THE ART OF CYBER WAR — ASYMMETRIC PAYOFFS LEAD TO MORE SPENDING ON PROTECTION

151

As Physical Security Converges With IT Security and Becomes More Network-Based, Can Cisco Compete?
Cisco recently introduced new video surveillance IP cameras and monitoring software targeted for small businesses. As corporate security technology and services become increasingly network-delivered and database-driven, the physical security market presents a compelling incremental growth opportunity for Cisco that we believe can exceed the billion dollar annual revenue threshold in the next 35 years. The physical security industry has been undergoing a paradigm shift toward convergence, whereby previously disjointed functions of IT security and physical security are experiencing greater formal cooperation. Organizations continue to implement more IP-based video surveillance cameras and building access controls both to upgrade capabilities and to reduce operational costs. Deploying IP-based security upgrades capabilities and reduces operational costs. Through the IP network a security system can assign priority to data and automatically discover new nodes such as IP cameras and control sensors, eliminating the time and effort of manual provisioning. Shifting building access controls from isolated networks to existing IP networks that house data, voice, and video can improve incident detection and assessment, authenticating both the user and device to provide efficient integrity checks. • Video Surveillance: The video surveillance market, which we estimate to be approximately $10 billion in size, should grow at a 10% CAGR over the next several years — a comparable growth profile to the similarly sized enterprise telephony market over the last decade. More than 20% of global video surveillance sales are now IP-based and this segment is projected to double over the next several years. Trends driving growth in network-based video surveillance include: increasing cost efficiencies, higher-quality HD resolution in IP cameras, video analytics mitigating bandwidth demands and offloading human operators, and hybrid DVRs facilitating legacy to analog migration. • Access Control: There is a growing movement to integrate physical and logical access controls, as between one-third and one-half of all enterprises that are implementing smart cards for PC and network login are adopting common access cards. This convergence offers increased operational efficiencies, lower administrative overhead, heightened security and enhanced risk management. Biometric identification based on unique biological or behavioral traits adds a further level of security, and increasing accuracy and affordability should drive 30% CAGR near-term growth in the industry. We see the potential for $1-$2 billion in direct physical security equipment revenue for Cisco within 3-5 years and believe "pull through" sales of switches and routers could be 50-100% of direct sales. Although comprising a relatively small portion of revenues today, we believe that physical security provides Cisco an attractive ancillary revenue opportunity. Although some enterprises may prefer to engage with more experienced security vendor incumbents, we believe Cisco can employ its historically successful strategy of leveraging existing client relationships and using the network as a platform to deploy interlinked applications in video surveillance and access control. Additionally, increasing network integration — and related network usage growth particularly through video surveillance consumption — will drive router and switch demand. Today, the $10 billion video

152

THE ART OF CYBER WAR — ASYMMETRIC PAYOFFS LEAD TO MORE SPENDING ON PROTECTION

surveillance market is about 20% IP. Cisco capturing $1-$2 billion in revenue in 35 years is consistent with its track record in other markets, such as enterprise voice. • Breadth of offering key to success: Cisco has a broad array of physical security offerings, including IP cameras, analog/IP gateway encoders, recording and storage solutions, Web-based video surveillance administration tools, access control gateways and managers, as well as systems promoting interoperability between radio and traditional communication networks for public safety officials and collaboration tools for incidence response. • Acquisitions likely to play a role: Given Cisco's scale and reach, we also believe there is an opportunity for the company to facilitate consolidation in the small, fragmented, and growing market of physical security. Cisco's recent acquisitions of Starent, Tandberg and Pure Digital Technologies have demonstrated Cisco's ability to effectively capture share by successfully leveraging the domain expertise of target company management. We believe that IP video surveillance company Axis Communications is an attractive target, given its market share leadership and margin profile. In addition, acquiring current video surveillance partner Pelco or other physical security information management players like Orsus, Proximex and VidSys would also allow Cisco to gain incremental expertise in security convergence and build a portfolio of complementary technologies. What Is Physical Security? We define physical security as a set of devices, sensors and software used to monitor and protect physical assets and personnel against threats. SecurityWorld magazine's annual Security Sales & Integration Systems Integrator Study identifies seven facets of physical security: video surveillance, access control, intrusion, systems integration (PSIM), fire, intercom/telephone systems and outdoor detection. Other building management systems that augment physical security infrastructures include various communication technologies (video, voice, data), incident response, HVAC (heating, ventilation, air conditioning), elevators, lighting and power (see Exhibit 150). In this piece, we pay particular attention to video surveillance and access control — the segments which we believe are being impacted most by the underlying industry trend of physical security and IT security convergence coupled with network integration. The video surveillance and access control segments are also the major segments in which Cisco has begun to compete in the physical security market. Physical Security Technologies Industry Map
Physical Security Segments

Exhibit 150

Video Surveillance

Access Control

Systems Integration (PSIM)

Intrusion

Fire

Telephone/Intercom Systems

Outdoor Detection

Other Building Management Systems Communication (Video/Voice/Data) Incident Response
Source: SecurityWorld Magazine and Bernstein analysis.

HVAC Elevators

Lighting Power

THE ART OF CYBER WAR — ASYMMETRIC PAYOFFS LEAD TO MORE SPENDING ON PROTECTION

153

Trends in Physical Security

The industry is undergoing a paradigm shift of convergence, whereby previously disjointed functions of IT security and physical security are experiencing greater formal cooperation. Exhibit 151 highlights the traditional divide between information technology and operational technology. IT systems typically feature enterprise-wide infrastructure and applications that are IP-based while OT systems within physical security typically feature event-driven, real-time, embedded hardware and software that are connected via hardwired control networks. IT vs. OT Divide
Information Technology Operational Technology Manage assets, control processes Event-driven, real-time, embedded hardware and software (custom) Electromechanical, sensors, coded displays Engineers, technicians and line of business managers Control networks, hardwired Controls machines

Exhibit 151

Purpose Architecture Interfaces Ownership Connectivity Role

Process transactions, provide information Enterprisewide infrastructure and applications (generic) Graphical user interface, Web browser, terminal and keyboard CIO and computer grads, finance and adminstration departments Corporate network, IP-based Supports people

Source: Gartner and Bernstein analysis.

Exhibit 152 underscores the notion that technology innovations, vendor adaptations and heightened threats have all driven convergence in physical and IT security. Exhibit 152
Technology Convergence

Convergence Drivers
Corporate security technology and services (e.g. video surveillance, access control, fraud detection, etc.) are increasingly network-delivered and database-driven Traditionally, information security vendors protected networks and physical security vendors protected bricks and mortar. Now, a growing roster of security companies operate in both areas: Brink's (armored car company) offers managed network security services Unisys (former mainframe purveyor) consults in supply chain security Computer Associates (software giant) partners with HID (smart-card vendor) to develop PhysBits network-and-building-access standard Kroll (physical security services provider) owns difital forensics unit Ontrack Data Recovery Digital controls are becoming more prevalent for physical systems. As such, security expert Hancock warns of blended threats (combined physical and logical attacks). The most likely scenario is a physical attack (such as 9/11) with its effect multiplied by digital denial-of service attacks aimed at telecommunications or other infrastructure

Vendor Convergence

Threat Convergence

Source: CSO Online and Bernstein analysis.

While some entities prefer a fully converged solution in executing IP integration, a majority of enterprises employ a hybrid approach in which the security network remains separate and dedicated using secure VLAN and firewalls while still being connected to the main network for remote accessibility using secure routers. The hybrid approach ensures that the user network is not taxed by heavy video surveillance traffic. Deploying IP-based security upgrades capabilities and reduces operational costs. Through the IP network a security system can assign priority to data and automatically discover new nodes such as IP cameras and control sensors, eliminating the time and effort of manual provisioning. Shifting building access controls from isolated networks to existing IP networks that house data, voice and

154

THE ART OF CYBER WAR — ASYMMETRIC PAYOFFS LEAD TO MORE SPENDING ON PROTECTION

video can improve incident detection and assessment, authenticating both the user and device to provide efficient integrity checks.18 Exhibit 153 Type of Physical Security Deployments for Global Government Agencies by 2011

25%

75%

Siloed Video Surv eillance & Access Control Conv erged Video Surv eillance & Access Control

Source: Gartner.

The federal government has been a driving force in the development of converged technologies in security. The passing of the Homeland Security Presidential Directive 12 in 2004 required that all federal government employees and agencies use a converged physical and logical ID badge. This mandate facilitated the creation of standards for badge design and embedded identity elements. According to Gartner, by 2011 more than 25% of governments will integrate video surveillance and access control into a single command-and-control interface to better assess and correlate information (see Exhibit 153). Despite the momentum in security convergence, there exist legitimate concerns. From a technological perspective, convergence critics consider video surveillance and access control systems to be more secure on a traditional closed network as opposed to an IP network that is more exposed to malware and attacks. From a managerial perspective, convergence critics argue that despite cost efficiencies, consolidating disparate physical security and IT security departments may cause lapses in execution. For example, Steve Collen, Director of Business Development for Cisco Physical Security warned that convergence exposes enterprises to security holes. When Cisco first implemented digital cameras, its physical security and IT teams were largely siloed. This left Cisco relatively unprepared in 2001 when a virus spread throughout 150 of Cisco's video management servers. It took about 20 IT and physical security employees working through a weekend to fix the issue.19 In the following sections, we explore the video surveillance and access control markets in detail. For each segment, we define the major technologies and highlight how each segment is impacted by physical-IT security convergence and network integration. In addition, we segment and size the market place and identify key players.

18 19

SecurityWorld Magazine SC Magazine

THE ART OF CYBER WAR — ASYMMETRIC PAYOFFS LEAD TO MORE SPENDING ON PROTECTION

155

Exhibit 154

NYPD Video Surveillance

Source: Bernstein.

Video Surveillance

Video surveillance or closed-circuit television systems (CCTV) monitor commercial, residential, and public areas and transmit signals to a specific viewing application for real-time or later review. We focus on the video camera, video management, and video content analytics sectors within surveillance given the dynamic change they are experiencing as physical security becomes more networkintegrated. Exhibit 154 shows one of the many video surveillance applications — NYPD monitoring of public grounds in New York City. Exhibit 155 describes each segment in detail.

156

THE ART OF CYBER WAR — ASYMMETRIC PAYOFFS LEAD TO MORE SPENDING ON PROTECTION

Exhibit 155

IP Video Surveillance Overview
Segments Analog Standard Definition IP Megapixel Night Vision Most traditional and commonly deployed cameras today. Connected to DVRs or encoders so operators can view over PCs Similar resolution to analog cameras but do not require DVR or encoder as video has been digitized for PC viewing inside camera Typically IP cameras that offer up to 16mp resolution (versus 0.3mp for analog) Specialized cameras featuring infared, thermal, and laser-based technologies for use when natural/artificial light is missing Convert analog video feeds into a digital format and save resulting digitized video on internal hard disk drives or on locally direct attached storage (for example, digital tapes, disk drives, or DVDs). DVS sends encoded video to larger security network using TCP/IP protocol. Hybrid DVRs accept both analog and digital formats Compress image internally within IP camera (encoded) and transmit via IP protocol and either stored in camera or on NVR Management software automates the day-to-day capture, indexing and storage of video content Video analytics automatically detect, recognize and analyze threats and other information using digitized video. This includes video motion and audio detection, camera tampering detection, people counting, cross line detection, vehicle license plate recognition, and biometric identification

Video Cameras

DVR/DVS/ Hybrid DVR Video Management NVR Management Software Video Content Analytics

Intelligent Video

Source: IPVideoMarket.info and Bernstein analysis.

Exhibit 156 presents a non-exhaustive list of companies that compete in each segment, indicating the highly fragmented nature of the overall video surveillance market. Exhibit 156 Video Surveillance Segmentation
Video Surveillance

Cameras Analog, IP, Megapixel, Night Vision
- 4XEM - ACTi - Arecont Vision - Avigilon - Axis - Basler - Bikal - Bosch - Cisco - DVTel - EverFocus - Geutebruek - Grandeye - Honeywell - Hikvision - IndigoVision - IQinVision - Lumenera - Mobotix - Pelco - Smartvue - Sony - StarDot - Verint - Vicon Night Vision: - Axsys - Cantronic - Extreme CCTV - Flir - Noble Peak - Raytec - Vumii

Video Management Servers, Codecs, Software
- 3VR - 3xLOGIC - Airship - American Dynamics - ATEME - Axxon - Bosch - byRemote - Cisco - Clickit - CSST - Dallmeier - Dedicated Micros - DIGIOP - DVTel - Envysion - EverFocus - Exacq - Genetec - Geutebrueck - Hikvision - Honeywell - i3DVR - IndigoVision - ipConfigure - JDS - LuxRiot - MangoDSP - March Networks - Milestone Systems - Mirasys - NICE Systems - NUUO - ONSSI - Pelco - Pixim - QNAP - Salient - Secure-i - SeeTec - Sony - Steelbox - Synectics - Tempest - TimeSight - Verint - Veracity - Video Insight - VideoNext - VideoProtein - VNS

Video Analytics Intelligent Video, Biometrics
- 3VR - Agent Vi - Aimetis - BiKal - BRS Labs - Cernium - ClickIt - Emza - Eptascape - Geutebrueck - Intellivid - ioimage - MATE IV - NICE Systems - ObjectVideo - SightLogix - VideoIQ - VideoMining - Vidient

Source: IPVideoMarket.info and Bernstein analysis.

THE ART OF CYBER WAR — ASYMMETRIC PAYOFFS LEAD TO MORE SPENDING ON PROTECTION

157

Video Cameras and Video Management Exhibit 157
$14.0 $12.0 $10.0 $BN $8.0 $6.0 $4.0 $2.0 $0.0 2009 CAGR 2009-2013: 10.0%

IMS research estimated the total market for surveillance cameras, recording equipment, and video encoders to be $8.2 billion in 2008. This is expected to grow at a 10% CAGR to $13.3 billion by 2013 (Exhibit 157). Global Video Surveillance Market Size (Manufacturer Level)

2010E

2011E

2012E

2013E

Source: Axis Communications and IMS Research.

An interesting comparison can be drawn between the video surveillance market and the enterprise telephony market. We estimate that the current size of the video surveillance market is approximately $10 billion — similar to that of enterprise telephony in the early 2000s. Enterprise telephony's growth trajectory over the past several years may be indicative for video surveillance, particularly given the sector's increasing adoption of network-based solutions. From 2001 to 2007, enterprise telephony grew at an 11.9% CAGR before the market contracted from 2007 to 2009 (Exhibit 158). Historical enterprise telephony growth rates are consistent with IMS projections for video surveillance going forward. Exhibit 158
$18 $16 $14 $12 $BN $10 $8 $6 $4 $2 $0 2001 2002 2003 2004 PBX 2005 2006 Voice Applications 2007 2008 2009 CAGRs 2001-2009: 5.8% 2001-2007: 11.9%

Enterprise Telephony Market Size

Telephones

Source: Dell'Oro.

The video surveillance market has numerous players, many of whom employ a niche strategy with respect to specific technology, price point, and application. IPVideoMarket.info estimates that there are easily hundreds of manufacturers in the video surveillance segment, with as many as 500 garnering at least $1 million in revenue. Hospital and school facilities as well as business offices, industrial

158

THE ART OF CYBER WAR — ASYMMETRIC PAYOFFS LEAD TO MORE SPENDING ON PROTECTION

manufacturing facilities and government facilities are the most common venues for video surveillance deployments. In the camera segment, fast-growing IP technology is still in its relatively early stages with analog technology still representing approximately 90% of the entire market based on unit sales and 80% based on revenue (Exhibit 159). Exhibit 159
100% 90% 80% 70% 60% 50% 40% 30% 20% 10% 0% Unit Sales Revenue 88% 78% 12% 22%

IP vs. Analog Share Estimates

Analog

IP

Source: IPVideoMarket.info

In IP cameras, Axis has the largest presence, having launched the technology in 1996 and commanding an estimated 30% market share of the IP camera segment. Panasonic has a leading share in analog cameras and video surveillance equipment. Pelco Bosch, Sony, and Honeywell are also leading players in the space (Exhibit 160). Exhibit 160
Network Cameras Rank 1 2 3 4 5 Supplier Axis Sony Panasonic(PCC) Mobotix Panasonic (PSS)

2009 Market Leaders in Video Surveillance
Security Cameras Rank 1 2 3 4 5 Supplier Panasonic (PSS) Pelco Axis Bosch Sony Video Surveillance Equipment Rank Supplier 1 Panasonic (PSS) 2 Pelco 3 Bosch 4 Axis 5 Honeywell

Note: PSS denotes Panasonic Security Systems, PCC denotes Panasonic Communications Co. Source: Axis Communications and IMS Research.

Axis AB, parent of Axis Communications, is a leading pure play video surveillance companies. Although it has experienced a recent deceleration in growth, Axis has consistently achieved 50% gross margins (Exhibit 161 and Exhibit 162).

THE ART OF CYBER WAR — ASYMMETRIC PAYOFFS LEAD TO MORE SPENDING ON PROTECTION

159

Exhibit 161

Axis Revenue Growth Has Declined to the Low Double Digits…
Axis AB Revenue Growth

Exhibit 162

…But Axis Gross Margins Have Remained Above 50%
Axis AB Gross Margins

40% 35% 30% 25% 20% 15% 10% 5% 0% -5% -10%

60% 50% 40% 30% 20% 10% 0%

FY00

FY01

FY02

FY03

FY04

FY05

FY06

FY07

FY08

FY00

FY01

FY02

FY03

FY04

FY05

FY06

FY07

FY08

Source: CapitalIQ.

FY09

Source: CapitalIQ.

Analog vs. IP Systems Exhibit 163

Exhibit 163 and Exhibit 164 demonstrate the evolution of video surveillance systems toward IP-based network integration. Types of Video Surveillance Systems (First, Second, and Third Generation)

Source: Cisco Systems IP Network-Centric Video Surveillance White Paper (2007) — used with permission.

FY09

LTM

160

THE ART OF CYBER WAR — ASYMMETRIC PAYOFFS LEAD TO MORE SPENDING ON PROTECTION

Exhibit 164

Types of Video Surveillance Systems (Fourth Generation)

Source: Cisco Systems IP Network-Centric Video Surveillance White Paper (2007) – used with permission.

While historically analog systems have proven more cost-effective, particularly in smaller deployments, IP system pricing continues to grow increasingly attractive. A study commissioned by Axis Communications compared the total cost of ownership for a 40-piece analog camera + DVR-based recording system versus an equally sized IP system (network cameras, IP infrastructure, server, video management software and storage) for a standard school facility. This mid-size deployment scenario was chosen because it appeared to offer no clear cost advantages for either the IP- or analog-based surveillance system at the onset. Of course, given that Axis Communications is the market leader in the network video market, the company's incentives for highlighting the merits of IP-based video surveillance systems over their analog counterparts are obvious. That being said, the study's structured research process included step-by-step validation of each project phase by non-vendor industry participants including security integrators, value-added resellers and industry analysts. These players defined cost components, deployment scenarios, and underlying assumptions. Moreover, an industry-standardized approach was used to collect cost data to maintain impartiality. After gathering the resulting quotes from participating systems integrators, the study found that the IP system had on average a 3.4% lower total cost of ownership versus the analog/DVR system, but given the flexibility of the IP system (availability of different cabling types and network platforms), it had a wider spread of cost outcomes (Exhibit 165). Moreover, the lowest cost IP system had a 25.4% lower total cost of ownership than the lowest cost analog/DVR system. Additionally, the highest cost IP system had an 11.5% higher cost than the highest cost analog/DVR system. In the base case, while the cost of labor, recording/playback and cable/infrastructure was lower for the IP system, the network cameras were 50% more expensive than their analog counterparts (Exhibit 166).

THE ART OF CYBER WAR — ASYMMETRIC PAYOFFS LEAD TO MORE SPENDING ON PROTECTION

161

Exhibit 165

Illustrative Cost of Video Surveillance: IP vs. Analog

Exhibit 166

Breakdown of Cost: IP vs. Analog

$75,000

$75,000

Cameras

$50,000

$50,000 54%

34%
Cable/ Infrastructure

16%
$25,000

Recording/ Playback Labor

$25,000

6% 21%

25%

$0 IP System Analog Cameras + DVR

19% $0 IP

25%

Analog

Note: Labor includes installation, configuration, training; Recording/Playback includes servers, storage, software; Cable/Infrastructure includes cables, switches, panels; Cameras include camera power. Source: Axis Communications Total Cost of Ownership (TCO): Comparison of IP- and Analog-Based Surveillance Systems White Paper (2008). Source: Axis Communications Total Cost of Ownership (TCO): Comparison of IP- and Analog-Based Surveillance Systems White Paper (2008).

In general, the larger the system, the more favorable the cost of IP vis-a-vis analog. In the Axis Communications study, the IP system was more compelling beyond 32 cameras. Assuming an IP infrastructure already exists (as is the case with many buildings today) the IP system is always more attractive than the analog system regardless of camera deployment. Network-based systems provide numerous benefits. IP cameras can provide high-definition resolution of up to 1080p and 30 frames per second. Video analytics software can also be hosted centrally on dedicated servers or in individual cameras, thereby offloading human operators and minimizing error. The emergence of hybrid DVRs has also effectively removed the barriers of migration to IP. Exhibit 167 exemplifies the momentum of IP growth vis-a-vis analog.

162

THE ART OF CYBER WAR — ASYMMETRIC PAYOFFS LEAD TO MORE SPENDING ON PROTECTION

Exhibit 167

Percentage of New Video System Sales That Are IP-Based
0% (NA), 7%

80-100%, 24% 1%-19%, 25%

Those who say 60% or more of their new video system sales are IPbased increased from 30% to 49%. The overall average percentage of new video system sales that are IPbased increased from 39% to 49%.

60-79%, 24% 40%-59%, 9%

20%-39%, 11%

Source: 2009 Security Sales & Integration Systems Integrator Study.

Bandwidth and Storage Requirements — London Case Study

The UK has been long-touted as the "most-watched" region in the world. While no official government statistics exist, the most recent estimates place the number of public CCTV cameras in the UK ranging from 1 million (CCTV User Group, 2008) to 4.2 million (UrbanEye, 2002). The high end of this range would suggest that the UK had 1% of the world's population but 20% of its CCTV cameras, with there being one camera for every 14 UK citizens. UrbanEye also estimated the CCTV camera count within London to be approximately 500,000. To illustrate the impact of a growing video surveillance industry, we show a back-of-the-envelope impact on bandwidth and disk storage for London's CCTV system (Exhibit 168). Based on JVSG's CCTV's bandwidth and storage space calculator,20 one camera running for 24 hours at standard 640x480 VGA resolution and MJPG-20 compression at 8 frames per second transmits at 2.5 megabits/second. London's CCTV system would consume 13.5 petabytes of disk space per day, requiring an incremental eight of EMC's highest storage capacity systems per day.21 Of course, storage capacity can be saved by discarding outdated recordings (as is commonly the case) or performing video analytics at the edge. Storage Demands for London CCTV

Exhibit 168

Illustrative Disk Space Calculation for London CCTV Estimated CCTV Cameras in London 500,000 Bandwidth (Mbit/s)/Camera 2.5 Daily Mbits Transmitted/Camera 216,000 Daily Required Disk Space/Camera (GB) 27 Total Daily Required Disk Space (GB) 13,500,000
Source: JVSG and Bernstein analysis.

According to IPVideoMarket.info, 80% of surveillance cameras use between 60GB to 600GB storage. Although bandwidth demand is a concern, the rapid advancement of compression algorithms has been a key mitigant. While just a few years ago MPEG-2 created a 4 to 5 Mbps video stream from a 30 frames per
20 21

http://www.jvsg.com/bandwidth-storage-space-calculation/ http://www.emc.com/collateral/hardware/comparison/emc-celerra-systems.htm

THE ART OF CYBER WAR — ASYMMETRIC PAYOFFS LEAD TO MORE SPENDING ON PROTECTION

163

second D1 720x480 resolution (NTSC) video camera, the cost-effective and more recently introduced MPEG-4 algorithms cut the video stream down to approximately 3.5 Mbps. This improvement in compression ratios comes with no discernable quality change from MPEG-2 compression. Other compression technologies offer the promise of further bandwidth reductions at equal or greater video fidelity of prevailing technologies. Moreover, cheaper and more powerful semiconductors allow the necessary DSPs to be affordable. Video Analytics Video analytics automates processes, thereby alleviating human burden and reducing costs. These systems are able to proactively signal for the immediate intervention of first responders or other actions (alarming, gate/door locking, etc.). According to Milestone in its Enabling Video Analytics White Paper, research in the U.S. has shown human observers start showing signs of viewing fatigue after as little as 12 minutes, overlooking up to 45 percent of all activity in the scenes. After 22 minutes, they overlook up to 95 percent.22 Significant projected growth in video surveillance traffic demands that human observers are aided by video analytics. As processors in cameras get more powerful and video analytics algorithms demand less processing power, many types of video analytics can be performed either at the server or on camera endpoints. Performing video content analytics at the edge reduces bandwidth demands and storage requirements as on-camera analytics ensure that only video of interest is disseminated through the network and inventoried, thereby cutting enterprise costs. However, the video analytics market remains small and fragmented to date. Imperial Capital interviewed 30 intelligent video companies, noting that fewer than five were greater than $10 million in revenues. Enhancing technologies and minimizing false alarms are ongoing industry challenges. Exhibit 169 highlights different segments of video analytics and sample vendors. Video Analytics Applications
Segments Access Point Monitoring & Motion Analysis Facial Feature Recognition Sample Vendors

Exhibit 169

Doors, cards, protected areas, roadways, public OnSSI, NEC transportation, parking facilities, shopping centers Peoples' faces, eyes, nose, mouth, hair, shape of face, skin color, news or magazine archives License plate ID, vehicle type, registration venue Eyealike, Cognitec Nice Systems, SRI International

Text Recognition
Source: Gartner.

Access Control

Access control systems enable authorities to control access to areas and resources in a given physical facility. Technologies employed include badging and card reading as well as biometric identification. Authenticating information is generally determined by something the user knows (e.g., password), something the user has (e.g., access card), or something the user is (e.g., biometrics) (Exhibit 170).

22

Milestone Enabling Video Analytics White Paper (2008)

164

THE ART OF CYBER WAR — ASYMMETRIC PAYOFFS LEAD TO MORE SPENDING ON PROTECTION

Exhibit 170

Physical Access Control Schematic
Something You Know + Have + Are: Pin/Password, ID/Token, Biometrics

Security Level

Something You Have + Something You Are: ID/Token, Biometrics Something You Know + Something You Have: Pin/Password, ID/Token Something You Know: Pin/Password Solutions

Source: Smart Card Alliance and Bernstein analysis.

Northrop Grumman is currently in the process of implementing a converged physical and logical identity/access management program. This program grants a smart common access card for all 120,000 employees, supporting multiple authentication methods and enforcing policies within the enterprise. When arriving at work, employees swipe their personalized smart ID card to enter the facility. This card stores information about the employee — name, address, photo, fingerprints, access controls, passwords, digital certificates, and training information, as well as data about the company. Once inside the facilities, employees swipe the same card to log into their computer, which will be equipped with a smart card reader.23 Smart Credentials A smart card is a chip card with embedded microcontroller silicon and is typically read through contact as opposed to contactless radio frequency. A smart token is a USB device embedded with a similar integrated circuit. Smart cards/tokens with public-key infrastructure (PKI) credentials enable high-assurance authentication, digital signatures and encryption, as well as provide a platform for other applications, including physical access control systems. Exhibit 171, Exhibit 172, and Exhibit 173 show sample vendors in within the smart credential industry. Exhibit 172 Public Key Infrastructure Exhibit 173 Card Management Tool Vendors Vendors Entrust Keynectics Microsoft OpenTrust Realsec STS Group Verisign Verizon
Source: Gartner.

Exhibit 171 Smart and RadioFrequency Token Vendors Generic: Gemalto, Giesecke, Devrient, Oberthur Authentication/Info-Security: ActivIdentity, SafeNet Traditional Prox Token: HID Global Specialist: Privaris (contactless smart tokens in nonstandard form factors)
Source: Gartner.

Specialist: Bell ID, Intercede CM + Smart Card/Token: ActivIdentity, Athena, Smartcard Solutions, Gemalto, SafeNet CM+PKI: Microsoft, OpenTrust, VeriSign

Source: Gartner.

A crucial step in the integration of physical and IT security is the consolidation of credentials to a common access card, which combines credentials used for building access with those used for PC/network login. Increasingly, common
23

SC Magazine

THE ART OF CYBER WAR — ASYMMETRIC PAYOFFS LEAD TO MORE SPENDING ON PROTECTION

165

access cards also employ contactless chip technology, transmitting and receiving data via radio frequency. These cards/tokens can also hold data suited for biometric authentication methods in logical access. Driving common access card adoption are increased operational efficiencies, lower administrative overhead, heightened security, and enhanced risk management (Exhibit 174). Exhibit 174 A Common Access Card Combines Credentials Used for Building Access With Those Used for PC/Network Login
Drivers of Common Access Card Adoption Increased operational efficiencies: financial benefits accrue from infrastructure consolidation and improved business processes including user convenience Lower administrative overhead: reduces costs of pin resets and lost cards (employees more likely to keep CACs with them at all times) Heightened security: correlating log entries allows organization to be notified of computer access attempts from users who have not physically entered the facility Enhanced risk management: integrated system can present all relevant information via single console and reporting system that can be examined to identify potential threats by measuring against a baseline of normal user activity
Source: www.SearchSecurity.com.

Gartner estimates that between one-third and one-half of all enterprises that are implementing smart cards for PC and network login are adopting the common access card approach and integrating physical and logical access controls. Several vendors are offering readers, software, and other devices enabling the use of existing building access cards (contactless chip cards or legacy proximity cards) for PC/network login, thereby eliminating the need to invest in new smart card technologies and PKI tools. Thus, an increasing number of enterprises are exploiting existing building access credentials for PC and network login and turning the existing credentials into common access cards. Despite the aforementioned benefits of smart tokens/cards and common access cards, the complexity of the necessary infrastructure and associated support costs (especially for workforce remote access) may provide a barrier to entry, and smart credentials work best where there is a clear need for high-assurance authentication or a need to provide other services, such as digital signature. Gartner reports that in the longer term, smart tokens may in fact be superseded by mobile phones, which maximize user convenience. Smart phones are already used as one-time password tokens (e.g. RSA SecureID on BlackBerries). However, using phones as tokens may place additional technical demands resulting in a potential increase in overall cost and complexity. Additionally, since phones cannot be used as photo ID cards, enterprises will also have to provision traditional nonsmart cards for this purpose. Biometrics Biometric authentication provides one of the most rigorous security level standards, involving the use of a biological or behavioral trait unique to the individual as the basis of user authentication. On a biological basis, this includes a fingerprint, iris structure, face topology, or vein structure. On a behavioral basis, this includes voice, typing rhythm, or graphical user interface interactivity. Biometric authentication can be employed for access to corporate networks, access to Web applications and other online services by workforce and external users, workforce access to mobile devices, and access to portable storage devices. Biometric technologies are gaining considerable momentum given the technology's increasing accuracy and affordability (Exhibit 175). The opportunities

166

THE ART OF CYBER WAR — ASYMMETRIC PAYOFFS LEAD TO MORE SPENDING ON PROTECTION

in biometrics stretch beyond the ability to enhance levels of security. In addition, biometrics could allow governments and corporations to peel away interim layers of security while simplifying the authentication process for consumers. Exhibit 175 Global Biometric Market
Global Biometric Revenues 7,000 6,000 5,000 $M 4,000 3,000 2,000 1,000 0 2009 2010E 2011E 2012E 32.2% CAGR

Source: Acuity Market Intelligence.

The biometric technologies market is fragmented, as many vendors either focus on hardware or software components (capture devices or feature extraction/comparison algorithms). These vendors sell to biometric solution providers or PC, phone or other device manufacturers rather than end-user organizations. Some of the largest and best-known biometric players — such as L-1 Identity — span multiple applications but rarely user authentication (Exhibit 176 and Exhibit 177).24 Vendors Offering Complete Biometric Authentication Products Directly to EndUser Organizations Fingerprint: DigitalPersona, SecuGen Face Topography: Sensible Vision Vein Structure: Fujitsu, Hitachi Typing Rhythm: AdmitOne Security, AuthenWare, BehavioSec Voice: Voicetrust, VoiceVault, PerSay Multimodal: Veritrix
Source: Gartner.

Exhibit 176

Exhibit 177

Vendors Offering Biometric-Enabled Portable Storage Devices

Fujitsu Kanguru Solutions Lexar MXI Security SanDisk Sony
Source: Gartner.

Early growth in the biometric industry began with government applications such as biometric passports and ID cards. In March 2010, the Wall Street Journal reported that Senate lawmakers were crafting a new comprehensive immigration bill requiring a national biometric identification card for all American workers. The ID card would be embedded with biometric data, specifically with fingerprints or a scan of the veins in the top of the hand and serve as a deterrent to hiring illegal immigrant labor. Commercial applications of biometrics, however, have gained significant momentum. According to Acuity Market Intelligence, commercial application biometric revenues are expected to match to public sector revenues in 2014, and then surpass public sector representing more than 55% of the total global market
24

Gartner

THE ART OF CYBER WAR — ASYMMETRIC PAYOFFS LEAD TO MORE SPENDING ON PROTECTION

167

for biometrics core technology by 2017. For example, in August 2010, 24 Hour Fitness announced the installation of finger scanners for its 60 Bay Area gyms. The machines, manufactured by MorphoTrak, map out unique points within the ridges of a finger and then convert that information into a binary code that is encrypted. Similar technologies are employed in venues as varied as American supermarket chains for paying of goods to Japanese banks for ATM transactions. According to The Economist, "those in the industry believe the banking and retail approaches to biometrics — one of which puts security above convenience, the other convenience above security — will eventually converge, opening up new applications in the process." Gartner predicts that by the end of 2013, 30% of enterprises will be using biometric authentication methods for access to higher-risk Web applications via mobile devices. Currently the technology tends to be proprietary and application-specific, but as the industry matures interoperable standards should emerge.25 Physical Security Case Study — New York-Based Professional Services Firm Our interviews with the security team of a professional services firm with approximately 4,300 employees headquartered in New York City gave us insight into the type of video surveillance and access control systems typically employed at similarly sized enterprises, along with their associated costs. The security budget at this firm was approximately $5 million in 2009. Of this amount, 60% was dedicated to manpower while 40% was dedicated to technology (Exhibit 178). While this firm comprises 47 offices worldwide, the majority of the budget is dedicated to the company's 35 large offices. The firm's New York City headquarters features a 50-story 1.9 million square foot building (see Exhibit 179). The firm's security is responsible for 23 of the 50 floors, covering approximately 875,000 square feet. Professional Services Firm 2009 Security Budget
6

Exhibit 178

$5.0M
5

4

40%

$M

3

2 60% 1

0 Manpower
Source: Professional services firm security team.

Technology

25

The Economist

168

THE ART OF CYBER WAR — ASYMMETRIC PAYOFFS LEAD TO MORE SPENDING ON PROTECTION

Exhibit 179

Professional Services Firm Headquarters Entrance

Source: Bernstein.

The video surveillance and access control strategy is to cover main entrances, core corridors, freight elevator lobbies, and critical spaces such as data centers and IT command centers. Exhibit 180 outlines the firm's video surveillance measures for its headquarters. The video surveillance system includes 387 cameras. Although new camera installations are entirely IP-based, a majority of cameras in the field are analog, which have been encoded to communicate over the network. The firm's security team plans to phase out all analog cameras with IP units by 4Q:2012/1Q:2013. IP cameras and video management hardware/software are provided by IndigoVision. Exhibit 181 outlines the firm's access control measures for its headquarters. Access is governed by smart proximity cards and readers provided by HID global along with controller panels from Software House. Software House's C-Cure provides the access control software infrastructure. Biometric identification provided by Bioscrypt is also used in critical areas such as data centers and command center environments. Exhibit 180 Professional Service Firm Video Surveillance Details
IndigoVision provides the IP camera a unit cost of approximately $1,300, while installation and storage costs vary by site. Legacy analog providers include IndigoVision, American Dynamics, Honeywell, and Verint. The typical upgrade cycle is 3-4 years, with replacements made as cameras fail or larger construction projects are commenced within the space.

Video Cameras

In addition to supplying IP cameras, IndigoVision also supplies the firm's NVRs and software, given Video Management interoperability benefits. Legacy DVRs from aforementioned analog camera providers are also employed. Daily bandwidth demand for video surveillance is 1.33TB while total storage capacity is 96TB. Minimal video analytics measures, such as intelligent motion detection and area masking, are employed based on incremental features already embedded. Costs include server and hardware costs in addition to a ~$300 licensing fee per camera.

Video Content Analytics

Source: Professional services firm security team.

THE ART OF CYBER WAR — ASYMMETRIC PAYOFFS LEAD TO MORE SPENDING ON PROTECTION

169

Exhibit 181
Credentials

Professional Service Firm Access Control Details
ID cards feature combination smart card and proximity Wiegand technology. Information stored within cards includes access control rights and cafeteria point-of-sale data. HID Global manufactures the cards at a price of $6.04 per unit. Card readers are not IP-networked, though main control panels are IP-networked. HID Global manufactures the readers at a price of $250 per unit. Software House provides iStar panels that handle 16 readers each and allow database-driven access control at a price of $7,500/unit. C-Cure, made by Software House, provides access control software infrastructure, including the providing and revoking of clearances, alarm and detection provisions, and employee database management for an annual licensing fee of ~$26,000. Biometric readers are used in critical areas such as data centers and command center environments. Bioscrypt provides the readers at $700 per unit. These readers have been in place for 2.5 years.

Readers / Controllers

Software

Biometrics

Source: Professional services firm security team.

Systems Integration and Convergence Exhibit 182

Exhibit 182 outlines some of the near-term security initiatives that the security team of the professional services firm we interviewed believes will define the next 5-10 years of physical security technologies. Professional Services Firm Future Security Initiatives • Greater usage of megapixel IP cameras with more sophisticated video analytics • Access control measures with advanced reporting features and automated policy engines • Real-time system integration with video overlay in the command center

Source: Professional services firm security team.

The opportunities for convergence synergies among access control, video surveillance, and other physical security systems are vast. For example, use of an unauthorized access card could trigger video surveillance to capture the event and either send an alarm or archive the video for forensics. Shifting building access controls from isolated networks to existing IP networks can also increase security efficiencies. Policy-based responses such as notifying a security guard on a smartphone if a door is opened after hours can be can be implemented. Additionally, administrators can lock down an entire building with a single click rather than checking each individual door. Cisco is also seeing organizations integrate the network-enabled building systems and device power management (e.g., switching employees' IP phones on or off upon swiping an access badge). The migration of physical security toward digital, information, networking technologies and IT has increased demand for open standards and implicit guarantees of interoperability. Physical security information management (PSIM) embraces IT convergence, building dedicated applications whose sole purpose is to manage existing disparate security devices and information systems, including video, access control, sensors, analytics, networks, building systems, etc. Given the emphasis on interoperability, the PSIM industry features relatively small niche players like Orsus (NICE Systems), Proximex, and Vidsys who offer a wide variety of independent out-of-the-box software solutions for a variety of different manufacturers. VidSys highlights five key capabilities for PSIM software systems in Exhibit 183.

170

THE ART OF CYBER WAR — ASYMMETRIC PAYOFFS LEAD TO MORE SPENDING ON PROTECTION

Exhibit 183 Key PSIM Capabilities Collection: Device management independent software collects data from any number of disparate security devices or systems Analysis: The system analyzes and correlates the data, events, and alarms, to identify the real situations and their priority Verification: PSIM software presents the relevant situation information in a quick and easily-digestible format for an operator to verify the situation Resolution: The system provides Standard Operating Procedures (SOPs), step-by-step instructions based on best practices and an organization's policies, and tools to resolve the situation Reporting: The PSIM software tracks all the information and steps for compliance reporting, training and potentially, in-depth investigative analysis
Source: VidSys PSIM White Paper (2008) and Bernstein analysis.

Cisco's Exposure to Physical Security

Currently, Cisco participates across the spectrum of video surveillance products in addition to segments of access control and incident response/building management. Cisco's offerings include IP cameras, analog/IP gateway encoders, recording and storage solutions, web-based video surveillance administration tools, access control gateways and managers, as well as systems promoting interoperability between radio and traditional communication networks for public safety officials and collaboration tools for incidence response. Cisco develops its HD IP camera solutions through a technology partnership with imaging leader Pelco. Just last week, Cisco rolled out new small business IP video camera solutions as well as video monitoring system software with embedded analytics targeted to small business deployments of up to 64 cameras. In access control, rather than offering endpoints products (e.g., cards/tokens, readers) as it does in video surveillance, Cisco provides access gateways and managers that facilitate network integration. Additionally, Cisco offers technology solutions for emergency first responders that bridge disparate communication networks, consolidate pertinent information, and provide collaboration tools. Exhibit 184 delves into Cisco's physical security offerings.

THE ART OF CYBER WAR — ASYMMETRIC PAYOFFS LEAD TO MORE SPENDING ON PROTECTION

171

Exhibit 184

Select Physical Security Offerings from Cisco
Product Description
Encoding servers (encode, distribute, manage, archive video from IP cameras and analog to IP encoders), media servers (distribute, store, and manage video), operations manager software, storage systems, and Virtual Matrix (live video feed remote monitoring) Convergence chassis (network communications and video encoding and decoding), integrated services platforms (network digital video recording and playback), IP gateways (allows analog video streams to be sqitched over the IP network), services platforms, and stream manager software High-definition (HD) video and H.264 compression DVD-quality video and MPEG-4 compression Full 1080p 2.1 megapixel high-definition Dynamic range DVD-quality video and MPEG-4 compression Monitoring system software (controls up to 64 cameras with enhanced control and analytics), cameras, enclosures, and lenses Connects door hardware (locks and readers) to IP network Configures hardware, monitors activity, enrolls users, and integrates with IT applications and data stores Enables interoperability between disparate radio and traditional communication networks for public safety officials. Includes media convergence servers, deployment options, operational views, phone client, push-to-talk management center client software, policy engines, and server software

IP Video Surveillance Management

Video Surveillance

IP Video Surveillance Management for Gaming 4000 Series IP Cameras 2500 Series IP Cameras 5000 Series HD IP Domes 2000 Series IP Domes Small Business Video Surveillance

Access Control

Cisco Physical Access Gateway Cisco Physical Access Manager

Other IP Interoperability & Collaboration (Interoperability) System (IPICS)
Source: www.Cisco.com and Bernstein analysis.

We see the potential for $1-$2 billion in direct physical security equipment revenue for Cisco within 3-5 years, and believe "pull through" sales of switches and routers could be 50% to 100% of direct sales. Although comprising a relatively small portion of revenues today, we believe that physical security provides Cisco an attractive ancillary revenue opportunity. Although some enterprises may prefer to engage with more experienced security incumbents, we believe Cisco can employ its historically successful strategy of leveraging existing client relationships and using the network as a platform to deploy interlinked applications in video surveillance and access control. Additionally, increasing network integration — and concomitant network usage growth particularly through video surveillance consumption — will drive router and switch demand. Today, the $10 billion video surveillance market is ~20% IP. Cisco capturing $1-$2 billion in revenue in 3-5 years is consistent with its track record in other markets, such as enterprise voice. Cisco's stated strategy is to leverage its existing network-based client relationships (Exhibit 185). Security Squared Interview With Steve Collen, Director of Business Development, Cisco Physical Security (October 6, 2009) "Basically our vision is that we start off by using the network as a platform and on top of that platform we are trying to deploy lots of interlinked applications. From my particular perspective, those are physical security applications. So my ideal customer is basically someone who has deployed a Cisco routing and switching infrastructure, they've already deployed a Cisco voice system, they've already got Cisco network security…and basically the physical security stuff is just another application they are able to overlay on that."
Source: SecuritySquared.

Exhibit 185

Although Cisco is still a relatively small player in the physical security market, we believe the company is well-positioned to deliver value-added custom solutions to customers as physical security migrates to the IP network and infrastructures converge (Exhibit 186).

172

THE ART OF CYBER WAR — ASYMMETRIC PAYOFFS LEAD TO MORE SPENDING ON PROTECTION

Exhibit 186 Quotes on Physical Security by Marthin De Beer, SVP, Emerging Technologies "If you think of a project like Songdo, [South Korea], that city, as it's getting built, is getting tens of thousands of video surveillance cameras deployed, tens of thousands of digital signage displays, and TelePresence in every home and apartment. It is done by the developer of the city, not by the actual occupant. So it is a different model for us, a different go-to-market model, but really interesting and exciting." – June 2, 2010 "If I talk to CIOs and enterprise customers, they are seeing lots and lots of growth of traffic on their networks, predominantly driven by video…Your video surveillance camera could become a feed to a TelePresence room so your marketing department can actually look at how well a promotion is doing in a retail store. But the fact that everything becomes interoperable now ensures that new applications can be made available, where before you had pretty much silos. And I think that when you put all of that together, the growth of video will only skyrocket on networks. But it will come with real value for companies as well. So it won't be a burden; it will actually be an enabler." — April 19, 2010
Source: Thomson Reuters StreetEvents.

Exhibit 187 details the impact of Cisco's own firm-wide IP video surveillance upgrade. Exhibit 187
Result Reduced storage requirements by 60% ($500,000)

Impact of IP Video Surveillance System Upgrade for Cisco
Explanation

Intelligence to store video only if motion detected reduces storage volume requirements Servers support nearly double number of cameras because they no Reduced number of servers by 40% ($200,000) longer need to devote compute cycles to video encoding At 4 frames/second, ability to recognize faces is vastly improved over Improved video quality previous system's 2 frames/second Ability to unify CCTV system with other Integrate alarm detection and access control capabilities systems Reduced false alarms by an anticipated 90% Reduced remediation from +5 days to 2-hour response and 24-hour turnaround for repair Reduced time required to investigate security incidents Reduced maintenance costs by 20% Increased security ROI - short payback period Give security personnel ability to view associated video in real-time When proprietary box broke in past, a third-party technician unfamiliar with site requirements was required Stored or real-time CCTV video can be viewed from any camera around the world. More video can also be retrieved at one time IT economies of scale allows less time to be spent monitoring and maintaining servers Network protection and virus definitions are implemented immediately Enables safety and security department to apprehend equipment thieves and recover stolen property

Source: Cisco Systems IP Network-Centric Video Surveillance White Paper (2007).

In April 2006, Cisco effectively entered the physical security market with its acquisition of SyPixx Networks. Since then, the company has forged further partnerships to continue to penetrate the market and promote the integration of physical security and the IP network (Exhibit 188).

THE ART OF CYBER WAR — ASYMMETRIC PAYOFFS LEAD TO MORE SPENDING ON PROTECTION

173

Exhibit 188
Date

Cisco's Historical Acquisitions and Partnerships in Physical Security
Cisco Target/Partner Initiative Partnership: Joint development of HD IP video security cameras built upon Pelco's Sarix technology platform. Pelco's Sarix camera's feature full-frame rate video, H.264 compression, advanced low-light performance, and embedded analytics Acquisition: Intelligent middleware technology enabling businesses to integrate building infrastructure and IT applications over a common IP network, resulting in improved efficiencies, greater energy savings and a reduced carbon footprint Partnership: Incorporation of video surveillance network modules onto existing Cisco Integrated Services Router (ISR) platforms Acquisition: IP-based video surveillance software enabling web-based monitoring, management, recording and storage of audio and video that can be accessed anywhere by authorized users Acquisition: Network-centric video surveillance software and hardware that enable existing analog video surveillance systems to operate as part of an open IP network

Sep-09

Pelco

Jan-09

Richards Zeta

Jun-08

ADT

May-07

Broadware

Apr-06

SyPixx

Source: www.Cisco.com and Bernstein analysis.

Given Cisco's scale and reach, we believe there is a compelling opportunity for the company to facilitate consolidation in the small, fragmented, and growing market of physical security. Providing effective physical security solutions will hinge on a variety of technology and vertical market applications. Through additional acquisitions, Cisco can position itself to attain a portfolio of complementary technologies to service client needs. In Exhibit 189, we highlight attractive acquisition candidates in physical security. Exhibit 189
Potential Acquisiton Targets Axis Communications

Potential Physical Security Acquisition Targets for Cisco
Headquarters Sales (LTM) Market Cap Commentary Market leader and pioneer in IP cameras Existing partner with leading security camera market share and advanced IP technology platform Leading provider of physical security information management software and systems integration Leading provider of physical security information management software and systems integration Leading provider of physical security information management software and systems integration

Lund, Sweden

$368mm

$913M

Pelco

Clovis, CA

NM

NA

Orsus

Irvine, CA

NM

NA

Proximex

Sunnyvale, CA

NM

NA

VidSys

Marlborough, MA

NM

NA

Source: Bernstein analysis.

Cisco's recent acquisitions of Starent, Tandberg, and Pure Digital Technologies have demonstrated Cisco's ability to effectively capture share by successfully leveraging the domain expertise of target company management. We believe that IP video surveillance company Axis Communications is an attractive target, given its market share leadership and margin profile. In addition, acquiring current video surveillance partner Pelco or other physical security information management

174

THE ART OF CYBER WAR — ASYMMETRIC PAYOFFS LEAD TO MORE SPENDING ON PROTECTION

players like Orsus, Proximex, and VidSys would also allow Cisco to gain incremental expertise in security convergence and build a portfolio of complementary technologies. Exhibit 190
Cisco: Income Statement ($ MM) Cisco (Fiscal Years) Revenue Products Services TOTAL Revenue COGS Gross Profit R&D Sales & Marketing General & Administrative Operating Income Net Interest Income (Expense) Other Pre-Tax Income Taxes Pro Forma Net Income PF EPS, Diluted Effect of GAAP on EPS EPS including options, Diluted Shares Outstanding, Diluted Margins Gross Margin % R&D % Sales & Marketing % General & Admimistrative Operating Margin Net Income Margin Year over Year Growth (%) Revenues Operating Income Net Income Shares Outstanding Pro Forma EPS 2009A 29,131 6,986 36,117 12,631 23,486 4,497 7,942 1,277 9,770 499 (128) 10,141 2,185 7,956 $ 1.35 $ $ (0.31) $ $ 1.04 $ 5,886 2009A 65.0% 12.5% 22.0% 3.5% 27.1% 22.0% 2009A -8.7% -16.2% -17.0% -4.3% -13.3% 2010 32,420 7,620 40,040 13,921 26,119 4,719 8,165 1,527 11,708 12 247 11,967 2,529 9,438 1.61 $ (0.29) $ 1.33 $ 5,848 2010 65.2% 11.8% 20.4% 3.8% 29.2% 23.6% 2010 10.9% 19.8% 18.6% -0.6% 19.3%

SCB CSCO Income Statement Model
2011E 37,592 8,321 45,913 16,449 29,464 5,557 9,392 1,927 12,587 17 12,604 2,773 9,831 1.71 $ (0.30) $ 1.41 $ 5,747 2011E 64.2% 12.1% 20.5% 4.2% 27.4% 21.4% 2011E 14.7% 7.5% 4.2% -1.7% 6.1% 2012E 42,757 9,152 51,909 18,623 33,286 6,005 10,442 2,116 14,723 15 14,738 3,242 11,496 2.02 (0.33) 1.69 5,683 2012E 64.1% 11.6% 20.1% 4.1% 28.4% 22.1% 2012E 13.1% 17.0% 16.9% -1.1% 18.3% Q110 7,200 1,821 9,021 3,044 5,977 1,097 1,879 361 2,640 54 19 2,713 597 2,116 0.36 $ (0.06) $ 0.30 $ 5,880 Q110 66.3% 12.2% 20.8% 4.0% 29.3% 23.5% Q110 -12.7% -14.2% -15.3% -1.7% -13.8% Q210 Q310 Q410 Q111E Q211E Q311E Q411E Q112E Q212E Q312E Q412E 7,976 8,436 8,808 8,813 9,241 9,457 10,081 10,108 10,505 10,935 11,209 1,839 1,932 2,028 1,930 2,023 2,117 2,251 2,123 2,245 2,307 2,476 9,815 10,368 10,836 10,743 11,264 11,574 12,332 12,231 12,750 13,242 13,685 3,373 3,611 3,893 3,840 4,036 4,156 4,418 4,373 4,579 4,756 4,915 6,442 6,757 6,943 6,903 7,228 7,418 7,914 7,858 8,171 8,486 8,771 1,109 1,266 1,247 1,331 1,386 1,403 1,438 1,415 1,475 1,532 1,583 1,977 2,104 2,205 2,232 2,319 2,361 2,481 2,461 2,565 2,664 2,753 380 398 388 494 459 472 503 499 520 540 558 2,976 2,989 3,103 2,846 3,064 3,183 3,493 3,484 3,611 3,751 3,877 (3) (24) (15) 11 (2) 7 1 (2) 0 6 26 96 106 2,999 3,061 3,194 2,857 3,063 3,190 3,494 3,482 3,612 3,757 3,888 660 585 687 629 674 702 769 766 795 826 855 2,339 2,476 2,507 2,229 2,389 2,488 2,725 2,716 2,817 2,930 3,033 0.40 $ 0.42 $ 0.43 $ 0.39 $ 0.42 $ 0.43 $ 0.47 $ 0.48 $ 0.49 $ 0.52 $ 0.54 (0.08) $ (0.05) $ (0.10) $ (0.07) $ (0.07) $ (0.07) $ (0.08) $ (0.08) $ (0.08) $ (0.08) $ (0.09) 0.32 $ 0.37 $ 0.33 $ 0.32 $ 0.34 $ 0.36 $ 0.40 $ 0.40 $ 0.41 $ 0.43 $ 0.45 5,862 Q210 65.6% 11.3% 20.1% 3.9% 30.3% 23.8% Q210 8.0% 29.5% 25.3% -0.4% 25.8% 5,869 Q310 65.2% 12.2% 20.3% 3.8% 28.8% 23.9% Q310 27.0% 37.9% 41.2% 0.5% 40.5% 5,795 Q410 64.1% 11.5% 20.3% 3.6% 28.6% 23.1% Q410 27.0% 39.4% 36.3% -0.8% 37.4% 5,745 Q111E 64.3% 12.4% 20.8% 4.6% 26.5% 20.7% Q111E 19.1% 7.8% 5.3% -2.3% 7.8% 5,751 Q211E 64.2% 12.3% 20.6% 4.1% 27.2% 21.2% Q211E 14.8% 3.0% 2.1% -1.9% 4.1% 5,747 Q311E 64.1% 12.1% 20.4% 4.1% 27.5% 21.5% Q311E 11.6% 6.5% 0.5% -2.1% 2.6% 5,745 Q411E 64.2% 11.7% 20.1% 4.1% 28.3% 22.1% Q411E 13.8% 12.6% 8.7% -0.9% 9.7% 5,711 Q112E 64.2% 11.6% 20.1% 4.1% 28.5% 22.2% Q112E 13.9% 22.4% 21.9% -0.6% 22.6% 5,699 Q212E 64.1% 11.6% 20.1% 4.1% 28.3% 22.1% Q212E 13.2% 17.8% 17.9% -0.9% 19.0% 5,677 Q312E 64.1% 11.6% 20.1% 4.1% 28.3% 22.1% Q312E 14.4% 17.8% 17.8% -1.2% 19.2% 5,644 Q412E 64.1% 11.6% 20.1% 4.1% 28.3% 22.2% Q412E 11.0% 11.0% 11.3% -1.8% 13.3%

$ $ $

Source: Bernstein estimates and analysis.

Exhibit 191
Cisco: Balance Sheet ($ MM) Cisco (Fiscal Years) Cash & Cash Equivalents Short Term Investments Other Current Assets Total Current Assets Investments Net PP&E Other Long-Term Assets Total Long-Term Assets Total Assets Total Current Liabilities Debt Total Liabilities Minority Interests Shareholders' Equity Total Liabilities & Shareholders' Equity 2009A 5,718 29,283 9,176 44,177 4,043 19,908 23,951 68,128 13,655 10,295 29,451 30 38,647 68,128 2010 4,581 35,280 11,560 51,421 3,941 25,768 29,709 81,130 19,233 12,188 36,845 44,285 81,130

SCB CSCO Balance Sheet Model
2011E 6,456 35,280 12,202 53,937 3,836 25,768 29,604 83,541 16,333 12,097 33,401 50,141 83,541 2012E 11,551 35,280 13,665 60,496 3,847 25,768 29,615 90,111 16,891 12,097 34,161 55,951 90,111 Q110 4,774 30,591 9,332 44,697 3,976 20,007 23,983 68,680 13,162 10,273 28,654 24 40,002 68,680 Q210 4,710 34,928 10,501 50,139 3,958 22,306 26,264 76,403 14,405 15,194 34,871 20 41,512 76,403 Q310 3,961 35,145 10,652 49,758 3,994 25,540 29,534 79,292 18,439 12,119 35,440 43,852 79,292 Q410 4,581 35,280 11,560 51,421 3,941 25,768 29,709 81,130 19,233 12,188 36,845 44,285 81,130 Q111E 3,821 35,280 11,408 50,510 3,895 25,768 29,663 80,172 18,357 12,097 35,285 44,888 80,172 Q211E 6,056 35,280 11,441 52,777 3,863 25,768 29,631 82,408 18,781 12,097 35,757 46,651 82,408 Q311E 4,657 35,280 11,689 51,626 3,842 25,768 29,610 81,236 15,945 12,097 32,962 48,274 81,236 Q411E 6,456 35,280 12,202 53,937 3,836 25,768 29,604 83,541 16,333 12,097 33,401 50,141 83,541 Q112E 7,222 35,280 12,345 54,847 3,830 25,768 29,598 84,445 15,736 12,097 32,854 51,591 84,445 Q212E 8,869 35,280 12,807 56,956 3,830 25,768 29,598 86,554 16,123 12,097 33,291 53,263 86,554 Q312E 10,334 35,280 13,277 58,891 3,836 25,768 29,604 88,495 16,557 12,097 33,782 54,713 88,495 Q412E 11,551 35,280 13,665 60,496 3,847 25,768 29,615 90,111 16,891 12,097 34,161 55,951 90,111

Source: Bernstein estimates and analysis.

Exhibit 192
Cisco: Cash Flow Statement ($MM) Cisco (Fiscal Years, $MM) Net Income Depreciation & Amortization Change in Working Capital Other (including interest expense) Cash Flow from Operations Capex as a % of Revenue

SCB CSCO Cash Flow Model
2009A 6,134 1,768 1,163 832 9,897 (1,005)
2.8%

2010 7,767 2,030 (472) 848 10,173 (1,008)
2.5%

2011E 8,129 2,199 (471) 323 10,180 (1,540)
3.4%

2012E 9,608 2,054 (929) 574 11,307 (1,438)
2.8%

Q110 1,787 429 (1,078) 350 1,488 (160)
1.8%

Q210 1,853 513 (8) 128 2,486 (248)
2.5%

Q310 2,192 473 216 86 2,967 (291)
2.8%

Q410 1,935 615 398 284 3,232 (309)
2.9%

Q111E 1,822 587 (721) (159) 1,530 (411)
3.8%

Q211E 1,971 561 383 160 3,074 (393)
3.5%

Q311E 2,060 537 (10) 184 2,771 (376)
3.2%

Q411E 2,275 515 (124) 139 2,805 (360)
2.9%

Q112E 2,272 514 (742) 173 2,217 (360)
2.9%

Q212E 2,353 513 (79) 135 2,922 (359)
2.8%

Q312E 2,449 513 (37) 138 3,063 (359)
2.7%

Q412E 2,534 514 (71) 128 3,105 (360)
2.6%

Other Cash Flow from Investments Common Stock Repurchases Other Cash Flow from Financing Cash at Beginning of Period Cash at End of Period

(8,954) (9,959) (3,611) 4,200 589 5,191 5,718

(10,923) (11,931) (7,864) 8,485 621 5,718 4,581

(1,540) (5,621) (1,145) (6,766) 4,581 6,456

(1,438) (6,899) 2,125 (4,774) 6,456 11,551

(1,093) (1,253) (1,869) 690 (1,179) 5,718 4,774

(6,684) (6,932) (1,375) 5,757 4,382 4,774 4,710

(2,757) (3,048) (2,196) 1,528 (668) 4,710 3,961

(389) (698) (2,424) 510 (1,914) 3,961 4,581

(411) (2,291) 412 (1,879) 4,581 3,821

(393) (955) 508 (447) 3,821 6,056

(376) (1,211) (2,583) (3,794) 6,056 4,657

(360) (1,164) 518 (646) 4,657 6,456

(360) (1,614) 523 (1,090) 6,456 7,222

(359) (1,444) 529 (916) 7,222 8,869

(359) (1,774) 534 (1,240) 8,869 10,334

(360) (2,067) 539 (1,527) 10,334 11,551

Source: Bernstein estimates and analysis.

Copyright of Black Book - The Art of Cyber War - Asymmetric Payoffs Lead to More Spending on Protection is the property of Bernstein Global Wealth Management and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use.