CXApp

Risk Management and Strategy

CXApp’s information security program is designed to identify, assess, and manage risks to the confidentiality, integrity, and availability of the Company’s information assets and is implemented based on ISO 27001 and SOC 2 frameworks.

Risk Management Program

As part of its information security program, CXApp maintains a risk management program that includes the identification, evaluation, and treatment of risks across the organization’s information assets, including risks arising from cybersecurity threats. The risk management program addresses uncertainties related to information assets in order to help ensure that desired business outcomes are achieved. CXApp performs formal risk assessments on an annual basis to identify security risks related to its corporate operations, products, and services and initiates appropriate remediation activities where necessary.

CXApp’s information security program is aligned with the Company’s business objectives and establishes processes governing the identification of risks, assignment of risk ownership, evaluation of how risks impact the confidentiality, integrity, and availability of information, and determination of appropriate risk treatment methods. A formal risk assessment methodology has been approved by management and is applied consistently across the organization.

The risk management framework includes guidelines for identifying and estimating the cost of protective measures designed to eliminate or reduce security risks to an acceptable level. All operations, products, services, information assets, and information systems that are owned and operated by CXApp are assessed for risks resulting from threats to the integrity, availability, and confidentiality of the Company’s data.

The risk management program focuses on the following activities:

● Identification of Strategic Objectives: Alignment of strategic objectives and risk management to avoid a siloed approach to risk management and to support effective risk assessments.

● Identification of Risks: Ongoing identification and documentation of risks that could affect CXApp’s strategic objectives, security functions, and business continuity.

● Analysis of Risks: Evaluation of the likelihood and potential impact of identified risks and prioritization of risks relative to one another.

● Mitigation Planning: Development of decisions and actions designed to reduce the likelihood or impact of risks or to improve the Company’s response to risk events.

● Tracking and Controlling Risks: Ongoing monitoring, reporting, and management oversight of risks and associated mitigation plans, including adjustments in response to changes in the risk environment.

In addition to annual risk assessments, CXApp monitors cybersecurity risks on an ongoing basis through security monitoring, vulnerability management activities, and periodic reassessment in response to significant changes in the threat landscape or business operations.

CXApp engages independent third-party assessors and auditors in connection with its cybersecurity risk management processes, including for independent assurance examinations, certification audits, and periodic external testing activities. The Company also maintains processes to identify and oversee cybersecurity risks associated with third-party service providers, including through vendor risk assessments, review of independent assurance reports, and contractual security requirements.

Governance

As part of the risk management program, responsibility for cybersecurity risk management is distributed across the organization and includes the Information Technology department, system owners, department managers, and executive management.

Management’s Role in Managing Risks

The Information Technology department is responsible for conducting risk assessments and for prioritizing, implementing, and maintaining appropriate risk-reduction measures identified through the risk assessment process.

Risk owners are individuals who are accountable for ensuring that assigned risks are managed appropriately. Multiple personnel may have direct responsibility for or oversight of activities designed to manage a given risk and work collaboratively with the designated risk owner. Responsibilities for the continued development, implementation, and maintenance of the risk management program are assigned internally.

Executive management is responsible for sponsoring and supporting the risk management program and processes, participating in risk management discussions, and reviewing and approving risk assessments and mitigation plans. As of December 31, 2025, the Company was not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. For further discussion of risks associated with cybersecurity incidents, see Item 1A. Risk Factors – Risks Relating to Cybersecurity Threats in this Annual Report.

The Company’s Senior Director of DevOps and IT is responsible for leading the assessment and management of cybersecurity risks and has prior professional experience in information security, risk management, and technology operations. The Senior Director of DevOps and IT provides regular reports regarding cybersecurity risks and related matters to executive management, the Audit Committee, and the Board of Directors.

Board of Directors Oversight

The Board of Directors plays an active role by meeting periodically to review the status of the organization’s information security program and roadmap for new cybersecurity risk management initiatives.

The board oversees cybersecurity risk management by evaluating whether management has current cybersecurity policies and procedures, regularly assesses, and monitors cybersecurity risks and receives regular reports on the organization’s cybersecurity posture.