WHITEHAWK LIMITED — Interim / Quarterly Report 2021

Oct 27, 2021

2021

Quarterly Activities Report

==> picture [454 x 321] intentionally omitted <==

Quarterly Activities Report for the Period Ended September 30, 2021

WHITEHAWK LIMITED (ASX: WHK OR “THE COMPANY”), THE FIRST GLOBAL ONLINE CYBER SECURITY EXCHANGE ENABLING BUSINESSES OF ALL SIZES TO TAKE SMART ACTION AGAINST CYBERCRIME, IS PLEASED TO PROVIDE AN UPDATE ON ITS PROGRESS FOR THE THIRD QUARTER 2021.

HIGHLIGHTS

• Invoiced US$1.964M YTD in 2021 up 8% over same period 2020. Invoicing US$1.2M in the third quarter of 2021.

• Collected US$880K relating to sales receipt from customers.

• US$526K in receivables will be collected in October 2021.

• WhiteHawk finishes the 3rd quarter of 2021 with a cash position of US$1.861M and no debt.

• Kicked-off Cyber Risk Radar 60-day Proof of Concept (POC) with Global Social Media Company for $100K USD. Based on client feedback, tailoring the implementation of a comprehensive program to commence December 2021.

• Three additional 60-day Cyber Risk Radar Proof of Concept (POC) (ranging from $125K$275K) have been scoped for execution in 2021, two with US Government and one with US based industry.

• Cyber Risk Program scoped for US based International University in 2021.

• Co-Sell agreement with D&B Public Sector, to both US Government Organizations and US Federal Contractors and Suppliers, now entering direct sales phase (after completing technical integration, vetting of Services Level Agreement, marketing and sales channel coordination). In parallel, coordinating with commercial sales leads.

• Kicked-Off sales channel across key Federal Contractors as part of the Amazon Web Services (AWS) Partner Network (APN), focused on joint solution for regulatory compliance with Cybersecurity Maturity Model Certification (CMMC) now required across all Department of Defence contractors and suppliers. AWS - Amazon Web Services, Inc. is a subsidiary of Amazon providing on-demand cloud computing platforms globally.

• Brian Hibbeln joined WhiteHawk as Non-Executive Board Member August 31, 2021. Currently a Venture Partner at Sinewave Venture Capital, LLC, Mr Hibbeln was previously the Director of the US Department of Defense (DoD), Remote Sensing Center, managing up to $7B USD in US Government contracts supporting the DoD and US Intelligence Community. Mr Hibbeln is also an advisor to Blackstone’s $32 Billion-dollar Tactical Opportunities Private Equity Fund with a focus on technology matters.

• 2[nd] year of contract extended through 2021, U.S. Department of Homeland Security (DHS) CISA QSMO Cybersecurity Marketplace, as a sub-contractor to Guidehouse (formerly PWC Federal), for US$1.5 to $1.8M Fiscal Year 2021. Working coordination of follow-on award in light of current U.S. Government Continuing Resolution (CR).

• Executing on Option Year 1 of 4 option years (after base year), Prime Contractor on U.S. Federal Government CISO Cyber Risk Radar for up to US$1.18M annually.

• Phase 2 of current contract scoped for a Cyber Risk Radar across an initial 1,000 suppliers in 4[th] QTR 2021 for US$1.1M. Cyber Risk Program contract 2[nd] YR being executed, via a Global Consulting Firm in direct support of a Global Manufacturer.

• Government active opportunities include: NAVINTEL, US Dept of Navy, Open-Source Cybersecurity Small Business Sources Sought June 7, 2021; US Dept of Treasury Small Business Cyber Security Assessment RFI May 6, 2021 and Cyber Risk Radar Proof of Concept for a US State Government CISO.

UPDATES FROM THE QUARTER

Second Year as Prime developer on contract with U.S. Federal Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) QSMO Cybersecurity Marketplace

Contract Summary

• WhiteHawk is a subcontractor on a contract won by the prime contractor, Guidehouse: The original contract is for 3 years (1 year with 2 option years).

• Executing Option Year 2 for Fiscal Year 2022 (October 2021-2022).

Contract Progress during the quarter

• New US Federal Administration DHS CISA members are aligning QSMO Cybersecurity online Marketplace requirements across all US Federal Department stakeholders and transitioning all work to US Federal Government owned cloud environment.

• Development of platform ongoing to meet Initial Operating Capability by early 2020.

Second year Cyber Risk Program contract with major U.S. Manufacturer via Global Consulting Partner and new Task Order vetting for Cyber Risk Radar

Contract Summary

• Cyber Risk Program is a “Hacker View” of prioritized cyber risks and mitigation strategies tailored and delivered to the Chief Information Officer (CIO), Executive Team, Chief Executive Officer (CEO), and Board of Directors (BoD).

• This independent expert risk assessment subscription for 7 Business Groups includes: Cyber Risk Continuous Monitoring and Prioritization; Quarterly Executive Level Scorecards and Reporting; and mapping to prioritized risk mitigation approaches and solution options.

• Client added deep assessment tasks which are underway across the CISO Team.

Progress for the Quarter

• Additional requirement for Cyber Risk Radar delayed by leadership changes, now planned for a Phase 1 of an initial 1,000 suppliers, late 2021/early 2022.

• Assessment of the CISO’s current team challenges, processes, training and optimization continues.

Prime Cyber Risk Radar Contract being executed (1[st] of 4 option years after base year in 2019) in support of U.S. Federal Government Department, Chief Information Security Officer (CISO),

Contract Summary

• WhiteHawk providing online platform Software as a Service (SaaS), an annual recurring CyberSupply Chain Risk Management (C-SCRM) subscription, with training and technical reach-back.

• • Automated Business Risk Reports provided twice annually, and Cyber Risk Scorecards being provided quarterly via an integrated and interactive vendor risk management dashboard.

Progress for the Quarter

• Tailored training sessions on the platform for new team members being provided.

• Business and Cyber Risk Continuous Monitoring, Alerting and Tracking ongoing.

• Quarterly Cyber Risk Scorecards mapped to Vendor Risk Management SaaS Dashboard.

• Working on documenting new team member requirements and respective deliverables.

2[nd] Contract with U.S. Federal Government Department CIO :

Contract Summary

• WhiteHawk's Cyber Risk Policy subcontract length is 5 years (1 year with 4 option years).

Contract Progress during the quarter

• With new leadership, scoping an automated Cyber Risk Management Framework across the Sector, based upon Proof of Concept conducted back in 2019.

• Appears that Small Business Set-Aside multi-million Task Order opportunity remains delayed by current Administration.

Cashflows

• Revenues remain consistent, with the Company recording revenue in each of the nine months of 2021. 2021 invoicing of US$2M is a mixture of government contracts, executive consulting, Cyber Risk Radar, Cyber Risk Program and WhiteHawk Scorecard product lines, an 8% increase over same period last year.

• The company will collect US$526K in receivables in October 2021 from third quarter invoicing of government contracts, executive consulting and WhiteHawk Scorecards.

• Payment made to related parties include payments made for the services provided by Key Management Personnel including Directors of the Company.

OUTLOOK

2021/2022 Growth Channels Implemented and Expanding:

• 1) Co-Sell Agreement with Global Business Risk/Credit Risk Manager, D&B Public Sector: Phase 1 has been the development of the D&B Cyber Compliance report Powered by WhiteHawk, soon to be an option via the D&B Investigate Offering for Cyber-Supply Chain Risk Management (C-SCRM),: https://www.dnb.com/products/government/investigate.html a Public Sector Offering.

• 2) Joint go to market campaign focusing on a “one-two punch” approach to effectively meeting the U.S. Department of Defense (DoD) Cybersecurity Maturity Model Certification (CMMC), now a baseline requirement for all 300,000+ DOD Contractors. This sales strategy is with Amazon Web Services (AWS) Federal and WhiteHawk Inc. as a member of the Amazon Partner Network (APN) and includes:

• a. AWS Cybersecurity Maturity Model Certification (CMMC) Customer Responsibility Matrix (CRM). The CRM provides a breakdown of the CMMC practices / controls that customers can inherit by using AWS. This enables defense industrial base (DIB) & DOD customers to accelerate CMMC compliance and reduce their level of effort: Compliant Framework for Federal and DoD Workloads in AWS GovCloud (US) helps customers deploy foundational AWS infrastructure to support an automated, secure, scalable, multi-account environment based on AWS best practices for CMMC.

• b. APN WhiteHawk Cybersecurity Exchange automated path to CMMC for all DOD Government Entities and DIB Primes, with a comprehensive and scalable Path to CMMC for all of their Team-Mates and Suppliers: https://www.whitehawk.com/cmmc

• 3) Kicked off a Cyber Risk Radar Proof of Concept (POC) with a Global Social Media Company, in preparation for a comprehensive C-SCRM Program by the end of 2021. This is the first of 3 60day POC’s that have been scoped for 2021 (between $100K and $275K). A majority of current Cyber Risk Radar contracts started with similar POC’s where a client can see the efficiency and effectiveness of the integrated and automated SaaS Platform.

Major Engagement/PR events include:

• a. Corporate Governance Institute (CGI) Webinar to over 2,000 Commonwealth members, August 24[th] .

• b. Military Cyber Professionals Association speech to 35,000+ government & industry members, September 7[th] .

• c. ANZ India Business Chamber Cyber Summit, keynote and panelist to 5,000+ members September 17[th] .

• d. Switzer Day Small Cap presentation and Q&A September 28[th] .

• e. WHK CEO Terry Roberts asked to join D&B Partner Advisory Board.

• f. Keynoted at Governor’s State-wide Cyber Summit October 4[th] .

• g. Wrote Cyber-Supply Chain Risk Management Chapter 10 of Cybersecurity Book released for Global Thought Leadership: https://lnkd.in/daZtP7P2

The Appendix 4C Quarterly Activities Report for the Period Ended September 30, 2021, follows.

DISCLOSURE STATEMENT

The Quarterly Activities Report is given in summary form and does not purport to be complete. The Quarterly Activities Report including financial information, should not be considered as a financial projection, advice, or a recommendation to any particular or potential investors in relation to subscribing for securities in WhiteHawk. Before acting on any information readers should consider the appropriateness of the information having regard to these matters, any relevant offer document and in particular, readers should seek independent financial advice. All securities involve risks, which include (among others) the risk of adverse or unanticipated market, financial or political developments and, in international transactions, currency risk. The Quarterly Activities Report may include statements regarding the Company's intent, belief, or current expectations with respect to our businesses and operations, market conditions, revenues, market penetration, and results of operations. Readers are cautioned not to place undue reliance on these statements. WhiteHawk does not undertake any obligation to publicly release the result of any revisions to these statements to reflect events or circumstances after the date hereof to reflect the occurrence of unanticipated events. While due care has been used in the preparation of the Quarterly Activities Report, actual results may vary in a materially positive or negative manner and are subject to uncertainty and contingencies outside WhiteHawk's control.

Rule 4.7B

Appendix 4C

Quarterly cash flow report for entities subject to Listing Rule 4.7B

Name of entity

WhiteHawk Limited ABN 97 620 459 823

Quarter ended (“current quarter”)

30 September 2021

Consolidated statement of cash flows	Consolidated statement of cash flows	Current quarter	Year to date
		$US’000	(9 months)
			$US’000
1.	Cash flows from operating activities	880	1,620
1.1	Receipts from customers
1.2	Payments for
	(a) research and development	(122)	(294)
	(b) product manufacturing and operating	(426)	(1,191)
	costs
	(c) advertising and marketing	(30)	(73)
	(d) leased assets	(21)	(64)
	(e) staff costs	(311)	(869)
	(f) administration and corporate costs	(146)	(463)
1.3	Dividends received (see note 3)	-	-
1.4	Interest received	-	-
1.5	Interest and other costs of finance paid	-	-
1.6	Income taxes paid	-	-
1.7	Government grants and tax incentives	-	-
1.8	Other (provide details if material)	-	-
1.9	Net cash from / (used in) operating	(176)	(1,334)
	activities
2.	Cash flows from investing activities
2.1	Payments to acquire or for:
	(a) entities	-	-
	(b) businesses	-	-
	(c) property, plant and equipment	-	-
	(d) investments	-	-
	(e) intellectual property	-	-
	(f) other non-current assets	-	-

ASX Listing Rules Appendix 4C (17/07/20) + See chapter 19 of the ASX Listing Rules for defined terms.

Page 1

Appendix 4C Quarterly cash flow report for entities subject to Listing Rule 4.7B

Consolidated statement of cash flows	Consolidated statement of cash flows	Current quarter	Year to date
		$US’000	(9 months)
			$US’000
2.2	Proceeds from disposal of:
	(a) entities	-	-
	(b) businesses	-	-
	(c) property, plant and equipment	-	-
	(d) investments	-	-
	(e) intellectual property	-	-
	(f) other non-current assets	-	-
2.3	Cash flows from loans to other entities	61	445
2.4	Dividends received (see note 3)	-	-
2.5	Other (provide details if material)	29	466
2.6	Net cash from / (used in) investing	90	911
	activities
3.	Cash flows from financing activities
3.1	Proceeds from issues of equity securities	-	-
	(excluding convertible debt securities)
3.2	Proceeds from issue of convertible debt	-	-
	securities
3.3	Proceeds from exercise of options	-	-
3.4	Transaction costs related to issues of	-	-
	equity securities or convertible debt
	securities
3.5	Proceeds from borrowings	-	-
3.6	Repayment of borrowings	-	-
3.7	Transaction costs related to loans and	(3)	(22)
	borrowings
3.8	Dividends paid	-	-
3.9	Other (provide details if material)	-	-
3.10	Net cash from / (used in) financing	(3)	(22)
	activities
4.	Net increase / (decrease) in cash and
	cash equivalents for the period
4.1	Cash and cash equivalents at beginning of	1,988	2,368
	period
4.2	Net cash from / (used in) operating	(176)	(1,334)
	activities (item 1.9 above)
4.3	Net cash from / (used in) investing activities	90	911
	(item 2.6 above)

ASX Listing Rules Appendix 4C (17/07/20) + See chapter 19 of the ASX Listing Rules for defined terms.

Page 2

Appendix 4C Quarterly cash flow report for entities subject to Listing Rule 4.7B

	Consolidated statement of cash flows	Consolidated statement of cash flows		Current quarter		Year to date
				$US’000		(9 months)
						$US’000
	4.4	Net cash from / (used in) financing activities		(3)		(22)
		(item 3.10 above)
	4.5	Effect of movement in exchange rates on		(38)		(62)
		cash held
	4.6	Cash and cash equivalents at end of		1,861		1,861
		period
	5.	Reconciliation of cash and cash		Current quarter		Previous quarter
		equivalents		$US’000		$US’000
		at the end of the quarter (as shown in the
		consolidated statement of cash flows) to the
		related items in the accounts
	5.1	Bank balances		877		929
	5.2	Call deposits		984		1,059
	5.3	Bank overdrafts		-		-
	5.4	Other (provide details)		-		-
	5.5	Cash and cash equivalents at end of		1,861		1,988
		quarter (should equal item 4.6 above)
	6.	Payments to related parties of the entity and their				Current quarter
		associates				$US'000
	6.1	Aggregate amount of payments to related parties and their				174
		associates included in item 1
	6.2	Aggregate amount of payments to related parties and their				-
		associates included in item 2
	Note: if any amounts are shown in items 6.1 or 6.2, your quarterly		activity report must include a description of, and an
	explanation for, such payments.

ASX Listing Rules Appendix 4C (17/07/20) + See chapter 19 of the ASX Listing Rules for defined terms.

Page 3

Appendix 4C Quarterly cash flow report for entities subject to Listing Rule 4.7B

7.	Financing facilities Total facility	Amount drawn at
	Note: the term “facility’ includes all forms of financing arrangements available to the entity. Add notes as necessary for an understanding of the sources of finance available to the entity. amount at quarter end $US’000	quarter end $US’000
7.1	Loan facilities -	-
7.2	Credit standby arrangements -	-
7.3	Other (please specify) -	-
7.4	Total financing facilities -	-
7.5	Unused financing facilities available at quarter end	-
7.6	Include in the box below a description of each facility above, including the lender, interest
	rate, maturity date and whether it is secured or unsecured. If any additional financing
	facilities have been entered into or are proposed to be entered into after quarter end,
	include a note providing details of those facilities as well.
	-
8.	Estimated cash available for future operating activities	$US’000
8.1	Net cash from / (used in) operating activities (item 1.9)	(176)
8.2	Cash and cash equivalents at quarter end (item 4.6)	1,861
8.3	Unused finance facilities available at quarter end (item 7.5)	-
8.4	Total available funding (item 8.2 + item 8.3)	1,861
8.5	Estimated quarters of funding available (item 8.4 divided by item 8.1)	10.57
	Note: if the entity has reported positive net operating cash flows in item 1.9, answer item 8.5 as “N/A”. Otherwise, a
	figure for the estimated quarters of funding available must be included in item 8.5.
8.6	If item 8.5 is less than 2 quarters, please provide answers to the following questions:
	8.6.1 Does the entity expect that it will continue to have the current	level of net operating
	cash flows for the time being and, if not, why not?
	Answer: N/A
	8.6.2 Has the entity taken any steps, or does it propose to take any steps, to raise further
	cash to fund its operations and, if so, what are those steps and how likely does it
	believe that they will be successful?
	Answer: N/A
	8.6.3 Does the entity expect to be able to continue its operations and to meet its business
	objectives and, if so, on what basis?
	Answer: N/A
	Note: where item 8.5 is less than 2 quarters, all of questions 8.6.1, 8.6.2 and 8.6.3 above must be answered.

ASX Listing Rules Appendix 4C (17/07/20) + See chapter 19 of the ASX Listing Rules for defined terms.

Page 4

Appendix 4C Quarterly cash flow report for entities subject to Listing Rule 4.7B

Compliance statement

• 1 This statement has been prepared in accordance with accounting standards and policies which comply with Listing Rule 19.11A.

• 2 This statement gives a true and fair view of the matters disclosed.

28 October 2021

Date: ...................................................................................

Terry Roberts Authorised by: ...................................................................................

(Name of body or officer authorising release – see note 4)

Notes

1. This quarterly cash flow report and the accompanying activity report provide a basis for informing the market about the entity’s activities for the past quarter, how they have been financed and the effect this has had on its cash position. An entity that wishes to disclose additional information over and above the minimum required under the Listing Rules is encouraged to do so.

2. If this quarterly cash flow report has been prepared in accordance with Australian Accounting Standards, the definitions in, and provisions of, AASB 107: Statement of Cash Flows apply to this report. If this quarterly cash flow report has been prepared in accordance with other accounting standards agreed by ASX pursuant to Listing Rule 19.11A, the corresponding equivalent standard applies to this report.

3. Dividends received may be classified either as cash flows from operating activities or cash flows from investing activities, depending on the accounting policy of the entity.

4. If this report has been authorised for release to the market by your board of directors, you can insert here: “By the board”. If it has been authorised for release to the market by a committee of your board of directors, you can insert here: “By the [ name of board committee – eg Audit and Risk Committee ]”. If it has been authorised for release to the market by a disclosure committee, you can insert here: “By the Disclosure Committee”.

5. If this report has been authorised for release to the market by your board of directors and you wish to hold yourself out as complying with recommendation 4.2 of the ASX Corporate Governance Council’s Corporate Governance Principles and Recommendations , the board should have received a declaration from its CEO and CFO that, in their opinion, the financial records of the entity have been properly maintained, that this report complies with the appropriate accounting standards and gives a true and fair view of the cash flows of the entity, and that their opinion has been formed on the basis of a sound system of risk management and internal control which is operating effectively.

ASX Listing Rules Appendix 4C (17/07/20) + See chapter 19 of the ASX Listing Rules for defined terms.

Page 5