EULA - Secure and Compliant On-Ramp to Hybrid and Multi-Cloud

RiskForesight^TM End User License Agreement

www.caveonix.com

P/N 02001

This End-User License Agreement (the “Agreement”) is an agreement between you (both the individual installing the Products and any single legal entity on behalf of which such individual is acting) (hereinafter “User”) and Caveonix Inc. (hereinafter “Caveonix”).

1 DEFINITIONS:

1.1 “Products” means the object code version of the Caveonix RiskForesightTM (“RiskForesight”) software programs provided to User in association with this Agreement, together with the associated original electronic media and all accompanying manuals and other documentation, and together with all enhancements, upgrades, and extensions thereto that may be provided by Caveonix directly or indirectly to User from time to

1.2 “CaveoIQ” = Core analytics engine

1.3 “FISMA” means the Federal Information Security Management Act

1.4 “Licensed Configuration” means to the extent applicable, as indicated by the License Key, the number and type of Products, the maximum number of RiskForesight software modules (e.g., Central Collector, Remote Collector, CaveoIQ Analytics, Index Store, Message Store, Relational Store, Compliance Control, Audit module, Orchestration and Dashboards) (each “Module”) and the number of IT assets, Virtual Machines, Containers, Cloud workloads (“Workloads”) that may permissibly be managed by each Product under this Agreement, and any other hardware or software specifications, as specified in the purchase order for the Products or in requesting the License Key, and upon which the licensing fee was

1.5 “Licensed Server” means the server for a particular Product that User identified by its host ID in requesting the License

1.6 “License Key” means the code provided to User by Caveonix that enables the Products to operate on the Licensed Server(s) in the Licensed

1.7 User is a “Standard User” if User indicated in the purchase order or in requesting the License Key that User intends to use the Products on it’s own behalf, or if User obtained the products from a Managed Service Provider (MSP) such as Cloud Service Provider (CSP), Managed Security Service Provider (MSSP), Systems Integrator (SI) or a Value Added Reseller (VAR).

1.8 User is a “Managed Service Provider” if (a) User is in the regular business of providing services for a fee to entities that are not User affiliates (each a “Service Customer”); and (b) User indicated in the purchase order or in requesting the License Key that User intends to use the Products on behalf of Service

1.9 User is a “OEM Partner” if (a) User is in the regular business of providing products or Services for a fee to entities that are not User affiliates (each a “Service Customer”); and (b) the RiskForesight software is embedded in the OEM Partner’s product or

2. LICENSE AND RESTRICTIONS:

2.1 License. Subject to the terms and conditions of this Agreement, Caveonix hereby grants only to User, a non-exclusive, non-sublicensable (unless an OEM partner), non-transferable license to use the Products, subject to the restrictions specified below that are applicable to User, only in accordance with the relevant end user documentation provided by Caveonix, only on the Licensed Server, and only in the Licensed Configuration.

2.2 Standard User Restrictions. If User is a Standard User, the Products are licensed to User solely for use by User to provide policy management for it’s own operations. No Product, nor any portion thereof, may be used by or on behalf of, accessed by, re-sold to, rented to, or distributed to any other party. User may use RiskForesight to manage the number of Information Systems or Workloads the applicable Licensed Configuration permits. User may use a single copy of RiskForesight to manage no more than the number of Modules the applicable Licensed Configuration permits. User may use a single copy of RiskForesight to manage the Modules, which are licensed and controlled by User, for User’s use only.

2.3 Managed Service Provider Restrictions. If User are a Managed Service Provider, the Products are licensed to User for use by User to provide policy management for only the operations of its Service Customers. Neither Product, nor any portion thereof, except for the management of it’s Service Customers, may be used by or on behalf of, accessed by, re-sold to, and rented to or distributed to any other party. User may use RiskForesight to manage the number of Workloads the respective Licensed Configuration permits. User may use a single copy of RiskForesight, to manage no more than the respective Licensed Configuration permits and only on behalf of its Service Customer(s).

2.4 OEM Partners. Please refer to the OEM License and Distribution Agreement

2.5 General Restrictions. Except for a copy solely for back-up purposes and as required by statute, User may not copy the Products, in whole or in part. In making any such copy, User shall reproduce and include the copyright notice and any other notices that appear on each original Product copy. User acknowledges that the source code of the Products, and the underlying ideas or concepts, are valuable intellectual property of Caveonix and its licensors and User agrees not to, attempt to (or permit others to) decipher, reverse translate, decompile, disassemble or otherwise reverse engineer or attempt to reconstruct or discover any source code or underlying ideas or algorithms or file formats or programming or interoperability interfaces of the Products by any means whatsoever, except to the extent the foregoing restriction is expressly prohibited by applicable law. Notwithstanding a contractual obligation to the contrary, provided that if applicable law permits any of the foregoing activities in respect to the Products, User may only attempt any such activities after User has requested the necessary information in writing from Caveonix and Caveonix has failed to make such information available within a reasonable period of time. User will not develop methods to enable unauthorized parties to use the Products, or to develop any other product containing any of the concepts and ideas contained in the Products. User will not (and will not allow any third party to) modify Products or incorporate any portion of Products into any other software or create a derivative work of any portion of the Products. User will not (and will not allow any third party to) remove any copyright or other proprietary notices from the Products. User have no right under this license to receive, use, or examine any source code or design documentation relating to the Products.

2.6 Evaluation License. This Section 2.6 shall only apply if the License Key indicates that User is licensing the Products for an initial thirty (30) day evaluation The license is valid only for a period of thirty (30) days from the delivery of the Products and is designed to allow User (or if User is a Managed Service Provider, a number of Service Customers identical to the number of CVs User is evaluating) to evaluate the Products during such period. In the event that User wishes to enter into a longer-term license agreement with Caveonix, User may request a License Key from Caveonix which if provided to User will allow User to use the Products after such evaluation period, but only subject to all of the terms and conditions of this Agreement. In the event that User determines not to enter into a licensing transaction with Caveonix at the end of such thirty-day evaluation period, or in the event that Caveonix advises User that discussions with respect to a licensing transaction have terminated, then User’s rights under this Agreement shall terminate and User shall promptly return to Caveonix or destroy all copies of the Products, and so certify to Caveonix.

2.7 Disabled Licensed Server. The License Key User obtains from Caveonix enables the Licensed server(s) and will allow User to use the Products in the Licensed If User’s Licensed- server is disabled for any reason, Caveonix may, at its sole discretion, issue User another License Key, which will enable User to operate the Products on a substitute Licensed-server. In this event, User agrees not to use the Products on the original Licensed-server nor its License Key.

2.8 Redeployment. A Product being used to manage the maximum number of Workloads permitted to be managed under this section may be “redeployed” to manage an additional Workloads with same or a new license key.

3. MAINTENANCE AND SUPPORT:

3.1 Caveonix will provide support, maintenance, upgrades, modifications, or new releases as deemed necessary under this Agreement

4. TITLE AND INTELLECTUAL PROPERTY:

4.1 All right, title, and interest in and to the Products shall remain with Caveonix and its licensors. The Products are protected under international copyright, trademark and trade secret and patent laws. The license granted herein does not constitute a sale of the Products or any portion or copy of them.

5. TERM AND TERMINATION:

5.1 This Agreement is effective until terminated. Caveonix may terminate this Agreement at any time upon User breach of any of the provisions hereof. Upon termination of this Agreement, User agrees to cease all use of the Products and to return to Caveonix or destroy the Products and all documentation and related materials in its possession, and, if User is a Managed Service Provider, to obtain all such materials from it’s Service Customers and return them to Caveonix or destroy them, and so certify to Caveonix. Except for the license granted herein and as expressly provided herein, the terms of this Agreement shall survive termination.

6. INDEMNIFICATION

6.1 Caveonix shall have the right, but not the obligation, to defend or settle, at its option, any action at law against User arising from a claim suit, or proceeding brought against User that User’s permitted use of the Products under this Agreement infringes upon any U.S. presently existing patent or copyright of a third party (“Claim”); provided User provide Caveonix with prompt written notice of any such claim such that Caveonix is not prejudiced by any delay in such notification and provides reasonable assistance in its Caveonix has sole discretion and control over such defense and all negotiations for a settlement or compromise, unless it declines to defend or settle, in which case User are free to pursue any alternative User may have. Following notice of a Claim or if Caveonix believes such a claim is likely, Caveonix may at its sole expense and option: (i) procure for User the right to continue to use the alleged infringing Products; (ii) replace or modify the Products to make it non-infringing; or (iii) accept return of the Products and provide User with a refund of the fees paid by User for the infringing Products. Caveonix assumes no liability for any Claims or allegations of infringement based on: (i) User’s use of any Products after notice that User should cease use of the same due to a Claim; (ii) any modification of the Products by User or at User’s direction; or (iii) User’s combination of the Products with other programs, data, hardware, or other materials. THE FOREGOING STATES USER’S EXCLUSIVE REMEDY WITH RESPECT TO ANY INFRINGEMENT CLAIM AND DOES NOT COVER OPEN SOURCE SOFTWARE OR ANY EVALUATION LICENSE.

7. LIMITED WARRANTY, WARRANTY DISCLAIMERS AND LIMITATION OF LIABILITY:

7. 1 Limited Warranty. Caveonix warrants to User that the encoding of the software program on the media on which the Products are furnished will be free from defects in material workmanship, and that the Products shall substantially conform to their user manual, as it exists at the date of delivery, for a period of ninety (90) days from the date User receive the original License Key. Caveonix’s entire liability and User’s exclusive and sole remedy shall be, at Caveonix’s option, either: (i) return of the price paid to Caveonix for the Products, resulting in the termination of this Agreement, or (ii) repair or replacement of the Products or media that do not meet this limited warranty; provided, that, (i) the Product has been properly installed and used at all times in accordance with the instructions in the applicable user manuals; (b) no modification, alteration or addition has been made to the Produces by persons other than Caveonix or Caveonix’s authorized representative. EXCEPT FOR THE LIMITED WARRANTIES SET FORTH IN THIS SECTION 7.1, THE PRODUCTS AND ANY SERVICES ARE PROVIDED “AS IS” WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED, IMPLIED OR STATUTORY. CAVEONIX DOES NOT WARRANT THAT THE PRODUCTS WILL MEET USER’S REQUIREMENTS OR THAT THEIR OPERATION WILL BE UNINTERRUPTED OR ERROR FREE. CAVEONIX EXPRESSLY DISCLAIMS ANY WARRANTIES OP MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. Some jurisdictions do not allow the exclusion of implied warranties or limitations on how long an implied warranty may last, so the above limitations may not apply to User. This warranty gives User specific legal rights. User may have other rights that vary from state to state. This warranty does not apply to any evaluation licenses.

7.2 Limitation on Liability. IN NO EVENT WILL CAVEONIX OR ANY OF ITS LICENSORS BE LIABLE TO USER OR ANY THIRD PARTY FOR ANY DAMAGES ARISING OUT OF THE SUBJECT MATTER OF THIS AGREEMENT, THE PRODUCTS OR ANY SERVICES, UNDER ANY THEORY OF LIABILITY, WHETHER BASED IN CONTRACT, NEGLIGENCE, STRICT LIABILITY, PRODUCT LIABILITY OR OTHER THEORY, FOR ANY INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES, INCLUDING LOST PROFITS, LOSS OF USE, BUSINESS INTERRUPTION, OR FOR LOSS OF OR CORRUPTION OF DATA, OR FOR COST OF PROCUREMENT OF SUBSTITUTE GOODS OR TECHNOLOGY, IRRESPECTIVE OF WHETHER CAVEONIX HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES AND REGARDLESS OF WHETHER ANY REMEDY FAILS OF ITS ESSENTIAL PURPOSE.. CAVEONIX’S MAXIMUM LIABILITY FOR DAMAGES SHALL BE LIMITED TO THE LICENSE FEES RECEIVED BY CAVEONIX UNDER THIS LICENSE FOR THE PARTICULAR PRODUCTS WHICH CAUSED THE Some jurisdictions do not allow the exclusion or limitation of incidental or consequential damages, so the above limitation or exclusion may not apply to User.

7.3 THE DISCLAIMER OF REPRESENTATIONS, WARRANTIES AND CONDITIONS AND LIMITATION OF LIABILITY CONSTITUTE AN ESSENTIAL PART OF THIS AGREEMENT. USER ACKNOWLEDGES THAT BUT FOR THE DISCLAIMER OF REPRESENTATIONS, WARRANTIES AND CONDITIONS AND LIMITATION OF LIABILITY, NEITHER CAVEONIX NOR ANY OF ITS LICENSORS OR SUPPLIERS WOULD GRANT THE RIGHTS GRANTED IN THIS AGREEMENT.

8. GOVERNMENT REGULATION AND EXPORT CONTROL:

8.1 Government User agrees that the Products will not be shipped, transferred, or exported into any country or used in any manner prohibited by law.

8.2 Export. The Products are subject to export control laws. User agrees to conform to any applicable export control regulations applicable in User’s jurisdiction. User agrees that User will not ship, transfer, or export the Products into any country, or make available or use the Products in any manner, prohibited by law.

User understands and acknowledges that the U.S. Department of Commerce prohibits export or diversion of certain products and technology to certain countries. Any and all of User obligations with respect to the Products shall be subject in all respects to such United States laws and regulations as shall from time to time govern the license and delivery of technology and products abroad by persons subject to the jurisdiction of the United States, including the Export Administration Act of 1979, as amended, any successor legislation, and the Export Administration Regulations (“EAR”) issued by the Department of Commerce, International Trade Administration, and Bureau of Export Administration. User warrants that User will comply in all respects with the export and re-export restrictions applicable to the Products and will otherwise comply with the EAR or other United States laws and regulations in effect from time to time.

User warrants and agrees that User is not, and if User is a Managed Service Provider, that its Service Customers are not and will not be: (i) located in, under the control of, or a national or resident of Cuba, Iraq, Libya, North Korea, Iran, Syria, Sudan or Yugoslavia, or (ii) on the U.S Treasury Department list of Specially Designated Nationals or the U.S. Commerce Departments Table of Deny Orders.

9. GENERAL:

9.1 Miscellaneous. User may not assign its rights or obligations under this Agreement without the prior written approval of Caveonix. If any provision of this Agreement is held to be invalid or unenforceable by a court of competent jurisdiction, that provision of the Agreement will be enforced to the maximum extent permissible so as to affect the intent of the Agreement, and the remainder of the provisions of this Agreement shall remain in full force and effect. The laws of the Commonwealth of Virginia shall govern all issues arising under or relating to this Agreement, without giving effect to the conflict of laws principles thereof. Any disputes or claims arising out of or in connection with this Agreement or any breach or alleged breach hereof shall be submitted to arbitration in the Commonwealth of Virginia under the then existing rules of the American Arbitration Association. Any award rendered shall be final and conclusive upon the parties and a judgment thereon may be entered in a court of competent jurisdiction. The expenses of the arbitration shall be borne equally by the parties to the arbitration, provided that each party shall pay for and bear the cost of its own experts, evidence and attorneys’ fees. This Agreement, and the restrictions on use of the Products set forth in the purchase order, request for License Key, and License Key, which restrictions are incorporated herein by reference, set forth the entire understanding and agreement between User and Caveonix and may be amended only in writing signed by both parties. Headings under this Agreement are intended only for convenience and shall not affect the interpretation of this Agreement. No failure of either party to exercise or enforce any of its rights under this Agreement will act as a waiver of those rights.

9.2 Licenser Software. The provisions of this Agreement shall apply to all of Caveonix’s licensors and to the software licensed to Caveonix by such licensors as if they were Caveonix and the Products, respectively.

9.3 Government Restricted Rights. This provision applies to Products acquired directly or indirectly by or on behalf of any Government. The Products and any accompanying documentation are deemed to be “commercial computer software” and “commercial computer software documentation,” respectively, pursuant to DFAR Section 227.7202 and FAR Section 12.212(b), as applicable and are commercial products, licensed on the open market at market prices, and were developed entirely at private expense and without the use of any Government funds. Any use modification, reproduction, release, performance, display, or disclosure of the Products by any Government shall be governed solely by the terms of this Agreement and shall be prohibited except to the extent expressly permitted by the terms of this Agreement, and no license to the Products is granted to any government requiring different terms. User shall not use the Products to provide services to any public sector or government end user where such would affect Caveonix’s rights in the Products or require any affirmative action to be taken by Caveonix due to governmental mandates or flow down regulations.

9.4 Third Party Software. User acknowledges that the Products may include software or data which has been provided to Caveonix by third parties (“Third Party Software”), and that the licensor of any Third-Party Software embedded in or provided with the Products has a proprietary interest in such software or data. If a separate license agreement for an item of Third Party Software is delivered to User with the Products; included in the download package for the Products; or referenced in any user materials that is included in the download or distribution package for the Products, then such Third-Party Software and such separate license agreement shall govern Users use of that item or version of such Third-Party Software. User’s right to use any Third-Party Software provided with the Products shall be limited to the use necessary to operate the Products as permitted by this Agreement.

9.5 Questions? Should User have any questions concerning this Agreement contact the manufacturer at Caveonix Inc., 7777 Leesburg Pike, Suite 307S, Falls Church, VA 22043. or send e-mail to info@Caveonix.com.