CYNERGISTEK I N V E S T O R P R E S E N T A T I O N NYSE AMERICAN: - PowerPoint PPT Presentation

CYNERGISTEK I N V E S T O R P R E S E N T A T I O N NYSE AMERICAN: CTEK

SAFE HARBOR STATEMENTS This presentation contains, and our officers and representatives may from time to time make, “forward-looking statements” within the meaning of the safe harbor provisions of the U.S. Private Securities Litigation Reform Act of 1995. Forward-looking statements can be identified by words such as: “anticipate,” “intend,” “plan,” “goal,” “seek,” “believe,” “project,” “estimate,” “expect,” “strategy,” “future,” “likely,” “may,” “should,” “will” and similar references to future periods. Examples of forward-looking statements include, among others, statements we make (herein or otherwise) regarding the size of the potential market for our services; the number of potential customers/clients for our services; plans and strategies of CynergisTek and its subsidiaries for future growth and performance; market acceptance of our business model; our ability to integrate acquisitions and merged companies; and timelines relating to growth, milestones, and strategic focus. Forward-looking statements are neither historical facts nor assurances of future performance. Instead, they are based only on management’s current beliefs, expectations and assumptions regarding the future of our business, future plans and strategies, projections, anticipated events and trends, the economy and other future conditions. Because forward-looking statements relate to the future, they are subject to inherent uncertainties, risks and changes in circumstances that are difficult to predict and many of which are outside of our control. Our actual results and financial condition may differ materially from those indicated in the forward-looking statements. Therefore, you should not rely on any of these forward-looking statements. Important factors that could cause our actual results and financial condition to differ materially from those indicated in the forward- looking statements include, among others, the risk factors discussed throughout Part II, Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations, and in Part I, Item 1A. Risk Factors of our Annual Report on Form 10-K for the year ended December 31, 2019; and throughout Part I, Item 2. Management’s Discussion and Analysis of Financial Condition and Results of Operations of our Quarterly Reports on Form 10-Q for the quarters ending March, June and September 31. Any forward-looking statement made by us in this presentation is based only on information currently available to us and speaks only as of the date on which it is made. We expressly disclaim any obligation to publicly update any forward-looking statement, whether written or oral, that may be made from time to time, whether as a result of new information, future developments, or otherwise. 2

CYNERGISTEK AT A GLANCE CynergisTek is the premier provider of cybersecurity managed services and security & compliance consulting to healthcare and other regulated industries What makes us unique? Cont’d YoY Growth in § Unrivaled industry expertise in healthcare, covering 1,000+ healthcare Est. Founded in 2004 Managed Service Rev. provider locations and business associates, and partnered with 2 of the 10 largest health systems in the US; a top medical device manufacturer; and 4 Electronic Health Records Companies $ 115 Employees $21.4M 2019A Revenue § Revenue is packaged as a recurring managed service with significant upsell opportunity for re-occurring consulting and professional services § Trusted advisor enabling clients to protect and support patient safety and care operations ~44% ~56% § Leadership team with experience across the security and healthcare industry Revenue driven by re-occurring Revenue driven by recurring Managed $ including former auditors, Healthcare CIO’s and leaders at Symantec, Cylance Consulting Segment, and Professional Services segment in 2019E and IBM Security Services 24% 85%+ Of managed service clients have 2 or 2019 Managed Service Renewal Rate more managed services Industry Accolades: Top Performing Services KLAS KLAS KLAS 330 Customers Nationwide 1k+ Healthcare Locations Cybersecurity HIT Advisory Tech Services 2018 2018 2018 145 50%+ Managed Service Clients Of clients using 2 or more service offerings 3

HEALTHCARE CYBERSECURITY IS A LARGE AND GROWING MARKET OPPORTUNITY Immature Cybersecurity Increasing Skill and Increasing Volume and Exponential Risk Adoption in Healthcare Resource Gap Cost of Attacks Top 10 1 in 8 Most likely industry Americans have had their medical to be attacked records exposed in data breaches 118% 65% 59% Increase in Ransomware attacks Costlier data breaches than any Of attacks in Healthcare come from during the first quarter of 2019 other industry the inside 32M $4B $14.4B $6.5M or $429/record Average cost of Healthcare data Healthcare Records Breached in Estimated Healthcare Data Breach Anticipated Healthcare breach First Half of 2019 Cost in 2019 Cybersecurity Market by 2024 4

WHAT SETS CYNERGISTEK APART? CynergisTek brings expertise that is both Cybersecurity & Compliance specific to healthcare & other regulated industries Unique Combination of Cybersecurity, Privacy, and Compliance knowledge with Healthcare and Regulated industry experience Teams led by nationally Proven client growth recognized experts in their strategy through trusted field advisor relationships Codified best practices and deep Potential to leverage reservoir of experience drives engagement insights to be efficiencies of engagements positioned for future opportunities 5

SOLUTIONS OVERVIEW COMPLETE SERVICE OFFERING Managed Services Risk Assessments Vendor Security Services Management Patient Privacy Medical Device Security Managed Services, Monitoring Service Management 56% Professional and Consulting, 44% Professional & Consulting Services Incident Response Red/Purple Ransomware Security Control EPCS Services Readiness Exercise Teaming Assessment Validation GDPR/Data Cloud Security Privacy IT Audit Services Endpoint Security 20+ Others Assessment Compliance 6

MANAGED SERVICES SNAPSHOT Compliance Assist Partner Program Patient Privacy Monitoring Medical Device Security Annual Assessments Experienced professionals review documents, Medical Device Security Technical Assessment § Annual Review to identify security gaps through processes, and procedures impacting research, § Comprehensive inventory of networked devices several assessments & analyses and identify possible gaps against HIPAA and associated vulnerabilities Internal and External Assessment requirements Medical Device Security Assessment § External: Quarterly § Annual review to identify security gaps § Evaluation of security controls & an identification § Internal: Bi-Annually through several assessments & analyses of gaps or vulnerabilities § Regularly review user activity within Medical Device Security Management Strategy designated ePHI applications § Strategy articulating different risk categories and remediation roadmap Vendor Security Management Managed Security Services* Evaluate and monitor vendors on a regular and Complete security monitoring solution and ongoing basis strategic security partnership § Comprehensive assessments § Cloud, Endpoint, SaaS, and Network § Status Updates on vendor participation and § 24x7 detection and response with trained escalation of issues cyber experts § Quarterly Program Report covering high-level § Assessment and remediation support of the vendor program, including recommendations *Currently serviced via referral 7