WHITEHAWK LIMITED — Interim / Quarterly Report 2019

Jan 29, 2020

2019

Quarterly Report

==> picture [454 x 322] intentionally omitted <==

Quarterly Activities Report for the Period Ended December 31, 2019

WHITEHAWK LIMITED (ASX: WHK OR “THE COMPANY”), THE FIRST GLOBAL ONLINE CYBER SECURITY EXCHANGE ENABLING SMALL AND MIDSIZE ENTERPRISES (REVENUE OF USD$1M TO USD$1B) TO TAKE SMART ACTION TO IDENTIFY AND ADDRESS CYBER RISK, IS PLEASED TO PROVIDE AN UPDATE ON ITS PROGRESS FOR THE FOURTH QUARTER 2019.

HIGHLIGHTS

• Creation of a comprehensive Enterprise Cyber Risk Program including: Continuous Risk Monitoring, Prioritization, Validation via Real Time Red-Team and Dark Net Assessment. First 3 year Cyber Risk Program sold via new Strategic Partnership with Global Consulting Group, GSIS | Global Security Innovative Strategies | Washington DC .

• Cyber Risk Radar implementation for Top 12 US Defence Industrial Base (DIB) Company, across their 150 suppliers, is ready for U.S. Federal Government live capability demonstrations of the platform, to include: breadth of risk detection and mitigation features and scalability across thousands of Supplier, Vendor and Partner companies

• Across the U.S. Federal Government, new cybersecurity policies are being implemented across all contractors, suppliers and vendors, the Cybersecurity Maturity Management Certification (CMMC), starting in 2020 Official Government Site: https://www.acq.osd.mil/cmmc/faq.html The WhiteHawk Cyber Risk Radar automates and scales the ability for government contractors of all sizes to achieve CMMC Levels 1-4 in 2020 and beyond

• Four new US DIB Company Cyber Risk Radar proposals in various stages of scoping and refinement, being strongly motivated by achieving the new CMMC Levels of certification requirement

• Based upon current contract in place with U.S. Department of Homeland Security (DHS) CISA as sub-contractor to Guidehouse (formerly PWC Federal), new comprehensive task being scoped for 1[st] QTR 2020

• Additional U.S. Federal Government customer Cyber Risk Radar near term contract being negotiated for 1[st] quarter 2020 (delayed from 2019)

• Sontiq/WHK SMB Digital Age Risk Offering approved by US Financial Institution Business Card, but Phase 1 delayed to 1[st] Quarter 2020

• Proven WhiteHawk Product Lines (Cyber Risk Radar, Scorecards and Program), have been aligned by the marketing team into online demo videos and standardized communication’s Lexicon, for scaling of efficient and effective customer outreach and engagement

• USD$295K collected relating to sales receipt from customers, $252K of which is a renewable SaaS subscription

Page 2

• First quarter 2020 cash outflows of USD$564K to be offset by expected cash inflows from revenue growth

• WhiteHawk finishes quarter with a strong cash position of USD$1.5M and a strong pipeline of sales contracts

• Additional Working Capital Facilities from RiverFort Global comprising a A$400,000 Loan and a A$1.5m combined placement and Equity Swap ) as per the ASX announcement dated 30 January 2020 (subject to shareholder approval to the placement to be obtained at the 2020 AGM in May)

• The January 2019 RiverFort Global Equity Swap has to date returned in excess of AUD$60K to WhiteHawk above the original placement.

==> picture [458 x 36] intentionally omitted <==

UPDATES FROM THE QUARTER

==> picture [458 x 36] intentionally omitted <==

Comprehensive Annual Subscription Contract put in place with Top 12 U.S. DIB Company for 150 Suppliers and Vendors

Contract Summary

• A comprehensive program for 150 vendors has been contracted and implemented as a scalable, repeatable and effective approach for monitoring, prioritizing and mitigating DIB Supplier business and cyber risks.

• This program builds upon the lessons learned from two smaller contracts, for a total of over USD$700K, incorporating a flexible Tiered approach to Digital Age risk identification and mitigation

• WhiteHawk providing online platform Software as a Service (SaaS), an annual recurring subscription augmented by consulting risk services.

Progress for the Quarter

• Implemented Business and Cyber Risk Monitoring for 30 Tier 1 Suppliers

• Implemented Cyber Risk Monitoring for 35 Tier 2 Suppliers

• Completed Cyber Risk Scorecards for 65 Suppliers and Vendors

• Working stakeholder engagement to codify risk management requirements, documentation and risk mitigation engagement processes

• Scoping additional programs for implementation and demonstration to U.S. Federal Government Supply Chain Cyber Risk Monitoring and Resolution.

Third Contract Extension: Signed with top 10 U.S. Financial Institution

Contract Summary

• Third contract extension secured with a U.S. top 10 financial institution

• This Cyber Risk Radar provides major businesses with a comprehensive analysis of the business and cyber risks associated with 50 of their Tier 1 vendors, suppliers and sub-contractors

• A 3-month contract extension was signed December 2019

Page 3

• Open Request for Proposals for a long-term Vendor Risk Management Program was released and responded to 15 March 2019 and announcement of winner is now extended to April 2020.

Contract Progress for the Quarter

• 50 updated Cyber Risk Scorecards were delivered on each Vendor

• Transition to updated Business Risk Platform was completed and training on new platform conducted

• Portfolio risk analytics were begun to track and highlight risk trends.

Execution on 1[st] Contract with U.S. Federal Government Department CIO commences under prime contractor:

Contract Summary

• WhiteHawk's sub-contract length is 5 years (1 year with 4 option years) and includes Cyber Subject Matter Expertise and Cyber Risk Solutions

• Contract execution has been in ramp up phase until now with first meaningful tasks assigned and executed. First 6 months revenue reflected the ramp up phase only, totalling USD$45K in 2019.

Contract Progress during the quarter

• First Cyber Risk Policy and strategy project completed.

• Revenues commenced in August.

• Second and third Cyber Risk Policy and strategy projects are being scoped and could commence in February 2020.

Execution on 2[nd] Contract with U.S. Federal Government Department CIO initially now being executed (announced May 1[st] , 2019):

Contract Summary

• WhiteHawk's sub-contract length is 5 years (1 year with 4 option years)

• First Cyber Risk Policy and strategy project assigned in August 2019 following completion of government initiation and ramp up phase

• Revenues commenced in August

• First full year (12 Month) revenue to WhiteHawk is expected to be between USD$300K to USD$600K and is subject to final scoping by the prime contractor and customer.

Contract Progress during the quarter

• Second and third Cyber Risk Policy and strategy projects were scoped and commenced in December.

3[rd] Contract with U.S. Federal Department of Homeland Security Cybersecurity and Infrastructure Security Agency (CISA) Prime Guidehouse (formerly PWC Federal):

Page 4

Security service cost can be WhiteHawk commenced sub-contractor role under the prime contractor on a newly awarded USD$28M contract in October 2019, additional cyber risk work is scoped and due to begin in January 2020.

Contract Summary

• WhiteHawk is a sub-contractor on a contract won by the prime contractor. The contract is for 7 years (1 year with 6 option years)

• WhiteHawk’s portion is scoped to be between USD$150K to USD$300K annually.

Contract Progress during the quarter

• Cybersecurity online offering has been scoped and mapped to DHS CISA initial requirements for phase 1 completion in 2020 and phase 2 in 2021. Initial invoice will be in January 2020.

==> picture [422 x 33] intentionally omitted <==

WHITEHAWK PRIMARY SALES CHANNELS

U.S. National Sales Channel through integration with Sontiq/EZShield: to include Financial Institution Business Card, Business Loan and Family Office Clients.

Offering: A Digital Age integrated business risk SaaS subscription (by month or annually) which addresses company financial fraud, identity theft, mobile device security, and cyber risk identification services, for all business customers. Current sales traction being seen with:

• 1 – Bank Business Card Customers

• Access to 400,000 to 1.2M SME’s to WHK products

• WHK products paid for by the Bank and implemented by the Business Customer

• Ability for the customer company to purchase the plus or premium service for their company and employees.

• Security service cost can be included in credit card fees, making it cost neutral for the bank.

• 2 - Bank Business Loan Customer with services to 5,000 to 25,000 SMB’s (provided the Level 1 service (Secure) paid for by the Bank and implemented by the Business Customer (with the ability for customer company to purchase the plus or premium service for their company and employees). Security service cost can be included in the loan fees, making it cost neutral for the bank and there is a revenue share option

• 3– Bank or Association Family Office Clients with services to 4,000 to 10,000 Clients ( provided the Level 2 service (Plus) paid for by the Bank or Association and implemented by the Family Office Client. Security service cost can be included in the fees, making it cost neutral for the Bank or Association (there is a revenue share option).

Page 5

==> picture [422 x 34] intentionally omitted <==

WHITEHAWK PRODUCT LINE DESCRIPTIONS & DEMOS

The following are the product line updates, perfected based upon real customer feedback and in-house development and testing:

Cyber Risk Portfolio Report:	The Cyber Risk Portfolio Report is an aggregated view of data collected across multiple suppliers or entities revealing current vulnerability trends and changes over time across the included companies or organizations. The format is similar to that of a Cyber Risk Scorecard but covers more than one company.
Cyber Threat Readiness Questionnaire (CyberPath):	The Cyber Threat Readiness Questionnaire is an online assessment that identifies key cyber risks to businesses or organizations, providing tailored risk mitigation options grouped in optimized and integrated bundles of solution options. By answering just 10 questions, a business can find out what the greatest threats to its industry are and how best to protect itself. This free online tool identifies the biggest risks and matches companies to affordable products that can help them today. Equipped with the results of the Cyber Threat Readiness Questionnaire and a short consultation with a WhiteHawk Cyber Consultant, a business is armed with the right information to take immediate action, thereby positively impacting their cyber risk posture.
Cyber Risk Radar:	Cyber Risk Radar provides continuous monitoring, prioritization, and near real-time mitigation of an enterprises' teammates, vendors, or supply chain’s cyber risks over time, including the identification and prioritization of a risk mitigation strategy. Cyber Risk Radar is an annual SaaS subscription consisting of quarterly services including Cyber Risk Scorecards, Cyber Risk Portfolio Reports, and ongoing conversations with a professional Cyber Analyst.
Cyber Risk Scorecard:	The WhiteHawk Cyber Risk Scorecard provides an executive level view of cyber risks for a singular companybased on open source data,AI analytics,and

Page 6

	custom Cyber Consultant commentary. Three tiers of Cyber Risk Scorecards provide for varying depth and detail, available as singular snapshots or continuous coverage over time. Purchase of a Cyber Risk Scorecard includes virtual access to a Cyber Consultant to talk through the identified risk environment and determine actionable, affordable steps to risk mitigation and cyber risk prevention.
WhiteHawk Business Model:	The WhiteHawk Business Model leverages our online Cybersecurity Exchange platform and best-of-breed SaaS partners to identify, prioritize, and mitigate cyber risks that impact your revenue and reputation. At WhiteHawk we partner with top commercial technologies and SaaS services that leverage AI techniques and open data sources. We are product and vendor agnostic, continuously vetting innovation to bring affordable, impactful solutions to businesses and organizations of all sizes across all sectors.
Annual Cyber Risk Scorecard Subscription:	Our Annual Cyber Risk Scorecard Subscription consists of quarterly (4) Cyber Risk Scorecard updates combined with Cyber Consultant sessions in tandem with the delivery of each scorecard. Each Scorecard includes information provided by a risk rating service, in addition to WhiteHawk Cyber Consultant risk analytics, notes, and solution options.
Cyber Marketplace:	As part of the WhiteHawk Cybersecurity Exchange, the Cyber Marketplace is an online resource offering hundreds of best-of-breed, affordable products and services catering to cyber risk mitigation needs of small to midsized businesses and organizations. Cyber Marketplace visitors can learn about and purchase solutions by contacting a WhiteHawk Cyber Consultant.
Cyber Risk Profile (CyberPath):	The Cyber Risk Profile, located in the WhiteHawk Cybersecurity Exchange, is the online client portal, a detailed, customized company summary generated based on information submitted through the Cyber Threat Readiness Questionnaire. The profile informs customers of key risks to their revenue and reputation, providing recommendations to prevent and mitigate cybercrime and fraud bymeans of

Page 7

solution option bundles. Cyber Risk Program: The WhiteHawk Cyber Risk Program is an outside-in second set of expert eyes monitoring, identifying, prioritizing, validating, and mitigating cyber risks to a company or organization’s revenue and reputation. The program is delivered to the Chief Information Officer (CIO), Executive Team, Chief Executive Officer (CEO), and Board of Directors (BOD). The Cyber Risk Program includes Cyber Risk Continuous Monitoring and Prioritization; Cyber Risk Executive Level Scorecards and Reporting; Cyber Risk Validation by Real-Time Red Team Assessment, and as appropriate, a Dark Net Assessment based upon Cyber Risk Program findings.

==> picture [458 x 35] intentionally omitted <==

OUTLOOK

As a result of our relentless product and sales channel development and refinement since our initial investments in 2018 and 2019, WhiteHawk is now strategically positioned for growth in 2020:

• We have perfected our Product Lines – based upon real customer feedback and iterative in-house development

• We have assembled the key multidisciplinary skillsets and optimized our team and their execution.

• Successfully automated, scaled and optimized for margins:

• Cyber Risk Radar

• Online Customer Journey & Cyber Risk Scorecard

• Cyber Risk Program

• Our sales channels have been optimised – what works near-term, what has not worked near term, and what we can nurture and leverage longer term.

• We are honing our Product Line marketing materials, video demos and splash pages for ease of engagement and speed of sales generation

• While our strategy of using key federal government contracts in place has not delivered customers to our online decision engine marketplace quickly as we expected (primarily because of the longer ramp up and initiation phases of large government departments and Prime Contractor execution) – we now have major work coming up that will start to deliver revenues on not just the risk review products but also the online decision engine marketplace

Page 8

• By positioning our Cyber Risk Radar across the Defense Industrial Base and key U.S. Federal Government Departments (as the AI Driven and automated approach to track and implement Cyber Resilience across over 330,000+ companies) has put us at the forefront of enabling all U.S. Federal government contractors to meet the new 2020 Cybersecurity Maturity Management Certification (CMMC) Levels

• Large and potentially game changing contracts and opportunities are coming to fruition.

We are reordering our primary areas of focus for the 1[st] QTR 2020:

1. Kick off Phase 1 of the Sontiq/EZShield/WhiteHawk SMB SaaS services to one of two Tier 1 Financial Institutions (currently in advanced discussions) across their respective business customers. Thereby scaling our online services to thousands of SMB’s or Family Offices in 2020.

2. In sync with the new U.S. Federal Government CMMC 2020 policies, advance the 4 mature Cyber Risk Radar proposal conversations with Top Tier Defense Industrial Base Companies, delivering 1-2 new contracts early in 2020.

3. Drive, work and deliver major task on 3[rd] U.S. Government contracts in 2020, and fully execute on others as Primes allow.

The Quarterly Report for the period ended December 31, 2019 follows.

DISCLOSURE STATEMENT

The Additional Information to Appendix 4C quarterly report ("the Additional Information") is given in summary form and does not purport to be complete. The Additional Information including financial information, should not be considered as a financial projection, advice or a recommendation to any particular or potential investors in relation to subscribing for securities in WhiteHawk. Before acting on any information readers should consider the appropriateness of the information having regard to these matters, any relevant offer document and in particular, readers should seek independent financial advice. All securities involve risks, which include (among others) the risk of adverse or unanticipated market, financial or political developments and, in international transactions, currency risk. The Additional Information may include statements regarding the Company's intent, belief or current expectations with respect to our businesses and operations, market conditions, revenues, market penetration, and results of operations. Readers are cautioned not to place undue reliance on these statements. WhiteHawk does not undertake any obligation to publicly release the result of any revisions to these statements to reflect events or circumstances after the date hereof to reflect the occurrence of unanticipated events. While due care has been used in the preparation of the Additional Information, actual results may vary in a materially positive or negative manner and are subject to uncertainty and contingencies outside WhiteHawk's control.

Page 9

Appendix 4C Quarterly report for entities subject to Listing Rule 4.7B

+Rule 4.7B

Appendix 4C

Quarterly report for entities subject to Listing Rule 4.7B

Introduced 31/03/00 Amended 30/09/01, 24/10/05, 17/12/10, 01/09/16

Name of entity

WhiteHawk Limited ABN Quarter ended (“current quarter”) 97 620 459 823 31 December 2019

Consolidated statement of cash flows	Consolidated statement of cash flows	Current quarter	Year to date
		$US’000	(12 months)
			$US’000
1.	Cash flows from operating activities
1.1	Receipts from customers	295	824
1.2	Payments for
	(a) research and development	(152)	(698)
	(b) product manufacturing and operating	(182)	(481)
	costs
	(c) advertising and marketing	-	(43)
	(d) leased assets	-	-
	(e) staff costs	(164)	(750)
	(f) administration and corporate costs	(228)	(800)
1.3	Dividends received	-	-
1.4	Interest received	2	7
1.5	Interest and other costs of finance paid	-	(12)
1.6	Income taxes paid	-	-
1.7	Government grants and tax incentives	-	-
1.8	Other (GST)	7	51
1.9	Net cash from / (used in) operating	(422)	(1,902)
	activities

2.	Cash flows from investing activities
2.1	Payments to acquire:
	(a) property, plant and equipment	(5)	(9)
	(b) businesses (see item 10)	-	-
	(c) investments	-	-

• See chapter 19 for defined terms

1 September 2016

Page 1

Appendix 4C Quarterly report for entities subject to Listing Rule 4.7B

Consolidated statement of cash flows	Consolidated statement of cash flows	Current quarter	Year to date
		$US’000	(12 months)
			$US’000
	(d) intellectual property	-	-
	(e) other non-current assets (Bonds paid)
2.2	Proceeds from disposal of:
	(a) property, plant and equipment	-	-
	(b) businesses (see item 10)	-	-
	(c) investments	-	-
	(d) intellectual property	-	-
	(e) other non-current assets	-	-
2.3	Cash flows from loans to other entities	120	(118)
2.4	Dividends received (see note 3)	-	-
2.5	Other#	9	61
2.6	Net cash from / (used in) investing	124	(66)
	activities

2.6 Net cash from / (used in) investing activities 124 (66)	2.6 Net cash from / (used in) investing activities 124 (66)	2.6 Net cash from / (used in) investing activities 124 (66)	2.6 Net cash from / (used in) investing activities 124 (66)
# As announced to ASX on 5 February 2019, other income received under the Equity Swap Agreement relates to difference
between	benchmark price and market price referred to in the Agreement.
3.	Cash flows from financing activities
3.1	Proceeds from issues of shares	-	2,639
3.2	Proceeds from issue of convertible notes	-	-
3.3	Proceeds from exercise of share options	-	14
3.4	Transaction costs related to issues of	-	(169)
	shares, convertible notes or options
3.5	Proceeds from borrowings	-	-
3.6	Repayment of borrowings	-	(250)
3.7	Transaction costs related to loans and	-	-
	borrowings
3.8	Dividends paid	-	-
3.9	Other (provide details if material)	-	-
3.10	Net cash from / (used in) financing	-	2,234
	activities
4.	Net increase / (decrease) in cash and
	cash equivalents for the period
4.1	Cash and cash equivalents at beginning of
	quarter/year to date	1,784	1,292
4.2	Net cash from / (used in) operating	(422)	(1,902)
	activities (item 1.9 above)
4.3	Net cash from / (used in) investing activities	124	(66)
	(item 2.6 above)
4.4	Net cash from / (used in) financing activities	-	2,234
	(item 3.10 above)

• See chapter 19 for defined terms

1 September 2016

Page 2

Appendix 4C Quarterly report for entities subject to Listing Rule 4.7B

Consolidated statement of cash flows	Consolidated statement of cash flows	Current quarter	Year to date
		$US’000	(12 months)
			$US’000
4.5	Effect of movement in exchange rates on	41	(31)
	cash held
4.6	Cash and cash equivalents at end of	1,527	1,527
	quarter**

** Cash and cash equivalents as at December 31, 2019 does not include receivable amount of A$116,667, under the Equity Swap Agreement, as announced to ASX on 5 February 2019.

5.	Reconciliation of cash and cash	Current quarter	Previous quarter
	equivalents	$US’000	$US’000
	at the end of the quarter (as shown in the
	consolidated statement of cash flows) to the
	related items in the accounts
5.1	Bank balances	82	289
5.2	Call deposits	1,445	1,495
5.3	Bank overdrafts	-	-
5.4	Other (provide details)	-	-
5.5	Cash and cash equivalents at end of	1,527	1,784
	quarter (should equal item 4.6 above)

6.	Payments to directors of the entity and their associates	Current quarter
		$US'000
6.1	Aggregate amount of payments to these parties included in item 1.2	59
6.2	Aggregate amount of cash flow from loans to these parties included	-
	in item 2.3
6.3	Include below any explanation necessary to understand the transactions included in
	items 6.1 and 6.2

N/A

7.	Payments to related entities of the entity and their	Current quarter
	associates	$US'000
7.1	Aggregate amount of payments to these parties included in item 1.2	88
7.2	Aggregate amount of cash flow from loans to these parties included	-
	in item 2.3
7.3	Include below any explanation necessary to understand the transactions included in
	items 7.1 and 7.2

N/A

• See chapter 19 for defined terms 1 September 2016

Page 3

Appendix 4C Quarterly report for entities subject to Listing Rule 4.7B

8.	Financing facilities available	Total facility amount	Amount drawn at
	Add notes as necessary for an	at quarter end	quarter end
	understanding of the position	$US’000	$US’000
8.1	Loan facilities	See below 8.4		-
8.2	Credit standby arrangements	-		-
8.3	Other (please specify)	See below 8.4		-
8.4	Include below a description of each facility above, including the lender, interest rate and
	whether it is secured or unsecured. If any additional facilities have been entered into or are
	proposed to be entered into after quarter end, include details of those		facilities as well.

The Company has the following financing facilities available:

• (a) As at 31 December 2019, A$116,667 is payable to Company under an Equity Swap Agreement as per the ASX announcement dated 5 February 2019.

• (b) As per the ASX announcement dated 30 January 2020, A$400,000 working capital loan facility is available to the Company.

• (c) As per the ASX announcement dated 30 January 2020, A$1.5m is available to the Company as a placement by the Company that will be placed into an equity swap repayable to the Company in equal instalments over 12 months. The placement is subject to shareholder approval to be obtained at the AGM in May 2020.

9.	Estimated cash outflows for next quarter	$US’000
9.1	Research and development	152
9.2	Product manufacturing and operating costs	100
9.3	Advertising and marketing	15
9.4	Leased assets	-
9.5	Staff costs	147
9.6	Administration and corporate costs	150
9.7	Other (provide details if material)	-
9.8	Total estimated cash outflows	564

10.	Acquisitions and disposals of	Acquisitions		Disposals
	business entities
	(items 2.1(b) and 2.2(b) above)
10.1	Name of entity		-		-
10.2	Place of incorporation or		-		-
	registration
10.3	Consideration for acquisition or		-		-
	disposal
10.4	Total net assets		-		-
10.5	Nature of business		-		-

• See chapter 19 for defined terms 1 September 2016

Page 4

Appendix 4C Quarterly report for entities subject to Listing Rule 4.7B

Compliance statement

• 1 This statement has been prepared in accordance with accounting standards and policies which comply with Listing Rule 19.11A.

• 2 This statement gives a true and fair view of the matters disclosed.

Sign here: ............................................................ Date: ............................................. 30 January 2020 ~~(Director~~ /Company secretary)

Kevin Kye Print name: .........................................................

Notes

1. The quarterly report provides a basis for informing the market how the entity’s activities have been financed for the past quarter and the effect on its cash position. An entity that wishes to disclose additional information is encouraged to do so, in a note or notes included in or attached to this report.

2. If this quarterly report has been prepared in accordance with Australian Accounting Standards, the definitions in, and provisions of, AASB 107: Statement of Cash Flows apply to this report. If this quarterly report has been prepared in accordance with other accounting standards agreed by ASX pursuant to Listing Rule 19.11A, the corresponding equivalent standard applies to this report.

3. Dividends received may be classified either as cash flows from operating activities or cash flows from investing activities, depending on the accounting policy of the entity.

4. See chapter 19 for defined terms 1 September 2016

Page 5