Item 1C. Cybersecurity.

Cybersecurity Risk Management and Strategy

Our cybersecurity framework (which includes management of related risks) is based on recognized cybersecurity industry frameworks and standards, including those of the National Institute of Standards and Technology, the Center for Internet Security Controls, and ISO 27001. We do not certify that we meet any particular technical standards, specifications, or requirements, but we use the aforementioned frameworks and standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. We use these frameworks, together with information collected from internal assessments, to develop policies for the use of our information assets (e.g., IT business information and information resources such as mobile phones, computers and workstations), access to specific intellectual property or technologies, and protection of personal information. We seek to protect these information assets through a variety of technical and organizational measures and identity and access management frameworks, including role-based access control, attribute-based access control, least privilege, need-to-know access and multi-factor authentication, which we require for access to our core resources. We also use endpoint detection and response tools intended to reduce the risk posed by emerging malware, rootkits, spyware, ransomware and similar threats to our endpoints and systems.

We also work with internal stakeholders across the Company to integrate foundational cybersecurity principles into our operations, including the employment of multiple layers of cybersecurity defenses, restricted access based on business needs, and measures designed to support the integrity of our business information. We train our employees on cybersecurity awareness topics, including social engineering attacks, confidential information protection, and emerging threats and we conduct simulated phishing attacks designed to improve their awareness.

We classify licensed datasets, content, annotations, metadata, and provenance records as high-value information assets subject to enhanced access controls — which may include role-based and attribute-based permissions, audit logging, and encryption at rest and in transit — and we seek to restrict access to those assets to personnel with a business need. Content delivered or transferred to enterprise customers is governed by customer-specific entitlement controls designed to limit access to authorized recipients under the terms of applicable agreements, and transfers are generally subject to monitoring and logging. Certain personal data relating to contributors — including identity, tax, payment, and consent and release information — is maintained in systems logically separated from our content and production environments and is subject to a dedicated data protection program based on applicable legal requirements across the jurisdictions in which we operate.

We maintain a business continuity program designed to address material risks to business operations, and our disaster recovery planning is reviewed and updated on a periodic basis.

We have standing engagements with incident response experts and external counsel, including through our cyber insurance. We collaborate with industry experts and cybersecurity practitioners at other companies to exchange information about potential cybersecurity threats, security practices and trends. The sources we review as part of our threat monitoring include information on vulnerabilities, attack patterns and TTPs (Tactics, Techniques, and Procedures) released by the Cybersecurity and Infrastructure Security Agency (CISA) and the National Institute of Standards and Technology (NIST) and the “Threat Landscape” report published by the European Union Agency for Cybersecurity (ENISA).

We also have an internal incident response team that addresses security events triggered by our Security Information and Event Management (SIEM) system. Monitoring of our infrastructure, from endpoint devices to virtual clusters, is intended to help detect potential interception of internal communications and to reduce the risk of leakage of business-critical data.

Our cybersecurity risk management extends to risks associated with our use of third-party service providers. We perform risk-based security and compliance diligence on new vendors before they are engaged, with the results considered against the risk tolerance set by management. Where a vendor’s engagement involves the processing of personal data on our behalf, this diligence is conducted as part of the same vendor management process designed to address applicable data protection requirements, which, as applicable to the particular engagement, may include execution of a written data processing agreement, assessment of whether the vendor acts as our processor or as an independent controller, flow-down of sub-processor obligations, and implementation of a cross-border transfer mechanism.

Our vulnerability management program involves scanning and testing of systems, endpoints, virtual environments, and cloud-based assets to identify potential software flaws, misconfigurations, or exposure points. Once vulnerabilities are detected, we prioritize remediation based on risk impact and business criticality, and we seek to address identified gaps in a timely manner. This approach is intended to harden our infrastructure, reduce our attack surface and align our practices with recognized industry frameworks.

As part of our secure development lifecycle (SDLC), we conduct both automated and manual code reviews intended to assess whether the applications we deliver to our users are resilient against exploitation and designed to limit data leakage. By incorporating security controls throughout the development process, from design to deployment, we seek to protect the confidentiality, integrity and reliability of our systems and data. This approach is also intended to support our compliance with applicable regulatory requirements.

In response to the growing use of AI by bad actors, we seek to adapt our internal policies, procedures, and control mechanisms to address AI-driven threats, including:

Our multi-layered defense strategy includes:

These practices are intended to help us adapt our defenses as AI-driven threats evolve. The measures described in this Item reduce but do not eliminate cybersecurity risk, and we cannot assure that our controls will prevent or detect every incident. See Item 1A, Risk Factors. 

Governance of Cybersecurity Risk Management

The board of directors, as a whole, has oversight responsibility for our strategic and operational risks and sets associated risk parameters and tolerance levels. The audit committee assists the board of directors with this responsibility by reviewing and discussing the defined risks, its assessment and proposed mitigation strategies, including cybersecurity risks, with members of management. The audit committee, in turn, periodically reports on its review with the board of directors.

Management is responsible for day-to-day assessment and management of cybersecurity risks and reports regularly to the audit committee. Our data protection officer assists the organization with monitoring internal compliance and informing and advising on data protection obligations in respect of cybersecurity.

Zedge’s cybersecurity risk governance helps our organization understand and implement cybersecurity governance practices that support long-term cybersecurity goals beyond the day-to-day information security tasks, and to align with legal and regulatory requirements and with the direction of the Company, by:

Governance of Cybersecurity Risk Management

The board of directors, as a whole, has oversight responsibility for our strategic and operational risks and sets associated risk parameters and tolerance levels. The audit committee assists the board of directors with this responsibility by reviewing and discussing the defined risks, its assessment and proposed mitigation strategies, including cybersecurity risks, with members of management. The audit committee, in turn, periodically reports on its review with the board of directors.

Management is responsible for day-to-day assessment and management of cybersecurity risks and reports regularly to the audit committee. Our data protection officer assists the organization with monitoring internal compliance and informing and advising on data protection obligations in respect of cybersecurity.

Zedge’s cybersecurity risk governance helps our organization understand and implement cybersecurity governance practices that support long-term cybersecurity goals beyond the day-to-day information security tasks, and to align with legal and regulatory requirements and with the direction of the Company, by: