Case 1:23-cv-00758-JLH-SRF Document 165-1 Filed 10/09/24 Page 1 of 166 PageID #:
`4063
`
`EXHIBIT 1
`
`

`

`Case 1:23-cv-00758-JLH-SRF Document 165-1 Filed 10/09/24 Page 2 of 166 PageID #:
`4064
`
`McKenna, Krissy (BN)
`Lacey, Catherine; Davis, Blake (Bay Area); Lonergan, Lucas (Bay Area); Banks, Ryan (OC); Prasad, Praatika; WSGR - Orca Wiz; Cottrell@RLF.com; Farnan@RLF.com; haynes@rlf.com
`#C-M ORCA SECURITY - WIZ - LW TEAM; RSmith@morrisnichols.com; JBlumenfeld@MNAT.com
`RE: Orca v. Wiz | Priority ESI Requests
`Thursday, July 18, 2024 9:42:01 PM
`
`From:
`To:
`Cc:
`Subject:
`Date:
`
`Caty,
`
`Below are the updated hit counts for Wiz’s revised AI term, bringing Wiz’s total count to 180,886 documents, about 30,000 less than Orca’s total count. As agreed during our meet and confer on July 17, Orca
`understands both parties will now move forward with production for all terms, excluding Orca’s cloud native term. Kindly let us know if Wiz will reconsider its position on that term, which is returning a
`reasonable number of hits, and which is plainly targeting information relevant to at least Orca’s damages claims. Otherwise, we will plan to circulate a motion for teleconference addressing that term to be
`filed with the Court tomorrow, consistent with the parties’ ESI Agreement.
`
`Avi Shua
`
`Term #
`
`1
`
`Arie Teter
`
`Term #
`
`1
`
`Yoav Alon
`
`Term #
`
`1
`
`Meghan Marks
`
`Term #
`
`1
`
`Search Term
`
`Total Hit Count
`
`Total Hits Including
`Family
`
`Unique Hits
`
`("artificial intelligence" OR ai OR "large language model" OR llm OR *gpt* OR
`openai OR "open ai" OR "amazon bedrock" OR "AWS bedrock" OR "google
`vertex" OR "google cloud vertex" OR sagemaker OR pytorch OR tensorflow
`OR "hugging face”) AND (cloud OR environment* OR estate* OR platform*
`OR *spm* OR ((security OR posture) w/3 management) OR orca OR vm* OR
`(virtual w/3 machine*) OR workload* OR asset* OR scan*)
`
`10,761
`
`13,526
`
`7,834
`
`Search Term
`
`Hit Count
`
`Total Hits Including
`Family
`
`Unique Hits
`
`("artificial intelligence" OR ai OR "large language model" OR llm OR *gpt*
`OR openai OR "open ai" OR "amazon bedrock" OR "AWS bedrock" OR
`"google vertex" OR "google cloud vertex" OR sagemaker OR pytorch OR
`tensorflow OR "hugging face”) AND (cloud OR environment* OR estate*
`OR platform* OR *spm* OR ((security OR posture) w/3 management) OR
`orca OR vm* OR (virtual w/3 machine*) OR workload* OR asset* OR
`scan*)
`
`8,657
`
`9,296
`
`6,520
`
`Search Term
`
`Hit Count
`
`Total Hits Including
`Family
`
`Unique Hits
`
`("artificial intelligence" OR ai OR "large language model" OR llm OR
`*gpt* OR openai OR "open ai" OR "amazon bedrock" OR "AWS bedrock"
`OR "google vertex" OR "google cloud vertex" OR sagemaker OR pytorch
`OR tensorflow OR "hugging face”) AND (cloud OR environment* OR
`estate* OR platform* OR *spm* OR ((security OR posture) w/3
`management) OR orca OR vm* OR (virtual w/3 machine*) OR workload*
`OR asset* OR scan*)
`
`7,695
`
`9,355
`
`5,200
`
`Search Term
`
`Hit Count
`
`Total Hits Including
`Family
`
`Unique Hits
`
`("artificial intelligence" OR ai OR "large language model" OR llm OR
`*gpt* OR openai OR "open ai" OR "amazon bedrock" OR "AWS bedrock"
`OR "google vertex" OR "google cloud vertex" OR sagemaker OR pytorch
`OR tensorflow OR "hugging face”) AND (cloud OR environment* OR
`estate* OR platform* OR *spm* OR ((security OR posture) w/3
`management) OR orca OR vm* OR (virtual w/3 machine*) OR workload*
`OR asset* OR scan*)
`
`11,769
`
`13,466
`
`9,162
`
`Total Hits Deduped Across All Custodians:
`
`Search Term
`(access* OR reach* OR attack*) AND (path* OR
`chain* OR vector* OR graph*)
`"artificial intelligence" OR (ai w/5 (secur* OR
`*spm* OR quer* OR search*)) OR "large
`language model" OR llm OR *gpt* OR openai
`OR "open ai" OR "amazon bedrock" OR "AWS
`bedrock" OR "google vertex" OR "google cloud
`vertex" OR sagemaker OR pytorch OR
`tensorflow OR "hugging face"
`(risk* OR vulnerabil* OR threat*) w/20 (sever*
`OR scor* OR priorit* OR match*)
`((agent* OR side) w/5 scan*) OR sidescan*
`(snapshot* OR (snap w/3 shot*) OR (imag* w/5
`(VM* OR machine*))) w/20 (scan* OR analy*
`OR visual* OR vulnerab* OR detect* OR priorit*
`OR *remediat* OR mitigat* OR pars* OR
`sensitiv* OR risk* OR *threat* OR config* OR
`encrypt* OR locat*)
`("beyond network*" OR wiz) AND (beat* OR
`win* OR compet* OR rac* OR playbook* OR
`kill* OR succe*)
`("check point" OR checkpoint) AND (risk* OR
`vulnerabil* OR threat* OR secur*)
`("beyond network*" OR wiz) AND (patent* OR
`ip OR "intellectual property" OR invention* OR
`innovat* OR new)
`autoremediation OR automitigation OR ((auto*
`OR self OR event-driven) w/5 (remediat* OR
`mitigate*))
`
`Total Documents Hit
`By Term
`
`Total Documents Hit by Term
`Including Families
`
`Slack Documents
`
`Email Documents
`
`Email Documents
`Including Families
`
`46,543
`
`94,714
`
`8,068
`
`38,475
`
`86,485
`
`35,773
`
`24,152
`14,352
`
`11,024
`
`7,037
`
`6,547
`
`5,947
`
`5,601
`
`42,318
`
`34,548
`24,434
`
`31,551
`
`8,423
`
`24,450
`
`7,249
`
`6,500
`
`2,526
`
`2,891
`1,762
`
`2,283
`
`2,984
`
`577
`
`1,708
`
`992
`
`33,247
`
`21,261
`12,590
`
`8,741
`
`4,053
`
`5,970
`
`4,239
`
`4,609
`
`39,766
`
`31,515
`22,585
`
`29,159
`
`5,146
`
`23,859
`
`5,388
`
`5,400
`
`1
`
`

`

`Case 1:23-cv-00758-JLH-SRF Document 165-1 Filed 10/09/24 Page 3 of 166 PageID #:
`4065
`
`(microsoft w/5 "cloud security") OR (microsoft
`AND (yinon OR costica OR assaf OR rappaport
`OR roy OR reznik OR ami OR luttwak))
`("beyond network*" OR wiz) AND (risk* OR
`vulnerabil* OR threat*)
`("check point" OR checkpoint) AND (risk* OR
`vulnerabil* OR threat*)
`
`2,250
`
`1,737
`
`663
`
`18,823
`
`2,120
`
`1,180
`
`999
`
`847
`
`73
`
`1,251
`
`890
`
`590
`
`1,277
`
`1,114
`
`1,099
`
`Total Documents De-duped Across All Terms and All Custodians
`Total Documents Including
`Email Families
`180,886
`
`Total Documents
`
`124,739
`
`Best,
`Krissy
`
`From: Lacey, Catherine <clacey@wsgr.com>
`Sent: Wednesday, July 17, 2024 11:06 PM
`To: McKenna, Krissy (BN) <Krissy.McKenna@lw.com>; Davis, Blake (Bay Area) <Blake.Davis@lw.com>; Lonergan, Lucas (Bay Area) <Lucas.Lonergan@lw.com>; Banks, Ryan (OC) <Ryan.Banks@lw.com>; Prasad,
`Praatika <pprasad@wsgr.com>; WSGR - Orca Wiz <WSGR-Orca-Wiz@wsgr.com>; Cottrell@RLF.com; Farnan@RLF.com; haynes@rlf.com
`Cc: #C-M ORCA SECURITY - WIZ - LW TEAM <orcasecuritywiz.lwteam@lw.com>; RSmith@morrisnichols.com; JBlumenfeld@MNAT.com
`Subject: RE: Orca v. Wiz | Priority ESI Requests
`
`Krissy,
`
`Please run the following revised version of Wiz’s “ai” term:
`
`("artificial intelligence" OR (ai /5 (secur* OR *spm* OR quer* or search*)) OR "large language model"
`OR llm OR *gpt* OR openai OR "open ai" OR "amazon bedrock" OR "AWS bedrock" OR "google vertex"
`OR "google cloud vertex" OR sagemaker OR pytorch OR tensorflow OR "hugging face”) AND (cloud OR
`environment* or estate* OR platform* OR *spm* OR ((security OR posture) /3 management) OR orca
`OR vm* OR (virtual w/3 machine*) OR workload* OR asset* OR scan* OR pii OR estate OR bom* OR
`(bill /3 material*) OR inventor* OR quer* OR search* OR question* OR ask* OR discover*)
`
`With respect to the following edit to Orca’s term proposed on the call today, in the interest of compromise, we can agree to move forward with this term.
`
`(threatoptix OR jacques OR nicole OR sentinel* OR dominique OR walterspiel OR sentinel* OR equifax)
`AND (orca OR RFI OR learn OR "set up" OR acqui* OR purchas* OR offer OR steal OR take* OR know*
`OR customer*)
`
`With respect to the following term, Wiz maintains its objections, as the revisions Orca has made do not address them.
`(((cloud w/5 (native OR security)) OR platform) w/15 (invest* OR profit* OR fund* OR venture OR
`market* OR demand OR compet* OR financ* OR revenue* OR sale* OR purchase* OR acqui* OR
`merg* OR cost* OR startup OR project* OR forecast* OR seed OR "series a" OR "series b" OR margin*
`OR milestone* OR price* OR pricing OR calculat* OR discount*))
`
`In addition, as discussed on the call, Wiz reserves the right to object to the overall burden of Orca’s requests in connection with future requests.
`
`Regards,
`Caty
`
`From: Krissy.McKenna@lw.com <Krissy.McKenna@lw.com>
`Sent: Wednesday, July 17, 2024 12:28 PM
`To: Lacey, Catherine <clacey@wsgr.com>; Blake.Davis@lw.com; Lucas.Lonergan@lw.com; Ryan.Banks@lw.com; Prasad, Praatika <pprasad@wsgr.com>; WSGR - Orca Wiz <WSGR-Orca-Wiz@wsgr.com>;
`Cottrell@RLF.com; Farnan@RLF.com; haynes@rlf.com
`Cc: orcasecuritywiz.lwteam@lw.com; RSmith@morrisnichols.com; JBlumenfeld@MNAT.com
`Subject: RE: Orca v. Wiz | Priority ESI Requests
`
`EXT - krissy.mckenna@lw.com
`
`Thanks, Caty. We just received the slack/email breakdown for Wiz’s terms, incorporated in the chart below. We will look out for Wiz’s confirmation tonight on further narrowing Wiz’s terms and your position
`on the ThreatOptix and cloud w/5 native terms.
`
`Total Hits Deduped Across All Custodians:
`
`Term #
`
`1
`
`2a
`
`Search Term
`(snapshot* OR (snap w/3 shot*) OR (imag* w/5 (VM* OR
`machine*))) w/20 (scan* OR analy* OR visual* OR vulnerab* OR
`detect* OR priorit* OR *remediat* OR mitigat* OR pars* OR
`sensitiv* OR risk* OR *threat* OR config* OR encrypt* OR locat*)
`("artificial intelligence" OR ai OR "large language model" OR llm
`OR *gpt* OR openai OR "open ai" OR "amazon bedrock" OR "AWS
`bedrock" OR "google vertex" OR "google cloud vertex" OR
`sagemaker OR pytorch OR tensorflow OR "hugging face”) AND
`(cloud OR environment* OR estate* OR platform* OR *spm* OR
`((security OR posture) w/3 management) OR orca OR vm* OR
`(virtual w/3 machine*) OR workload* OR asset* OR scan*)
`("artificial intelligence" OR ai OR "large language model" OR llm
`OR *gpt* OR openai OR "open ai" OR "amazon bedrock" OR "AWS
`bedrock" OR "google vertex" OR "google cloud vertex" OR
`
`Total Documents
`Hit By Term
`
`Total Documents
`Hit By Term
`Including Families Slack Documents Email Documents
`
`Email Documents
`Including Families
`
`11,024
`
`31,551
`
`2,283
`
`8,741
`
`29,159
`
`62,347
`
`99,481
`
`4,566
`
`57,781
`
`94,887
`
`26,656
`
`59,808
`
`2,445
`
`24,211
`
`57,336
`
`2
`
`

`

`Case 1:23-cv-00758-JLH-SRF Document 165-1 Filed 10/09/24 Page 4 of 166 PageID #:
`4066
`
`sagemaker OR pytorch OR tensorflow OR "hugging face”) AND (pii
`OR estate OR bom* OR (bill w/3 material*) OR inventor* OR
`quer* OR search* OR question* OR ask* OR discover*)
`(risk* OR vulnerabil* OR threat*) w/20 (sever* OR scor* OR
`priorit* OR match*)
`(access* OR reach* OR attack*) AND (path* OR chain* OR vector*
`OR graph*)
`("beyond network*" OR wiz) AND (beat* OR win* OR compet* OR
`rac* OR playbook* OR kill* OR succe*)
`
`2b
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`24,152
`
`46,543
`
`7,037
`
`14,352
`
`5,947
`
`2,250
`
`5,601
`
`1,737
`
`34,548
`
`94,714
`
`8,423
`
`24,434
`
`7,249
`
`18,823
`
`6,500
`
`2,120
`
`24,450
`
`2,891
`
`8,068
`
`2,984
`
`1,762
`
`1,708
`
`1,251
`
`992
`
`847
`
`577
`
`21,261
`
`38,475
`
`4,053
`
`12,590
`
`4,239
`
`999
`
`4,609
`
`890
`
`5,970
`
`31,515
`
`86,485
`
`5,146
`
`22,585
`
`5,388
`
`17,546
`
`5,400
`
`1,114
`
`23,859
`
`((agent* OR side) w/5 scan*) OR sidescan*
`("beyond network*" OR wiz) AND (patent* OR ip OR "intellectual
`property" OR invention* OR innovat* OR new)
`(microsoft w/5 "cloud security") OR (microsoft AND (yinon OR
`costica OR assaf OR rappaport OR roy OR reznik OR ami OR
`luttwak))
`autoremediation OR automitigation OR ((auto* OR self OR event-
`driven) w/5 (remediat* OR mitigate*))
`("beyond network*" OR wiz) AND (risk* OR vulnerabil* OR
`threat*)
`("check point" OR checkpoint) AND (risk* OR vulnerabil* OR
`threat* OR secur*)
`("check point" OR checkpoint) AND (risk* OR vulnerabil* OR
`threat*)
`
`11
`
`12
`
`Best,
`Krissy
`
`6,547
`
`663
`
`1,180
`
`73
`
`590
`
`1,099
`
`From: Lacey, Catherine <clacey@wsgr.com>
`Sent: Wednesday, July 17, 2024 3:01 PM
`To: McKenna, Krissy (BN) <Krissy.McKenna@lw.com>; Davis, Blake (Bay Area) <Blake.Davis@lw.com>; Lonergan, Lucas (Bay Area) <Lucas.Lonergan@lw.com>; Banks, Ryan (OC) <Ryan.Banks@lw.com>; Prasad,
`Praatika <pprasad@wsgr.com>; WSGR - Orca Wiz <WSGR-Orca-Wiz@wsgr.com>; Cottrell@RLF.com; Farnan@RLF.com; haynes@rlf.com
`Cc: #C-M ORCA SECURITY - WIZ - LW TEAM <orcasecuritywiz.lwteam@lw.com>; RSmith@morrisnichols.com; JBlumenfeld@MNAT.com
`Subject: RE: Orca v. Wiz | Priority ESI Requests
`
`Krissy,
`
`The updated hit count deduped across custodians and terms for O365 is 110,171.
`
`Thanks,
`Caty
`
`From: Lacey, Catherine <clacey@wsgr.com>
`Sent: Wednesday, July 17, 2024 11:52 AM
`To: Krissy.McKenna@lw.com; Blake.Davis@lw.com; Lucas.Lonergan@lw.com; Ryan.Banks@lw.com; Prasad, Praatika <pprasad@wsgr.com>; WSGR - Orca Wiz <WSGR-Orca-Wiz@wsgr.com>;
`Cottrell@RLF.com; Farnan@RLF.com; haynes@rlf.com
`Cc: orcasecuritywiz.lwteam@lw.com; RSmith@morrisnichols.com; JBlumenfeld@MNAT.com
`Subject: RE: Orca v. Wiz | Priority ESI Requests
`
`Krissy,
`
`With the latest revisions to Orca’s terms, the Slack total hit count across custodians and terms is 38,568 documents (without families), and the O365 total hit count across custodians and terms should be
`<120,000 documents with families. We will provide a more exact number for O365 asap. There was an error in the way the terms were run for O365 that the vendor is attempting to address. The hit counts
`per-custodian are also below, but some of the totals are also impacted by the error:
`
`Ami Luttwak
`
`Clause
`orca* AND (avi OR shua OR gil OR geron OR roadmap OR
`battlecard OR playbook OR copy* OR copie* OR compet* OR
`confid* OR customer OR deal OR platform OR functional* OR
`feature OR vulnerabil* OR secret OR scan* OR VM OR takeout
`OR NDA OR portal OR access* OR MRI OR login OR
`((implement* OR add* OR take OR use* OR pull*) w/5
`(feature* OR tech* OR same OR similar OR solution OR
`method OR strategy OR approach OR stack)) OR problem* OR
`(better w/3 than) OR microsoft OR invent* OR patent* OR
`publication* OR application* OR provisional* OR "intellectual
`property" OR "IP")
`"11,663,031" OR "11663031" OR "11,663,032" OR "11663032"
`OR "11,693,685" OR "11693685" OR "11,726,809" OR
`"11726809" OR "11,740,926" OR "11740926" OR "11,775,326"
`OR "11775326" OR "11,431,735" OR "11431735" OR ((*031
`OR *032 OR *685 OR *809 OR *926 OR *326 OR *019 OR
`*287 OR *220 OR *313 OR *080 OR *527 OR *364 OR *150
`OR *861 OR *201 OR *220 OR *181 OR *718 OR *735 OR
`*678 OR *967 OR *692 OR *556 OR *231 OR *976 OR *998
`OR *798 OR *270 OR *345 OR *488 OR *750) w/10 (patent
`OR orca OR avi OR shua)) OR "11,772,554" OR "11772554" OR
`"11,929,896" OR "11929896" OR "11,936,693" OR "11936693"
`OR "12,001,549" OR "12001549" OR "12,003,529" OR
`"12003529" OR ((*554 OR *442 OR *082 OR *896 OR *190 OR
`*693 OR *845 OR *499 OR *549 OR *794 OR *529 OR *659)
`w/10 (patent OR orca OR avi OR shua))
`sidescan* OR (side* w/5 scan) OR MRI OR (control w/3 plane)
`OR (data w/3 plane) OR out*of*band
`((priorit* OR detect* OR *remediat* OR mitigat* OR analy*
`OR pars*) w/10 (threat* OR vulnerabil* OR secret* OR
`sensitive OR inactive)) AND (snapshot OR disk)
`(M&B OR "ip analysts" OR michael OR mike OR ben-shimon OR
`
`O365 DeDuped
`Docs
`
`O365 DeDuped
`Docs w/Family
`
`O365 Unique
`DeDuped Docs
`
`O365 Unique
`DeDuped
`Families
`
`Slack DeDuped
`Docs
`
`Slack DeDuped
`Docs w/Family
`
`Slack Unique
`DeDuped Docs
`
`1,089
`
`1,478
`
`685
`
`771
`
`2,759
`
`16,085
`
`N/A
`
`823
`
`3,405
`
`508
`
`755
`
`130
`
`451
`
`N/A
`
`1,258
`
`2,258
`
`6,113
`
`10,516
`
`917
`
`1,109
`
`2,441
`
`2,262
`
`1,996
`
`2,616
`
`54,549
`
`61,842
`
`1,415
`
`1,229
`
`3
`
`

`

`Case 1:23-cv-00758-JLH-SRF Document 165-1 Filed 10/09/24 Page 5 of 166 PageID #:
`4067
`
`prosecut* OR "mb-ip.com") AND (orca OR avi OR shua OR
`((copy* OR copie* OR implement* OR add* OR take OR use*
`OR pull*) w/10 (feature* OR tech* OR same OR similar OR
`solution OR method OR strategy OR approach OR problem*))
`OR (better w/3 than) OR NDA OR conflict OR sidescan* OR
`(side w/5 scan*) OR snapshot)
`
`(((cloud w/5 (native OR security)) OR platform) w/15 (invest*
`OR profit* OR fund* OR venture OR market* OR demand OR
`compet* OR financ* OR revenue* OR sale* OR purchase* OR
`acqui* OR merg* OR cost* OR startup OR project* OR
`forecast* OR seed OR "series a" OR "series b" OR margin* OR
`milestone* OR price* OR pricing OR calculat* OR discount*))
`
`((attack w/5 path) OR "security dashboard" OR (cdr OR "cloud
`detection and response")) AND ((posture w/2 management)
`OR "Shift-Left" OR (shift w/3 left) OR (data w/3 model) OR
`((securit* OR path OR apply*) w/6 policy))
`("artificial intelligence" OR "AI-SPM" OR "security posture
`Management") OR ("LLM" OR LLM* OR "large language
`model" OR "large language models") OR (natural w/3
`language) OR "BOM" OR (machine w/4 learn*) OR ((AI OR
`"artificial intelligence" OR LLM OR LLM* OR "large language
`models") w/5 (risk* OR database* OR model OR use OR
`detect))
`TOTAL
`
`Assaf Rappaport
`
`5,099
`
`11,236
`
`3,773
`
`4,838
`
`4,052
`
`48,212
`
`2,941
`
`6,213
`
`11,419
`
`4,474
`
`5,466
`
`6,565
`
`83,912
`
`5,286
`
`306
`
`1,042
`
`38
`
`70
`
`605
`
`15,941
`
`116
`
`3,858
`
`6,231
`
`2,090
`
`2,331
`
`6,206
`
`69,432
`
`4,495
`
`16,818
`
`31,144
`
`13,594
`
`18,934
`
`20,579
`
`118,982
`
`N/A
`
`O365 DeDuped
`Docs
`
`O365 DeDuped
`Docs w/Family
`
`O365 Unique
`DeDuped Docs
`
`O365 Unique
`DeDuped
`Families
`
`Slack DeDuped
`Docs
`
`Slack DeDuped
`Docs w/Family
`
`Slack Unique
`DeDuped Docs
`
`3,260
`
`4,212
`
`2,296
`
`2,512
`
`1,039
`
`2,290
`
`N/A
`
`25
`
`92
`
`N/A
`
`Clause
`orca* AND (avi OR shua OR gil OR geron OR roadmap OR
`battlecard OR playbook OR copy* OR copie* OR compet* OR
`confid* OR customer OR deal OR platform OR functional* OR
`feature OR vulnerabil* OR secret OR scan* OR VM OR takeout
`OR NDA OR portal OR access* OR MRI OR login OR
`((implement* OR add* OR take OR use* OR pull*) w/5
`(feature* OR tech* OR same OR similar OR solution OR
`method OR strategy OR approach OR stack)) OR problem* OR
`(better w/3 than) OR microsoft OR invent* OR patent* OR
`publication* OR application* OR provisional* OR "intellectual
`property" OR "IP")
`"11,663,031" OR "11663031" OR "11,663,032" OR "11663032"
`OR "11,693,685" OR "11693685" OR "11,726,809" OR
`"11726809" OR "11,740,926" OR "11740926" OR "11,775,326"
`OR "11775326" OR "11,431,735" OR "11431735" OR ((*031
`OR *032 OR *685 OR *809 OR *926 OR *326 OR *019 OR
`*287 OR *220 OR *313 OR *080 OR *527 OR *364 OR *150
`OR *861 OR *201 OR *220 OR *181 OR *718 OR *735 OR
`*678 OR *967 OR *692 OR *556 OR *231 OR *976 OR *998
`OR *798 OR *270 OR *345 OR *488 OR *750) w/10 (patent
`OR orca OR avi OR shua)) OR "11,772,554" OR "11772554" OR
`"11,929,896" OR "11929896" OR "11,936,693" OR "11936693"
`OR "12,001,549" OR "12001549" OR "12,003,529" OR
`"12003529" OR ((*554 OR *442 OR *082 OR *896 OR *190 OR
`*693 OR *845 OR *499 OR *549 OR *794 OR *529 OR *659)
`w/10 (patent OR orca OR avi OR shua))
`sidescan* OR (side* w/5 scan) OR MRI OR (control w/3 plane)
`OR (data w/3 plane) OR out*of*band
`((priorit* OR detect* OR *remediat* OR mitigat* OR analy*
`OR pars*) w/10 (threat* OR vulnerabil* OR secret* OR
`sensitive OR inactive)) AND (snapshot OR disk)
`(M&B OR "ip analysts" OR michael OR mike OR ben-shimon OR
`prosecut* OR "mb-ip.com") AND (orca OR avi OR shua OR
`((copy* OR copie* OR implement* OR add* OR take OR use*
`OR pull*) w/10 (feature* OR tech* OR same OR similar OR
`solution OR method OR strategy OR approach OR problem*))
`OR (better w/3 than) OR NDA OR conflict OR sidescan* OR
`(side w/5 scan*) OR snapshot)
`
`(((cloud w/5 (native OR security)) OR platform) w/15 (invest*
`OR profit* OR fund* OR venture OR market* OR demand OR
`compet* OR financ* OR revenue* OR sale* OR purchase* OR
`acqui* OR merg* OR cost* OR startup OR project* OR
`forecast* OR seed OR "series a" OR "series b" OR margin* OR
`milestone* OR price* OR pricing OR calculat* OR discount*))
`
`(threatoptix OR jacques OR nicole OR sentinel* OR dominique
`OR walterspiel OR sentinel* OR equifax) AND (orca OR RFI OR
`learn OR "set up" OR acqui* OR purchas* OR offer OR steal OR
`take* OR know* OR customer*)
`
`Raaz Herzberg
`
`Clause
`orca* AND (avi OR shua OR gil OR geron OR roadmap OR
`battlecard OR playbook OR copy* OR copie* OR compet* OR
`confid* OR customer OR deal OR platform OR functional* OR
`feature OR vulnerabil* OR secret OR scan* OR VM OR takeout
`OR NDA OR portal OR access* OR MRI OR login OR
`((implement* OR add* OR take OR use* OR pull*) w/5
`(feature* OR tech* OR same OR similar OR solution OR
`method OR strategy OR approach OR stack)) OR problem* OR
`
`93
`
`425
`
`13
`
`18
`
`249
`
`472
`
`611
`
`1,586
`
`103
`
`240
`
`154
`
`424
`
`135
`
`122
`
`402
`
`374
`
`62
`
`65
`
`3,345
`
`5,440
`
`2,291
`
`3,203
`
`430
`
`1,405
`
`223
`
`8,565
`
`12,152
`
`7,479
`
`9,387
`
`1,108
`
`2,981
`
`825
`
`4,381
`
`5,929
`
`1,220
`
`3,773
`
`754
`
`O365 DeDuped
`Docs
`
`O365 DeDuped
`Docs w/Family
`
`O365 Unique
`DeDuped Docs
`
`O365 Unique
`DeDuped
`Families
`
`Slack DeDuped
`Docs
`
`Slack DeDuped
`Docs w/Family
`
`Slack Unique
`DeDuped Docs
`
`3,216
`
`4,025
`
`2,403
`
`2,506
`
`4,361
`
`12,677
`
`N/A
`
`4
`
`

`

`Case 1:23-cv-00758-JLH-SRF Document 165-1 Filed 10/09/24 Page 6 of 166 PageID #:
`4068
`
`(better w/3 than) OR microsoft OR invent* OR patent* OR
`publication* OR application* OR provisional* OR "intellectual
`property" OR "IP")
`"11,663,031" OR "11663031" OR "11,663,032" OR "11663032"
`OR "11,693,685" OR "11693685" OR "11,726,809" OR
`"11726809" OR "11,740,926" OR "11740926" OR "11,775,326"
`OR "11775326" OR "11,431,735" OR "11431735" OR ((*031
`OR *032 OR *685 OR *809 OR *926 OR *326 OR *019 OR
`*287 OR *220 OR *313 OR *080 OR *527 OR *364 OR *150
`OR *861 OR *201 OR *220 OR *181 OR *718 OR *735 OR
`*678 OR *967 OR *692 OR *556 OR *231 OR *976 OR *998
`OR *798 OR *270 OR *345 OR *488 OR *750) w/10 (patent
`OR orca OR avi OR shua)) OR "11,772,554" OR "11772554" OR
`"11,929,896" OR "11929896" OR "11,936,693" OR "11936693"
`OR "12,001,549" OR "12001549" OR "12,003,529" OR
`"12003529" OR ((*554 OR *442 OR *082 OR *896 OR *190 OR
`*693 OR *845 OR *499 OR *549 OR *794 OR *529 OR *659)
`w/10 (patent OR orca OR avi OR shua))
`sidescan* OR (side* w/5 scan) OR MRI OR (control w/3 plane)
`OR (data w/3 plane) OR out*of*band
`((priorit* OR detect* OR *remediat* OR mitigat* OR analy*
`OR pars*) w/10 (threat* OR vulnerabil* OR secret* OR
`sensitive OR inactive)) AND (snapshot OR disk)
`
`(((cloud w/5 (native OR security)) OR platform) w/15 (invest*
`OR profit* OR fund* OR venture OR market* OR demand OR
`compet* OR financ* OR revenue* OR sale* OR purchase* OR
`acqui* OR merg* OR cost* OR startup OR project* OR
`forecast* OR seed OR "series a" OR "series b" OR margin* OR
`milestone* OR price* OR pricing OR calculat* OR discount*))
`
`roadmap OR battlecard OR playbook
` (threatoptix OR jacques OR nicole OR sentinel* OR dominique
`OR walterspiel OR sentinel* OR equifax) AND (orca OR RFI OR
`learn OR "set up" OR acqui* OR purchas* OR offer OR steal OR
`take* OR know* OR customer*)
`
`Yinon Costica
`
`105
`
`274
`
`28
`
`132
`
`126
`
`717
`
`N/A
`
`1,058
`
`2,592
`
`1,864
`
`4,049
`
`693
`
`2,103
`
`753
`
`2,294
`
`1,487
`
`1,837
`
`31,783
`
`22,419
`
`973
`
`1,198
`
`7,571
`
`11,325
`
`6,216
`
`7,946
`
`7,658
`
`54,288
`
`6,296
`
`9,463
`
`4,477
`
`11,956
`
`5,841
`
`8,079
`
`9,096
`
`6,322
`
`3,589
`
`20,515
`
`17,413
`
`5,127
`
`2,172
`
`O365 DeDuped
`Docs
`
`O365 DeDuped
`Docs w/Family
`
`O365 Unique
`DeDuped Docs
`
`O365 Unique
`DeDuped
`Families
`
`Slack DeDuped
`Docs
`
`Slack DeDuped
`Docs w/Family
`
`Slack Unique
`DeDuped Docs
`
`3,013
`
`4,573
`
`10,615
`
`N/A
`
`Clause
`orca* AND (avi OR shua OR gil OR geron OR roadmap OR
`battlecard OR playbook OR copy* OR copie* OR compet* OR
`confid* OR customer OR deal OR platform OR functional* OR
`feature OR vulnerabil* OR secret OR scan* OR VM OR takeout
`OR NDA OR portal OR access* OR MRI OR login OR
`((implement* OR add* OR take OR use* OR pull*) w/5
`(feature* OR tech* OR same OR similar OR solution OR
`method OR strategy OR approach OR stack)) OR problem* OR
`(better w/3 than) OR microsoft OR invent* OR patent* OR
`publication* OR application* OR provisional* OR "intellectual
`property" OR "IP")
`"11,663,031" OR "11663031" OR "11,663,032" OR "11663032"
`OR "11,693,685" OR "11693685" OR "11,726,809" OR
`"11726809" OR "11,740,926" OR "11740926" OR "11,775,326"
`OR "11775326" OR "11,431,735" OR "11431735" OR ((*031
`OR *032 OR *685 OR *809 OR *926 OR *326 OR *019 OR
`*287 OR *220 OR *313 OR *080 OR *527 OR *364 OR *150
`OR *861 OR *201 OR *220 OR *181 OR *718 OR *735 OR
`*678 OR *967 OR *692 OR *556 OR *231 OR *976 OR *998
`OR *798 OR *270 OR *345 OR *488 OR *750) w/10 (patent
`OR orca OR avi OR shua)) OR "11,772,554" OR "11772554" OR
`"11,929,896" OR "11929896" OR "11,936,693" OR "11936693"
`OR "12,001,549" OR "12001549" OR "12,003,529" OR
`"12003529" OR ((*554 OR *442 OR *082 OR *896 OR *190 OR
`*693 OR *845 OR *499 OR *549 OR *794 OR *529 OR *659)
`w/10 (patent OR orca OR avi OR shua))
`sidescan* OR (side* w/5 scan) OR MRI OR (control w/3 plane)
`OR (data w/3 plane) OR out*of*band
`((priorit* OR detect* OR *remediat* OR mitigat* OR analy*
`OR pars*) w/10 (threat* OR vulnerabil* OR secret* OR
`sensitive OR inactive)) AND (snapshot OR disk)
`(M&B OR "ip analysts" OR michael OR mike OR ben-shimon OR
`prosecut* OR "mb-ip.com") AND (orca OR avi OR shua OR
`((copy* OR copie* OR implement* OR add* OR take OR use*
`OR pull*) w/10 (feature* OR tech* OR same OR similar OR
`solution OR method OR strategy OR approach OR problem*))
`OR (better w/3 than) OR NDA OR conflict OR sidescan* OR
`(side w/5 scan*) OR snapshot)
`(threatoptix OR jacques OR nicole OR sentinel* OR dominique
`OR walterspiel OR sentinel* OR equifax) AND (orca OR RFI OR
`learn OR "set up" OR acqui* OR purchas* OR offer OR steal OR
`take* OR know* OR customer*)
`
`(((cloud w/5 (native OR security)) OR platform) w/15 (invest*
`OR profit* OR fund* OR venture OR market* OR demand OR
`compet* OR financ* OR revenue* OR sale* OR purchase* OR
`acqui* OR merg* OR cost* OR startup OR project* OR
`forecast* OR seed OR "series a" OR "series b" OR margin* OR
`milestone* OR price* OR pricing OR calculat* OR discount*))
`
`((attack w/5 path) OR "security dashboard" OR (cdr OR "cloud
`detection and response")) AND ((posture w/2 management)
`OR "Shift-Left" OR (shift w/3 left) OR (data w/3 model) OR
`
`4,366
`
`5,473
`
`2,791
`
`100
`
`262
`
`23
`
`28
`
`331
`
`662
`
`N/A
`
`790
`
`1,796
`
`2,593
`
`6,112
`
`441
`
`613
`
`591
`
`801
`
`1,836
`
`1,979
`
`38,486
`
`35,225
`
`1,213
`
`1,088
`
`5,631
`
`9,671
`
`3,914
`
`4,993
`
`3,779
`
`38,500
`
`2,372
`
`3,824
`
`5,645
`
`2,183
`
`2,477
`
`4,307
`
`23,161
`
`2,872
`
`11,469
`
`18,524
`
`8,416
`
`10,489
`
`7,996
`
`67,355
`
`6,085
`
`765
`
`2,257
`
`106
`
`135
`
`737
`
`4,247
`
`140
`
`5
`
`

`

`Case 1:23-cv-00758-JLH-SRF Document 165-1 Filed 10/09/24 Page 7 of 166 PageID #:
`4069
`
`((securit* OR path OR apply*) w/6 policy))
`("artificial intelligence" OR "AI-SPM" OR "security posture
`Management") OR ("LLM" OR LLM* OR "large language
`model" OR "large language models") OR (natural w/3
`language) OR "BOM" OR (machine w/4 learn*) OR ((AI OR
`"artificial intelligence" OR LLM OR LLM* OR "large language
`models") w/5 (risk* OR database* OR model OR use OR
`detect))
`TOTAL
`
`Thanks,
`Caty
`
`4,756
`
`8,768
`
`2,540
`
`4,220
`
`5,154
`
`43,958
`
`3,037
`
`26,327
`
`38,885
`
`21,027
`
`26,747
`
`24,164
`
`102,640
`
`N/A
`
`From: Krissy.McKenna@lw.com <Krissy.McKenna@lw.com>
`Sent: Wednesday, July 17, 2024 9:35 AM
`To: Lacey, Catherine <clacey@wsgr.com>; Blake.Davis@lw.com; Lucas.Lonergan@lw.com; Ryan.Banks@lw.com; Prasad, Praatika <pprasad@wsgr.com>; WSGR - Orca Wiz <WSGR-Orca-Wiz@wsgr.com>;
`Cottrell@RLF.com; Farnan@RLF.com; haynes@rlf.com
`Cc: orcasecuritywiz.lwteam@lw.com; RSmith@morrisnichols.com; JBlumenfeld@MNAT.com
`Subject: RE: Orca v. Wiz | Priority ESI Requests
`
`EXT - krissy.mckenna@lw.com
`
`Hi Caty, yes, we can do 3pm ET, but have a hard stop a few minutes before 4pm ET. I’ll update the invite now.
`
`From: Lacey, Catherine <clacey@wsgr.com>
`Sent: Wednesday, July 17, 2024 12:29 PM
`To: McKenna, Krissy (BN) <Krissy.McKenna@lw.com>; Davis, Blake (Bay Area) <Blake.Davis@lw.com>; Lonergan, Lucas (Bay Area) <Lucas.Lonergan@lw.com>; Banks, Ryan (OC) <Ryan.Banks@lw.com>; Prasad,
`Praatika <pprasad@wsgr.com>; WSGR - Orca Wiz <WSGR-Orca-Wiz@wsgr.com>; Cottrell@RLF.com; Farnan@RLF.com; haynes@rlf.com
`Cc: #C-M ORCA SECURITY - WIZ - LW TEAM <orcasecuritywiz.lwteam@lw.com>; RSmith@morrisnichols.com; JBlumenfeld@MNAT.com
`Subject: RE: Orca v. Wiz | Priority ESI Requests
`
`Hi Krissy,
`
`Thank you. Are you all still available at 3:00 PM ET / noon PT and could we push the meeting to that time? We expected to have hit counts in time for this morning, but our vendor is still working through
`them.
`
`Regards,
`Caty
`
`From: Krissy.McKenna@lw.com <Krissy.McKenna@lw.com>
`Sent: Wednesday, July 17, 2024 8:28 AM
`To: Lacey, Catherine <clacey@wsgr.com>; Blake.Davis@lw.com; Lucas.Lonergan@lw.com; Ryan.Banks@lw.com; Prasad, Praatika <pprasad@wsgr.com>; WSGR - Orca Wiz <WSGR-Orca-Wiz@wsgr.com>;
`Cottrell@RLF.com; Farnan@RLF.com; haynes@rlf.com
`Cc: orcasecuritywiz.lwteam@lw.com; RSmith@morrisnichols.com; JBlumenfeld@MNAT.com
`Subject: RE: Orca v. Wiz | Priority ESI Requests
`
`EXT - krissy.mckenna@lw.com
`
`Caty,
`
`Below are updated hit counts for Wiz’s revised search terms. Note that Wiz’s revised AI term exceeded the character count for our document vendor to run as one term, so we had to break the term into two
`subsets, shown below as parts (a) and (b). We can discuss further on today’s meet and confer. In addition, we are still waiting on the breakdown of slack vs. email documents from our vendor. We will follow
`up once we have those numbers, but wanted to provide you with the total updated hit counts ahead of meeting at 1pm ET. Please let us know when you will have updated counts for Orca’s revised terms
`provided on Monday.
`
`Avi Shua
`
`Term #
`
`Search Term
`
`Total Hit Count
`
`Total Hits Including
`Family
`
`Unique Hits
`
`("artificial intelligence" OR ai OR "large language model" OR llm OR *gpt* OR
`openai OR "open ai" OR "amazon bedrock" OR "AWS bedrock" OR "google
`vertex" OR "google cloud vertex" OR sagemaker OR pytorch OR tensorflow
`OR "hugging face”) AND (cloud OR environment* OR estate* OR platform*
`OR *spm* OR ((security OR posture) w/3 management) OR orca OR vm* OR
`(virtual w/3 machine*) OR workload* OR asset* OR scan*)
`("artificial intelligence" OR ai OR "large language model" OR llm OR *gpt* OR
`openai OR "open ai" OR "amazon bedrock" OR "AWS bedrock" OR "google
`vertex" OR "google cloud vertex" OR sagemaker OR pytorch OR tensorflow
`OR "hugging face”) AND (pii OR estate OR bom* OR (bill w/3 material*) OR
`inventor* OR quer* OR search* OR question* OR ask* OR discover*)
`(risk* OR vulnerabil* OR threat*) w/20 (sever* OR scor* OR priorit* OR
`match*)
`
`1a
`
`1b
`
`2
`
`19,666
`
`23,965
`
`8,311
`
`9,518
`
`12,277
`
`0
`
`11,166
`
`17,671
`
`2,466
`
`Arie Teter
`
`Term #
`
`Search Term
`
`Hit Count
`
`Total Hits Including
`Family
`
`Unique Hits
`
`1a
`
`1b
`
`("artificial intelligence" OR ai OR "large language model" OR llm OR *gpt*
`OR openai OR "open ai" OR "amazon bedrock" OR "AWS bedrock" OR
`"google vertex" OR "google cloud vertex" OR sagemaker OR pytorch OR
`tensorflow OR "hugging face”) AND (cloud OR environment* OR estate*
`OR platform* OR *spm* OR ((security OR posture) w/3 management) OR
`orca OR vm* OR (virtual w/3 machine*) OR workload* OR asset* OR
`scan*)
`
`("artificial intelligence" OR ai OR "large language model" OR llm OR *gpt*
`OR openai OR "open ai" OR "amazon bedrock" OR "AWS bedrock" OR
`"google vertex" OR "google cloud vertex" OR sagemaker OR pytorch OR
`tensorflow OR "hugging face”) AND (pii OR estate OR bom* OR (bill w/3
`material*) OR inventor* OR quer* OR search* OR question* OR ask* OR
`discover*)
`
`12,595
`
`41,828
`
`6,410
`
`4,795
`
`33,505
`
`0
`
`6
`
`

`

`Case 1:23-cv-00758-JLH-SRF Document 165-1 Filed 10/09/24 Page 8 of 166 PageID #:
`4070
`
`2
`
`(risk* OR vulnerabil* OR threat*) w/20 (sever* OR scor* OR priorit* OR
`match*)
`
`8,416
`
`9,053
`
`5,771
`
`
`Yoav Alon
`
`Term #
`
`Search Term
`
`Hit Count
`
`Total Hits Including
`Family
`
`Unique Hits
`
`("artificial intelligence" OR ai OR "large language model" OR llm OR
`*gpt* OR openai OR "open ai" OR "amazon bedrock" OR "AWS bedrock"
`OR "google vertex" OR "google cloud vertex" OR sagemaker OR pytorch
`OR tensorflow OR "hugging face”) AND (cloud OR environment* OR
`estate* OR platform* OR *spm* OR ((security OR posture) w/3
`management) OR orca OR vm* OR (virtual w/3 machine*) OR workload*
`OR asset* OR scan*)
`
`("artificial intelligence" OR ai OR "large language model" OR llm OR
`*gpt* OR openai OR "open ai" OR "amazon bedrock" OR "AWS bedrock"
`OR "google vertex" OR "google cloud vertex" OR sagemaker OR pytorch
`OR tensorflow OR "hugging face”) AND (pii OR estate OR bom* OR (bill
`w/3 material*) OR inventor* OR quer* OR search* OR question* OR
`ask* OR discover*)
`(risk* OR vulnerabil* OR threat*) w/20 (sever* OR scor* OR priorit* OR
`match*)
`
`1a
`
`1b
`
`2
`
`13,866
`
`30,237
`
`7,131
`
`5,172
`
`20,326
`
`1
`
`6,602
`
`8,614
`
`1,319
`
`
`Meghan Marks
`
`Term #
`
`Search Term
`
`Hit Count
`
`Total Hits Including
`Family
`
`Unique Hits
`
`("artificial intelligence" OR ai OR "large language model" OR llm OR
`*gpt* OR openai OR "open ai" OR "amazon bedrock" OR "AWS bedrock"
`OR "google vertex" OR "google cloud vertex" OR sagemaker OR pytorch
`OR tensorflow OR "hugging face”) AND (cloud OR environment* OR
`estate* OR platform* OR *spm* OR ((security OR posture) w/3
`management) OR orca OR vm* OR (virtual w/3 machine*) OR workload*
`OR asset* OR scan*)
`
`("artificial intelligence" OR ai OR "large language model" OR llm OR
`*gpt* OR openai OR "open ai" OR "amazon bedrock" OR "AWS bedrock"
`OR "google vertex" OR "google cloud vertex" OR sagemaker OR pytorch
`OR tensorflow OR "hugging face”) AND (pii OR estate OR bom* OR (bill
`w/3 material*) OR inventor* OR quer* OR search* OR question* OR
`ask* OR discover*)
`(risk* OR vulnerabil* OR threat*) w/20 (sever* OR scor* OR priorit* OR
`match*)
`
`1a
`
`1b
`
`2
`
`21,234
`
`2