen Firewall

On Prem

Heartbeat

Endpoint/Next-Gen Endpoint

Wireless

Mobile

Email

Server

Web

Encryption

Cloud Intelligence Analytics | Analyze data across all of Sophos’ products to create simple, actionable insights and automatic resolutions Sophos Labs | 24x7x365, multi-continent operation |

URL Database | Malware Identities | File Look-up | Genotypes | Reputation | Behavioural Rules | APT Rules Apps | Anti-Spam | Data Control | SophosID | Patches | Vulnerabilities | Sandboxing | API Everywhere

18

Synchronized Security Platform and Strategy Admin | Manage All Sophos Products

Self Service | User Customizable Alerts

Partner | Management of Customer Installations

Sophos Central In Cloud

UTM/Next-Gen Firewall

On Prem

Unknown App ID

Endpoint/Next-Gen Endpoint

Wireless

Mobile

Email

Server

Web

Encryption

Cloud Intelligence Analytics | Analyze data across all of Sophos’ products to create simple, actionable insights and automatic resolutions Sophos Labs | 24x7x365, multi-continent operation |

URL Database | Malware Identities | File Look-up | Genotypes | Reputation | Behavioural Rules | APT Rules Apps | Anti-Spam | Data Control | SophosID | Patches | Vulnerabilities | Sandboxing | API Everywhere

19

Synchronized Security Platform and Strategy Admin | Manage All Sophos Products

Self Service | User Customizable Alerts

Partner | Management of Customer Installations

Sophos Central In Cloud

On Prem

UTM/Next-Gen Firewall

Endpoint/Next-Gen Endpoint

Wireless

Synchronized Encryption

Email Web

Mobile Server Encryption

Cloud Intelligence Analytics | Analyze data across all of Sophos’ products to create simple, actionable insights and automatic resolutions Sophos Labs | 24x7x365, multi-continent operation |

URL Database | Malware Identities | File Look-up | Genotypes | Reputation | Behavioural Rules | APT Rules Apps | Anti-Spam | Data Control | SophosID | Patches | Vulnerabilities | Sandboxing | API Everywhere

20

Synchronized Security Platform and Strategy Admin | Manage All Sophos Products

Self Service | User Customizable Alerts

Partner | Management of Customer Installations

Sophos Central In Cloud

UTM/Next-Gen Firewall

On Prem

Lateral Movement Protection

Endpoint/Next-Gen Endpoint

Wireless

Mobile

Email

Server

Web

Encryption

Cloud Intelligence Analytics | Analyze data across all of Sophos’ products to create simple, actionable insights and automatic resolutions Sophos Labs | 24x7x365, multi-continent operation |

URL Database | Malware Identities | File Look-up | Genotypes | Reputation | Behavioural Rules | APT Rules Apps | Anti-Spam | Data Control | SophosID | Patches | Vulnerabilities | Sandboxing | API Everywhere

21

Synchronized Security Platform and Strategy Admin | Manage All Sophos Products

Self Service | User Customizable Alerts

Partner | Management of Customer Installations

Sophos Central In Cloud

On Prem

UTM/Next-Gen Firewall

Endpoint/Next-Gen Endpoint

Wireless Email

Mobile

Synchronized Phishing Protection

Web

Server Encryption

Cloud Intelligence Analytics | Analyze data across all of Sophos’ products to create simple, actionable insights and automatic resolutions Sophos Labs | 24x7x365, multi-continent operation |

URL Database | Malware Identities | File Look-up | Genotypes | Reputation | Behavioural Rules | APT Rules Apps | Anti-Spam | Data Control | SophosID | Patches | Vulnerabilities | Sandboxing | API Everywhere

22

Synchronized Security Platform and Strategy Admin | Manage All Sophos Products

Self Service | User Customizable Alerts

Partner | Management of Customer Installations

Sophos Central In Cloud

On Prem

UTM/Next-Gen Firewall Wireless Email

Endpoint/Next-Gen Endpoint

Continuous Authentication

Web

Mobile Server Encryption

Cloud Intelligence Analytics | Analyze data across all of Sophos’ products to create simple, actionable insights and automatic resolutions Sophos Labs | 24x7x365, multi-continent operation |

URL Database | Malware Identities | File Look-up | Genotypes | Reputation | Behavioural Rules | APT Rules Apps | Anti-Spam | Data Control | SophosID | Patches | Vulnerabilities | Sandboxing | API Everywhere

23

Sophos Central Bill Lucchini SVP and General Manager, Cloud Security Group

Synchronized Security Platform and Strategy Admin | Manage All Sophos Products

Self Service | User Customizable Alerts

Partner | Management of Customer Installations

Sophos Central In Cloud

On Prem

UTM/Next-Gen Firewall

Endpoint/Next-Gen Endpoint

Wireless

Mobile

Email

Server

Web

Encryption

Cloud Intelligence Analytics | Analyze data across all of Sophos’ products to create simple, actionable insights and automatic resolutions Sophos Labs | 24x7x365, multi-continent operation |

URL Database | Malware Identities | File Look-up | Genotypes | Reputation | Behavioural Rules | APT Rules Apps | Anti-Spam | Data Control | SophosID | Patches | Vulnerabilities | Sandboxing | API Everywhere

26

Sophos Central

27

Sophos Central: Admin Dashboard User-Centric Unified

Powerful Simple Fast

28

Sophos Central: Self Service

29

Sophos Central: Partner Dashboard Partner-Centric Portfolio Mgmt.

MSP License Mgmt. Trial to Purchase

30

Sophos Central: Partner View View Upsell Opportunities View Renewal Opportunities Easily Manage Licenses

31

FY16 Sophos Central Launches Security Heartbeat

Download Reputation

Updated Email Alerts

Endpoint Update Caching

Application Control Mobile Security Server Lockdown

AD Sync Filters Groups

Locate for Mobile Localization Web Gateway: Win/Mac

Endpoint for Linux

Web Gateway: iOS

vShield

Web Gateway: Chromebook 32

Sophos Central: Fastest Growing Solution in Sophos History 12,000k 3,000

92% Growth

220% Growth

10,000k

in Active Partners

in Billings

2,500

8,000k

6,000k

2,000

77% of billings come from 4,000k

competitive wins 1,500

2,000k

0k

1,000 Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Jan

Feb

Mar

Q1FY14 Q2FY14 Q3FY14 Q4FY14 Q1FY15 Q2FY15 Q3FY15 Q4FY15 Q1FY16 Q2FY16 Q3FY16 Q4FY16

33

Enduser Products John Shaw VP Product Management ESG

% of Enduser Billings (1)

Products

Enduser Security: Product Overview (13% Growth) Endpoint Protection

Mobility Management

Server Protection

Data Protection

Endpoint Standard

Mobile Control

Server Standard

Device Encryption

Endpoint Advanced

Mobile Security

Server Advanced

File Encryption

Endpoint Intercept

11%

67%

Note: 1. Figures refer to FY16 on a like-for-like basis

14%

8%

36

Sophos Enduser Security Strategy Innovate to Enhance and Expand Existing Business and Enter Exciting Adjacent Growth Opportunities

Signature-less Next-Gen Protection

Secure the (Mobile) Device

Across Windows, Mac, Linux and Android

Secure phones and tablets like any other endpoint

Secure the Servers

Next Gen Encryption

Protection optimized for servers (physical, virtual and IaaS)

Encrypt Everything, All the time, Everywhere Hacker-Proof Encryption

Highlights Schrodinger

Exploit Prevention

Secure BYOD

IaaS (AWS / Azure)

CryptoGuard

Root Cause Analytics

Application Reputation

Synchronized security

37

Schrodinger: Driving Cross-Sell

Sophos Central Endpoint Protection

Mobility Management

Server Protection

Data Protection

Feature parity in Sophos Central Management capabilities for larger organisations On premise version

38

Sophos Next-Gen Endpoint Next-Gen Advanced Exploit Prevention

Cryptoguard

Application Lockdown

Exploit

Behavior

Whitelist

Crowd Sourced Reputation

Device Control App Control Web Control

Exposure Web Protect DLP

Synchronized Security

Delivery Behavior Collaborate

Prevent

Surface

Malicious Traffic Detection

On Device Emulation

Signatureless cleanup

Network Isolation Key Revoke/Restore

Investigate

Clean

Posture

Respond

Detect

Emulation

Root Cause Analysis

Behavior

Execute

Remediate

HIPS/Behavior Monitoring

File Heuristics Signatures

Quarantine Malware Removal

Traditional

39

Exploit Prevention and Next-Gen Endpoint Protection

ANNUAL NEW MALWARE SAMPLES

100,000,000s

ANNUAL KNOWN EXPLOITS (CVE’S) CUMULATIVE KNOWN EXPLOIT TECHNIQUES

1,000s

24 40

Next-gen Endpoint: Root Cause Analytics

41

Mobile Strategy: Manage, Secure + Protect Data An Endpoint Is an Endpoint Is an Endpoint

42

Server Protection Strategy ADDING NEXT GEN PROTECTION

TODAY

MTD Antimalware

Lockdown

MTD

Server Spectrum Cryptoguard

Optimized for performance

PHYSICAL

•Optimize performance •Lightweight agent

VIRTUAL

•Performance is key •Agentless/Light agent

IaaS

•On-demand resources •Usage based licensing 43

Two Types of Encryption: Both Are Needed FULL DISK ENCRYPTION

FILE ENCRYPTION Protects against device theft or loss

Secures data even if system is hacked or compromised Secures data even if exfiltrated

Helps to protect against insider threats Secures sensitive email Secures data stored in the cloud Secures data stored on mobile devices and elsewhere 44

Synchronized Encryption: A New Paradigm in Data Protection Encrypt Everything, Everywhere, Automatically “By 2019, 25% of security spend will be driven by EU data protection regulation and privacy concerns.” - IDC

Synchronized with Endpoint Protection

User Integrity

App Integrity

System Integrity 45

Network Products Bryan Barney SVP and General Manager NSG

Network Security: Product Overview (28% Growth)

Products

UTM/Next-Gen Firewall UTM/Next-Gen Firewall  IPS  Application control  User-based policies  Web filtering  Email security RED

AP15, 55, & 100 (wireless access points)

Sophos UTM for AWS

Email Security Secure Email Appliance Virtual Email Appliance

SG105W/115W/125W/ 135W (desktop UTMs with built in wireless)

iView Reporting Sophos UTM Manager

% of Network Billings (1)

Secure Wi-Fi

Sophos Wireless (Beta cloud managed wireless access points)

4%

PureMessage for Unix PureMessage for Exchange

Web Security Secure Web Appliance

Virtual Web Appliance Cloud Web Gateway (cloud-based web security)

Sophos Email (Beta: cloud-based email security)

11%

4%

81%

Note: 1. Figures refer to FY16 on a like-for-like basis

48

Sophos Network Security Strategy Innovate to Enhance and Expand Existing Business and Enter Exciting Adjacent Growth Opportunities

Accelerate NGFW/UTM Combine the strengths of Sophos and Cyberoam

Become a Leader in Wireless Leveraging UTM/NGFW, build a cloud-managed wireless product line

Grow Secure Email Gateway

Grow Secure Web Gateway

Consolidate technology and launch a cloud offering

Consolidate technology and create hybrid offerings

Highlights IaaS (AWS / Azure)

Integrate with Sophos Central

Advanced security

Converged architectures

Performance

Synchronized security

49

UTM/Firewalls: Two Platforms with Competitive Advantage SG UTM Trusted platform getting stronger

• Solid, stable platform customers and partners know and love

• Sophos Sandstorm in v9.4 • WAF and VPN enhancements in v9.5 • Future-proofed and ready for SF-OS whenever customers/partners choose

XG Firewall New platform for an exciting future

• Combined platform with the best features of SG UTM 9 and Cyberoam • Feature superset of Sophos SG UTM • Simplified user experience • Comprehensive central management solution on-prem and in the cloud • Enhanced Synchronized Security 50

SFOS v16 User Interface (UTM/NGFW) administrator

51

Sophos Wireless Strategy Sophos UTM Wi-Fi: • Strong solution, good features •UTM 50%+ YoY fastest NSG growth •Wi-Fi Expanding hardware portfolio

MARKET FORCES

Proliferation of Wi-Fi across enterprises of every size

Opportunities to accelerate growth: • Improved performance / scale • Separation of admin privilege • Competitive in pure Wi-Fi opportunities

Differentiate

Simplified Experience

UTM Managed Improved scalability Benefit from cloud Seamless migration

Visibility and Reporting

Cloud Managed

Synchronized Security

Better scalability Faster innovation New sales opps

Next-Gen Protection 52

Sophos Email Strategy Sophos Email solutions: • Powerful security features • Strong industry reputation • Evolving portfolio

MARKET FORCES

Office 365 Adoption Increased Threat Vector

Opportunities for Growth: • Secure Office 365 • Protect against evolving threats • Support global compliance landscape

Differentiate

Synchronized Security

UTM Managed Managed Appliance ATP Features Encryption DLP

Simplified Experience Data Protection Next-Gen Protection

Cloud Managed Proven security Office 365 integration Self-Service Portal Continuity

53

Sophos Web Protection Strategy Endpoint Endpoint Advanced

• Web control • Category-based web filtering enforced on and off the corporate network

Cloud

Appliance

UTM/Firewall

Web Standard

• All the features Sophos UTM customers receive today • Web category policies • Web malware detection • On-prem reporting (iView) • Optional cloud sandbox

Web Advanced

• • • • • •

Web Standard + Extra SWA 4.x features Cloud reporting Hybrid enforcement Web DLP (future) CASB visibility (future) 54

Product Q&A Session

Channel Strategy Mike Valentine SVP of Worldwide Sales

High-Quality and Fast-Growing Channel Ecosystem Sophos ‘Blue Chip’ Partner Growth (1)

Distributors

National Resellers

Sampling of VARs

4800 4700 4600 4500 4400 4300 4200 4100 4000 3900 3800 3700 3600 3500 3400 3300 3200 3100 3000 2900 2800 2700 2600 2500 2400 2300 2200 2100 2000 Q1

Q2

Q3

Q4

Q1

Q2

Q3

Q4

Q1

Q2

Q3

Q4

FY 2014 FY 2015 FY 2016 Note: 1. Blue chip partners defined as partners transacting 5 or more deals in trailing 6 months

58

‘Channel First’ Approach Drives Reach and Leverage Key Elements

Key Benefits

1

Commitment to channel at the top

2

Attractive program: discounts, tiers, etc.

3

Effective training and certification

4

1

Greater customer reach and touch

2

Lower go-to-market costs

High quality products

3

More predictable billings

5

Channel-focused sales executives

4

Faster to scale

6

High quality partner marketing and partner enablement

7

Opportunity to cross-sell other products and services

5

Increased customer satisfaction

8

No direct sales destroying channel trust/loyalty Best-in-Class Reach and Leverage

800+ Sophos Partner Reps and Sales Engineers

Work with

20,000+ Partners

Who Deliver

175,000+ 65,000+

Sales Reps Sales Engineers

59

Sophos Sweeps Prestigious CRN ARC Awards WINNER

2015 CLIENT SECURITY

WINNER

2015

Sophos is the first-ever winner in all THREE security categories two years running

Source: CRN 2015

CLIENT SECURITY OVERALL SCORE

OVERALL SCORE

WINNER

NETWORK SECURITY

NETWORK SECURITY

90.4

74.9

76.3

91.8

81.8

80

79.4

91.6

90.6

79.5

77.3

NETWORK SECURITY APPLIANCE

NETWORK SECURITY APPLIANCE

2015

93.2

OVERALL SCORE

60

Why Are Partners Joining Sophos

Sophos Central

Next-Gen Endpoint (Intercept)

Synchronized Security

61

Marketing Matt Fairbanks Chief Marketing Officer

What Does Marketing Do?

AWARENESS

DEMAND GEN

ENABLEMENT 64

Consistent Growth in the Marketing Funnel

WEBSITE VISITORS

+40% +58% +92%

Marketing Contacts MARKETING CONTACTS QUALIFIED LEADS

Qualified Leads

WON Closed Business Q2 Q3 Q4 Q1 Q2 Q3 Q4 Q1 Q2 Q3 Q4 FY14 FY14 FY14 FY15 FY15 FY15 FY15 FY16 FY16 FY16 FY16

65

Awareness

67

“There are zero reasons for a home user to pay for AV now . . . and permachine web-filters are a huge bonus for us parents!!”

Sophos Home

350,000+

45

19

Accounts Created

NPS Score

Industry Avg.

400,000

Brad Call, Internal I.T. Ltd.

“I've found it to be easy to use, reliable, and not heavy on system resources. It's also picked up on every bit of malware that I've been able to throw at it.”

350,000 300,000 250,000

200,000

ZD Net Review

150,000 100,000 50,000

Jun

May

APR

MAR

FEB

JAN

DEC

NOV

0

“Very unobtrusive program, doesn't have constant nag windows trying to get me to upgrade. If I wanted to be nagged to death I would go talk to my ex-wife.”

Anonymous IT Administrator

EXCELLENT 68

Sophos Partner Program: Marketing Tools

Partner Portal

• • • • • • •

Simple quoting and deal registration Online training and certification Partner demand gen campaigns Sophos website-in-a-box and marketing service center Asset registration and reporting Renewal tracking Sales tools, price configurator, battlecards

Partner App

• • • • •

Partner Portal in your pocket View and register for Sophos events Rate presenters at events / feedback Sophos news and alerts Webcasts / podcasts on the go

69

Sophos Partner Program: Marketing Campaigns Partner Recruitment

Partner Campaigns

Ransomware

Encryption

Endpoint Comparison

HIPAA Compliance

Synchronized Security

Virtualization Security

• Digital awareness with channel media and PR outreach • Active partner recruitment at industry events • Disti-led partner recruitment efforts

Partner Spend Emails

7 Deadly IT Sins

XG Firewall

UTM Elevated 9.4

Landing Page Sophos vs. Symantec

TMG Replacement

Sophos vs. Websense

Banner Ads

• 55% of discretionary marketing spend on channel “to” and “thru” efforts • Funding skewed heavily to largest partners who drive the most volume • e.g., 46% YoY billings growth at CDW 70

Go-To-Market Q&A Session

Finance Nick Bray Chief Financial Officer

Billings Trends

High-teens growth with contribution from Network and Enduser 534.9

LIKE-FOR-LIKE BILLINGS GROWTH ($M) 476.0 30.7%

28.2

31.2%

UTM 27.5%

NETWORK 23.9%

18.0%

19.7% 17.5% 13.0%

GROUP

OTHER

388.1 25.5

158.5

41%

ENDUSER

204.1

53%

5%

266.7

50%

238.2

45%

6%

6%

NETWORK

534.9 30.0

223.7

47%

224.1

47%

13.4%

ENDUSER

8.9%

4.3% 0.5%

FY14

FY15

FY16

FY14

FY15

FY16 74

New and Existing Customer Billings

New business to brand new customers has improved growth; aided by improvement in the renewal rate

New Customer Metrics

Existing Customer Metrics

FY15

FY16

Partners

15K

20K

Customer Billings(5) YOY

Blue Chip partners (>5 orders last 6 mo.)

3.4K

4.7K

Renewal rate

Number of customers

200K

220K

Cross-sell % Endpoint / UTM

New Customer Billings(5) YOY

FY15

FY16 19.7%

100.2% 101.9% 5.6%

7.4%

33.0%

Significant Enduser recovery New Customer Enduser Billings(5) YOY

FY14

FY15

FY16

-20.8%

16.3%

28.3%

75

Long-Term Stability of Billings

Majority of current year billings are available for renewal three years out; hence growth of the existing customer base takes time yet is very robust EXAMPLE NEW BILLINGS ($M)

Average billings length has remained consistent over time (FY16: 28.6 months; FY15: 28.0 months)

EXAMPLE AVAILABLE FOR RENEWAL ($M) AS EXISTING CUSTOMER BILLINGS

100.0 4.0 6.0

5 Year Subscription 4 Year Subscription

48.0

3 Year Subscription

9.0

2 Year Subscription 48.0

33.0

1 Year Subscription

33.0 9.0

FY16

6.0

4.0

FY16 FY17 FY18 FY19 FY20 FY21

76

Cumulative Effect of New Billings New billings continually adding to the existing customer base EXAMPLE AVAILABLE FOR RENEWAL ($M) AS EXISTING CUSTOMER BILLINGS 1 Year Subscription 2 Year Subscription 3 Year Subscription 4 Year Subscription 5 Year Subscription

EXAMPLE OF CUMULATIVE EFFECT ($M)

48.0 48.0

9.0

6.0 9.0 4.0 9.0

FY29

FY28

FY27

FY26

FY25

FY24

FY23

FY22

FY21

FY20

FY19

FY18

FY17

FY16 FY17 FY18 FY19 FY20 FY21 FY22

FY16

33.0 33.0 33.0 33.0 33.0 33.0

• The renewal rate (FY16: 101.9%) reflects a sticky existing customer base… • …Which with the cumulative effect of new billings translates to a solid opening base level of billings at the start of each year (rather than starting each year at zero)… • …From which the Group can then grow… • …Supporting growth momentum and providing visibility 77

Short-Term Billings Visibility and Sustainability

FY17 renewal base for existing subscription billings up c.11%(6); majority of subscription contracts are from renewals and hence expected to increase double digit even without further improvement in the retention rate

Growth Growth (AR) (LFL)

Billings, $M FY16 rates

FY15

FY16

Subscription

384.9

422.8

9.8%

16.5%

Hardware

78.4

99.0

26.3%

37.7%

Other

12.7

13.1

3.1%

10.2%

Total billings

476.0

534.9

12.4%

19.7%

• Subscription billings split c.$333M from existing customers and c.$90M from new customers • FY17 renewal base for existing subscription billings up c.11% 78

Billings by Region and EMEA Currency

Strong diversification of billings by market; modest UK domestic exposure EMEA Billings

534.9

16%

476.0

14% 67.6 388.1

APJ

47.6

12% 152.9

AMERICAS

EMEA

124.6

215.9

FY14

32%

264.0

83.0

187.9

35%

% EMEA

% TOTAL

24.0

6% 9%

3% 4%

GBP

66.8

25%

12%

EUR

159.0

60%

30%

OTHER USD

14.2

32%

56%

255.5

FY15

54%

264

FY16

49%

FY16

Sterling and Euro costs at 20% and 26%, respectively

79

Billings to Revenue Example

Current-year billings recognised as revenue over term of contract Billings

Revenue Recognition

FY16

FY16

FY17

FY18

FY19

Customer 1 – 1 year subscription

100

50

50

Customer 2 – 2 year subscription

100

25

50

25

Customer 3 – 3 year subscription

100

17

33

33

17

Customer 4 – Hardware

100

100

400

192

133

58

17

• Three brand new customers purchasing subscriptions in the middle of FY16 of one, two and three year durations • One brand new customer purchasing hardware • Cash received up-front on standard credit terms • Subscription billings recognised over the term of the contract • Hardware billings recognised upfront 80

Subscription Billings to Revenue

Billings flow more evenly to revenue; yet not linear due to mix of contract terms EXAMPLE NEW BILLINGS ($M) 100.0 4.0 6.0

5 Year Subscription 4 Year Subscription

48.0

3 Year Subscription

EXAMPLE REVENUE RECOGNITON ($M)

16.5

9.0

33.0

2 Year Subscription

1 Year Subscription

16.5

4.5

2.3

2.3

16.0

16.0 8.0

8.0

FY16

0.8

1.5

1.5

1.5

0.8

FY16

FY17

FY18

FY19

FY20

FY21 81

Revenue by Source

Revenue in the main reflects past billings performance REPORTED BILLINGS BY TYPE ($M)

HARDWARE +26.3% 18.5% of billings OTHER +3.1% 2.5% of billings

REPORTED REVENUE BY SOURCE ($M)

534.9 99.0 13.1

478.2

20.5% of total revenue from FY16 hardware billings(7) 26.9% of total revenue from FY16 subscription and other billings

SUBSCRIPTION +9.8% 79.0% of billings

98.1

128.7

422.8

52.6% of total revenue brought forward deferred revenue FY16

251.4

FY16

286.5

FY17

Over half of FY16 revenue from opening deferred revenue balance; hardware billings have an immediate effect; current year subscription billings mostly benefit future years 82

Deferred Revenue Analysis

14.0% increase YOY in revenue to be recognised within one year

$M

FY14

FY15

FY16

498.7 16.1

Billings Revenue recognised

388.1

476.0

534.9

(378.8) (446.7) (478.2) 9.3

29.3

56.7

Translation and other adjustments

12.8

(43.8)

8.7

Net movement

22.1

(14.5)

65.4

Net deferral

Deferred revenue – b/f

425.7

447.8

433.3

Deferred revenue – c/f

447.8

433.3

498.7

433.3

58.4

12.9

TOTAL +15.1% >3 YEARS +24.8% 2-3 YEARS +15.4%

50.6 137.7

1-2 YEARS +16.3%

286.5

< 1 YEAR

118.4

251.4

End FY15

+14.0%

End FY16

Subscription billings growth takes time to translate to revenue; strong subscription performance increases deferred revenue, hence revenue growth lags subscription billings growth 83

Earnings Analysis

Cash EBITDA is a leading indicator of current year cash flow and future statutory profit performance (billings less expenses); Adjusted EBITDA is an indicator of past performance (revenue less expenses) EBITDA RECONCILIATION

$M

FY14

FY15

FY16

Cash EBITDA

97.0

101.4

120.9

25.0%

21.3%

22.6%

Net deferral of revenue

(9.3)

(29.3)

(56.7)

Adjusted EBITDA

87.7

72.1

64.2

Share based payment expense

(1.3)

(1.4)

(15.0)

Depreciation

(7.6)

(8.3)

(8.4)

Amortisation

(58.7)

(47.6)

(29.2)

(0.1)

-

-

(16.0)

(17.3)

(41.9)

Unrealised foreign exchange (loss) / gain

(6.4)

2.0

(2.4)

Operating loss

(2.4)

(0.5)

(32.7)

(88.1)

(53.8)

(35.7)

(0.7)

(5.7)

(3.5)

(91.2)

(60.0)

(71.9)

Cash EBITDA margin

Gains / (loss) on group asset disposal Exceptional items

Net finance expense

Income tax charge Loss for the year

• Number of Shares currently 452M; dilution policy announced at IPO: up to 10% over five years • Share Based Payments will increase over time with each annual issue of three-year “options”; FY16 charge of $15M expected to broadly double in FY17 as moving to run rate • Will decrease over time given reducing balance methodology • FY16 charge of $29M expected to fall to $18M in FY17 • Previously under a private equity funding structure • FY16 re-financed debt to $235M and €60M facility agreements • Margin of Libor and Euribor +2.25% • Operational ETR medium term in the 24% to 26% range, longer term expected to decline as benefit of UK tax rate obtained with majority of IP being held in the UK • Anticipated reduction in cash tax YOY below $25M FY16 amount

84

Cash Flow: Working Capital Focus Working capital in FY17 expected to normalise

CASH EBITDA TO UFCF(8) RECONCILIATION

WORKING CAPITAL MOVEMENTS

UFCF TO OPERATING CASH RECONCILIATION

$M

FY15

FY16

$M

FY15

FY16

$M

FY15

FY16

Cash EBITDA

101.4

120.9

Increase in inventory

(8.1)

(6.7)

Unlevered FCF

65.3

46.4

Capex

(11.9)

(16.8)

Increase in trade and other receivables

(15.8)

(16.1)

Capex

11.9

16.8

Cash tax

(25.7)

(25.2)

(17.3)

(41.9)

59.9

21.3

Change in working capital Unlevered FCF

1.5

(32.5)

65.3

46.4

Exceptional items

Increase/(decrease) in trade and other payables

27.0

Other

(1.6)

1.2

1.5

(32.5)

Change in working capital

(10.9)

Net cash from operating activities

Unlevered free cash flow is expected to approximately double in FY17 • Profit level anticipated to improve • Working capital in FY17 expected to normalise at approximate average of FY15 / FY16 85

Outlook: Confident on Key Metrics for FY17 • FY17 Outlook Mid-teens percentage billings growth on a like-for-like basis; contributing to similar mid-teens revenue growth o Modest Cash EBITDA margin expansion; reflecting the operational leverage in the business o Unlevered free cash flow expected to approximately double; as working capital normalises and the level of our anticipated profit improves o

• Q1 Trading Update o o o o

Sophos has continued to enjoy strong trading, with Q1 billings expected to be above the Board’s expectations Q1 FY17 Like-for-like billings growth is expected to be in the range of 20 percent to 23 percent year-over-year Billings assisted by a material contract with an existing customer Sophos re-confirms FY17 outlook 86

Finance: Key Points (1 of 2) • Billings: 79% of billings from subscriptions which are visible, sustainable and have a strong “cumulative growth” impact ￮

c. 62% of FY16 total billings from existing customer subscriptions with a 101.9% renewal rate

￮

Existing customer subscription billings growth driven by the cumulative effect; assisted by improving renewal rate

￮

Strong growth in subscription billings from new customers which is expected to grow

￮

Positive cumulative impact of new customer billings results in growth even if new customer billings flat

• Revenue: High level of visibility ￮

53% of FY16 revenue from deferred revenue on the balance sheet at the start of the period; current year billings in the main benefit future periods

￮

Revenue growth rate has been moving closer to billings growth rate and we expect this to continue 87

Finance: Key Points (2 of 2) • Cash EBITDA margin: Improving and now a solid proxy for unlevered free cash flow ￮

Investments set to drive billings growth

￮

Cash EBITDA (billings less expenses) has grown over the past three years; yet adjusted EBITDA (revenue less expenses) has declined with significant subscription billings deferred to the balance sheet

￮

Inflexion point imminent

• Unlevered Free Cash Flow: Expected to approximately double in FY17 ￮

Working capital expected to be a more normal year in FY17; specifically creditor movements

• FY17: Confident on key metrics for FY17 ￮

The year when all key metrics start moving “up and to the right” – billings, cash EBITDA and unlevered free cash flow; statutory metrics of revenue and adjusted EBITDA also expected to move positively

88

Finance Q&A Session

Summary and Wrap Up Kris Hagerman Chief Executive Officer

Summary and Wrap Up • Strong market and demand environment • Focused and differentiated mission and strategy • Solid and consistent execution across product, go-to-market, and operations • Innovative product roadmap led by synchronized security platform and Sophos Central • Solid foundation for continued strong financial performance driven by billings growth in existing customers and new customers

91

End Notes (1) Source for c.$38Bn IT security market (hardware + software) is IDC WW IT Security Products 2015-2019 Forecast: Comprehensive Security Product Review (December 2015, IDC #US40709015) and represents expected market size in 2016. Growth of 7% represents 2015E-2019E CAGR.

(2) Like-for-like billings represent billings on a constant currency basis excluding disposals and including acquisitions from the point of acquisition plus the pre-acquisition billings of any acquired companies on a reported basis. Like-for-like billings are presented to enhance comparability. Key constant currency rates for the period were: USD vs. Euro of 0.931; USD vs. GBP of 0.674; and USD vs. Yen of 119.9.

(3) Billings represents the value of products and services invoiced to customers after receiving a purchase order from the customer and delivering products and services to them, or for which there is no right to a refund for undelivered items. Billings does not equate to statutory revenue.

(4) Cash earnings before interest, taxation, depreciation and amortisation (“cash EBITDA”) is defined as the Group’s operating (loss) / profit adjusted for depreciation and amortisation charges, any gain or loss on the sale of tangible and intangible assets, share option charges, unrealised foreign exchange differences and exceptional items, with billings replacing recognised revenue.

(5) Constant currency billings excluding Cyberoam. (6) Estimated, excluding acquisitions and OEM.

(7) $98.1 million of hardware revenue relates to FY16 hardware billings, difference to total FY16 hardware revenue of $100.9 million and FY16 hardware billings of $99.0 million due to release of deferrals from earlier periods and deferral into future periods of certain minor legacy hardware items as well as Email and Web hardware.

(8) Unlevered free cash flow (“uFCF”) is defined as cash EBITDA, less capex, less change in net working capital, less cash taxes. 93

© Copyright 2016. Sophos Group plc. All rights reserved. Sophos Group plc (Company Number: 09608658) is Incorporated in England and Wales, with registered offices at The Pentagon, Abingdon, OX14 3YP, United Kingdom. Sophos is the registered trademark of the Sophos Group. All other product and company names mentioned are trademarks or registered trademarks of their respective owners.

95