Netskope

Cybersecurity Risk Management

We maintain a cybersecurity risk management program designed to mitigate risks from cybersecurity threats to our business, products, systems, and data, including risks associated with third-party service providers. Our cybersecurity program provides a foundation for identifying, monitoring, evaluating, and responding to cybersecurity threats and incidents, including those associated with our use of software, applications, services, and cloud infrastructure developed or provided by third-party vendors and service providers. This program includes steps for identifying the source of a cybersecurity threat or incident, including whether such cybersecurity threat or incident is associated with a third-party vendor or service provider: assessing the severity and overall risk of a cybersecurity threat or incident, implementing cybersecurity countermeasures and mitigation or remediation strategies, and informing the relevant members of our senior management team and, when appropriate, the Audit Committee and our Board of Directors.

We engage third parties, including vendors and other external service providers, to support our cybersecurity and data privacy processes. For example, we regularly engage independent third parties for penetration testing and evaluation of our various security

compliance standards. We also conduct internal assessments of our cybersecurity risk management program. We periodically review and update our cybersecurity policies, standards and procedures, including to account for material changes in the threat and operational landscapes, as well as in response to legal and regulatory developments. Our team has established a continuous improvement process through which we regularly update our risk register against the evolving capabilities of adversaries and incorporate findings from internal and external testing. Further, we require mandatory training for all employees and contractors on our cybersecurity and privacy policies. We also have processes to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers. We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. In addition, we perform diligence on our vendors and prospective vendors regarding their cybersecurity posture.

An incident response team is responsible for the monitoring and disposition of potential occurrences such as data breaches, intrusions, and other security incidents and implementing our detailed incident response plan. Our incident response plan includes processes and procedures for assessing potential internal and external threats, activation and notification, and post-incident recovery designed to safeguard the confidentiality, availability, and integrity of our information assets.

In fiscal 2026, and through the filing of this Annual Report on Form 10-K, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business strategy, operating results, and/or financial condition. If we were to experience a material cybersecurity incident in the future, such an incident could potentially have a material effect, including on our business strategy, operating results, or financial condition. For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto, see Part I, Item 1A, “Risk Factors” in this Annual Report on Form 10-K.

Cybersecurity Governance

Our Board of Directors oversees our overall enterprise risk management. Our cybersecurity risk management program is integrated with our overall enterprise risk management and is prioritized for Board oversight through the Audit Committee. The Audit Committee receives periodic updates from our Chief Information Security Officer ("CISO") regarding cybersecurity risks and the Company’s cybersecurity program, which may include updates on threat environment, security program initiatives, incident response preparedness, and significant risk areas.

Management is responsible for day-to-day risk management activities, including identifying and assessing cybersecurity risks, establishing processes to ensure that potential cybersecurity risk exposures are monitored, implementing appropriate mitigation or remediation measures, and maintaining cybersecurity programs. Our cybersecurity program is led by our CISO, who regularly reports to senior management and provides updates to the Audit Committee. The CISO works directly with the internal security team to support oversight of cybersecurity risks across the Company.

Our CISO has substantial cybersecurity experience, and has held senior leadership positions at publicly traded companies in the technology industry. The CISO’s leadership team, which consists of seasoned information security professionals with experience at globally recognized organizations, works to ensure that we maintain a robust and comprehensive approach to cybersecurity oversight.