BBlackBerry

Cybersecurity Risk Management and Strategy

The Company’s cybersecurity risk management program is an integral part of its overall enterprise risk management efforts. The Company manages cybersecurity risks within its products and services, infrastructure and corporate resources using a framework that is based on applicable regulations, industry standards and recognized best practices designed to safeguard the confidentiality, integrity, and availability of its information assets. Through this framework, the Company devotes appropriate resources to monitoring, identifying, assessing and responding to cybersecurity threats and incidents, including those associated with its use of third-party software, applications, services, and cloud infrastructure.

To mitigate risk to its systems, endpoints and data, the Company evaluates internal and external threat intelligence, deploys encryption and authentication technologies and other protective measures, maintains security policies and procedures, and conducts awareness training. The Company also conducts penetration and vulnerability testing and other risk assessments,

implements appropriate internal controls, and engages independent third-party auditors to evaluate its compliance with security industry standards.

The Company’s incident response team, comprised of representatives from the Company’s information technology, information security, product security, engineering, communications, privacy and legal groups, is responsible for addressing potential and actual security threats and other security incidents and implementing the Company’s incident response plan. The Company’s incident response plan includes processes and procedures for assessing potential internal and external threats, activation, escalation, crisis management, notifications, post-incident recovery and after-action review.

The readiness of the incident response team is promoted through table-top exercises and threat simulations, including during the fiscal year ended February 28, 2026. The Company also conducts mandatory training of all employees on its security and data privacy practices and policies and periodically sends simulated phishing emails to employees to build resilience.

In addition, the Company maintains specific policies and practices to mitigate third party security risks, including a process for evaluating the security controls of vendors and service providers who exchange data with the Company or have access to or integrate with the Company’s systems. At the same time, the Company’s control over the security posture of third parties is limited and there can be no assurance that any vendor or service provider of the Company will not experience a compromise or failure in the information assets under its control.

For the years covered by this report, the Company did not identify any security threats or incidents that have materially affected or are reasonably likely to materially affect its business strategy, results of operations or financial condition. However, like all other enterprises, the Company faces known and unknown cybersecurity risks and threats that are not fully mitigated. While the Company works continuously to enhance its security programs and risk management efforts, it discovers vulnerabilities from time to time and there can be no assurance that the Company has not experienced an undetected cybersecurity incident or that it will not experience material loss or damage from an incident in the future.

Cybersecurity Governance

The Board oversees the Company’s enterprise risk management program, including cybersecurity risk. The Audit and Risk Management Committee assist the Board in this oversight. The Company’s internal audit function reports to the Audit and Risk Management Committee and provides independent assurance on the design and operating effectiveness of risk management activities and internal controls related to cybersecurity risk. For more information, see Part 3, Item 10, “Directors, Executive Officers and Corporate Governance – Enterprise Risk Management”.

The Company’s cybersecurity program is managed by the Chief Information Security Officer (“CISO”), who leads a team of information security professionals and is responsible for activities to prevent, detect, mitigate, and remediate cybersecurity risk. The CISO provides quarterly updates to the Board on the program, including security control coverage and effectiveness, vulnerability testing and remediation, and security operations. These updates also address improvements to processes, technology, and governance intended to reduce residual cybersecurity risk.