Agora

Cybersecurity risk management is a foundational aspect of our comprehensive risk management program. Our cybersecurity risk management initiative aligns with various industry and regulatory frameworks, and we hold multiple certifications and attestations,

including ISO 27001/2, ISO27017, ISO27018, Sarbanes-Oxley, AICPA SOC 2 Type 2, HIPAA, and GDPR, as well as various regional compliance frameworks. We have implemented security controls compliant with these frameworks to effectively address potential material cybersecurity incidents. Additionally, we have established internal processes such as vulnerability management, third-party penetration testing, third-party audits, continuous monitoring, and ongoing compliance assessments.

We continuously monitor and review threats and cybersecurity incidents associated with the use of services and security tools by third-party service providers. We operate an Incident Response Program (“IRP”) to ensure coordinated responses across company departments to manage potential material cybersecurity incidents effectively. This program entails assessing threat severity, identifying threat sources (especially related to third-party services), implementing countermeasures and mitigation strategies, and promptly informing management and the board of directors of material cybersecurity threats and incidents. Regular assessments by our cybersecurity team help evaluate and enhance our cybersecurity risk management program, with specific focus areas assessed by third-party experts in critical risk domains. In addition, our cybersecurity team facilitates compliance and cybersecurity training to all employees. Our executive officers are regularly updated on the status of the cybersecurity and risk management program by the Head of Information Security for Agora and the Head of Information Security for Shengwang. Together, they have the overall oversight responsibility for our risk management and are charged with oversight of our cybersecurity risk management program / delegates cybersecurity risk management oversight to the cybersecurity team.

Our executive officers are responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which the company is exposed and implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. Our executive officers shall report any material cybersecurity risks to our Board. Our senior management team is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our CEO and chairman of the board, who receives reports from our Heads of Information Security and cybersecurity team and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our Heads of Information Security and dedicated personnel are experienced information systems security professionals and information security managers with years of experience. Management, including the Heads of Information Security and our cybersecurity team, regularly update the Chief Executive Officer on the company’s cybersecurity and risk programs, material cybersecurity risks and mitigation strategies and provide regular cybersecurity reports that cover, among other topics, third-party assessments of the company’s cybersecurity programs such as AICPA SOC2 Type 2 developments in cybersecurity and updates to the company’s cybersecurity programs and mitigation strategies.

In 2025, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see “Item 3. Key Information—D. Risk Factors—Risk Related to Our Business and Industry— Breaches of networks or systems of our suppliers, could degrade our ability to conduct our business, compromise the integrity of our products, platform and data, result in significant data losses and leakage and the theft of our intellectual property, damage our reputation, expose us to liability to third parties and require us to incur significant additional costs to maintain the security of our networks and data” on page 17 of this annual report.