Kaltura

Cybersecurity Risk Management and Strategy

Kaltura has developed and implemented a cybersecurity risk management program, intended to protect the confidentiality, integrity, and availability of our critical systems and information.

We aim to be proactive in our approach to cybersecurity, with our practices informed by the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This approach aids us in identifying and managing cyber risks in a manner that aligns with our business operations. While the NIST CSF serves as a guiding framework to help us identify, assess, and manage cybersecurity risks, this does not imply we adopt a blanket adherence to its standards and requirements in all respects. Our cybersecurity risk management program is further informed by the industry-recognized certifications we have obtained through comprehensive third-party evaluations, including ISO/IEC 27001:2022, ISO 27701, ISO 27799, ISO 22301, SOC 2 Type 2, and SOC 3.

Our cybersecurity risk management program is integrated into the broader scope of Kaltura's enterprise risk management framework, including processes for managing risks, from legal and compliance to strategic, operational, and financial threats, through shared methodologies, reporting channels, and governance processes.

Key elements of our cybersecurity risk management program encompass:

a.Risk Assessments: A risk assessment process to identify and evaluate material cybersecurity threats to our systems, data, products, services, and overall IT environment.

b.Security Team Expertise: Our security team, led by our Chief Information Security Officer (CISO), who oversees our cybersecurity risk assessments, the implementation of security controls, and the coordination of our incident response efforts.

c.External Collaboration: We engage with external service providers, where appropriate, for assessing and testing our security processes and controls.

d.Cybersecurity Awareness Training: Security awareness and training programs for our employees.

e.Incident Response Preparedness: Our incident response plan outlines our approach to addressing and responding to cybersecurity incidents and to findings, vulnerabilities and incidents that could lead to or allegedly be suspected as cybersecurity incidents.

f.Third-Party Risk Management: A process for evaluating and managing the risks associated with our service providers, suppliers, and vendors who access our critical systems and data.

We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us or are reasonably likely to materially affect us.

We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.

See “Risk Factors – Risks Related to Information Technology, Intellectual Property and Data Privacy and Security” - “A real or perceived bug, defect, security vulnerability, error, or other performance failure involving our platform, products or solutions could cause us to lose revenue, damage our reputation, and expose us to liability.” and “If we or our third-party service providers experience a security breach, data loss or other compromise, including if unauthorized parties obtain access to our customers’ data, our reputation may be harmed, demand for our platform, products and solutions may be reduced, and we may incur significant liabilities.”

Cybersecurity Governance

Cybersecurity risk is a critical aspect of our Board of Directors' risk oversight function. The Board has entrusted the Audit Committee with the oversight of cybersecurity and other IT-related risks. This committee monitors the execution of our cybersecurity risk management program.

Regular briefings are provided to the Audit Committee by management, regarding the cybersecurity risk landscape and any significant cybersecurity incidents. These updates are then relayed to the full Board as deemed necessary by the Audit Committee. Our management team also receives regular internal briefings.

Board members are regularly educated on cybersecurity issues through presentations from our Chief Information Security Officer (CISO) and internal security team. External experts may also be consulted to provide additional insights or reports when necessary.

Our management team, including the CISO, Data Privacy Officer (DPO) and Chief Product, Engineering and Marketing Officer, responsible for the assessment and mitigation of cybersecurity threats and overseeing both our internal security personnel and external cybersecurity consultants. Our management team’s cumulative experience includes decades of specialized work in cybersecurity, spanning large-scale cloud-native environments and global public companies. Our CISO is a graduate of John Bryce’s Information Security Management (CISO) program, an executive-level curriculum focused on strategic risk management, the intersection of technology, business management, and regulatory law. He brings extensive experience in driving security strategy and innovation within complex, multi-account AWS infrastructures. His professional background includes serving as Director of Security Operations and SecOps & IR Team Lead at Kaltura, as well as holding key technical roles such as Cyber Security Engineer at Imperva and Network Operations Engineer at RSA Security. His expertise encompasses enterprise cyber defense, risk management, and the design of resilient security architectures. The team reporting to our CISO includes specialists in Cyber Detection and Response, Red Teaming, and Security Compliance Auditing, ensuring a comprehensive approach to both offensive and defensive security postures.

Our Data Privacy Officer (DPO) brings over 15 years of experience advising technology and SaaS organizations on global data protection and compliance frameworks, including leadership of enterprise-wide data privacy initiatives ensuring compliance with the General Data Protection Regulation (GDPR), the California Consumer Privacy Act and California Privacy Rights Act (CCPA/CPRA), and related international privacy regimes. In this capacity, the DPO oversees the governance of Data Processing Agreements (DPAs), including the review, drafting, and negotiation of such agreements with customers, partners, and vendors, as well as the management of Data Subject Access Requests (DSARs) to ensure compliance with applicable response timelines and data integrity requirements. The DPO also serves in a strategic advisory role on privacy and security matters across our Legal, IT Security, Product, Human Resources, Sales, and Compliance teams, and is responsible for ongoing research and policy development relating to evolving data protection laws, cybersecurity trends, and industry best practices. The DPO holds an LL.M. in Cyber Law and Data Privacy from Drexel University, Thomas R. Kline School of Law, earned with High Distinction, as well as a Certificate in Data Privacy Strategy from Cornell University.

Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include: briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.