SURF AIR MOBILITY INC.

We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. We have implemented and planned several cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such material risks.

Cybersecurity Risk Management and Strategy

As part of our overall risk management framework, we have implemented the following cybersecurity measures:

•

Cybersecurity incident response plan and procedures

•

Change management and software development life cycle (“SDLC”) workflow across the Engineering release team

•

Role-based access controls across enterprise systems

•

Work with partners that have SOC1/SOC2 compliance standards around the management and processing of payment card industry (“PCI”) and personally identifiable information (“PII”) data

•

Use of multi-factor authentication for accessing digital content across important roles in the enterprise

•

Security controls designed to mitigate risks related to business email compromise, malware, ransomware, and other cybersecurity threats across employee devices

•

Centralized device management tools to centrally manage and update company-owned hardware assets

•

Vulnerability scanning frameworks across digital and hardware assets across the enterprise

In addition, our cybersecurity roadmap includes the following planned initiatives:

•

Periodic reviews of our consumer-facing policies and statements related to cybersecurity

•

Cybersecurity management and incident training for employees

•

Regular phishing email simulations for all employees and contractors with access to corporate email systems to enhance awareness and responsiveness

•

Ongoing evaluation and refinement of internal processes and response plans to address evolving cybersecurity threats and trends

To further enhance our cybersecurity posture, weengage, and plan to continue engaging, external assessors, consultants, and other third parties to review elements of our cybersecurity program and identify areas for improvement or enhanced compliance. We are also working toward a more comprehensive cybersecurity risk assessment process aligned to standards published by the National Institute of Standards and Technology (NIST) and plan to align certain controls with the Center for Internet Security (CIS) benchmarks. In addition, we anticipate engaging third-party providers to perform penetration testing of our information systems.

As of December 31, 2025, we have not experienced any material cybersecurity incidents. Risks from cybersecurity threats, including any prior incidents, have not materially affected the Company’s business strategy, results of operations or financial condition. Certain third-party SaaS infrastructure providers used by the Company have experienced cybersecurity events as part of broader industry-wide incidents; however, the impact to the Company was immaterial, and no penalties or settlements were incurred.

Additional information on cybersecurity risks we face can be found in Part I, Item 1A “Risk Factors” of this Report under the headings “We will rely on our information technology systems to manage numerous aspects of our business. A cyber-attack of these systems could disrupt our ability to deliver services to our customers and could lead to increased overhead costs, decreased sales and harm to our reputation” and “System failures, defects, errors or vulnerabilities in our website, applications, backend systems or other technology systems or those of third-party technology providers could harm our reputation and brand and adversely affect our business, financial condition and results of operations,” which should be read in conjunction with the foregoing information.

Governance and Oversight

Cybersecurity is an integral part of the Company’s enterprise risk management processes and an area of increasing focus for our Board of Directors. The Board oversees the Company’s enterprise risk management process, including the management of risks arising from cybersecurity threats.

Management oversight of cybersecurity risk is supported by the Information Technology Steering Committee, which includes executive leadership, business leaders, and information technology leadership. The Information Technology Steering Committee meets regularly to review cybersecurity risks, mitigation strategies, and related initiatives. Management provides the Board with periodic updates regarding cybersecurity risk management and strategy, including the Company’s security posture, progress toward risk-mitigation initiatives, and emerging threat developments.

Pursuant to the Company’s cybersecurity incident response framework, certain cybersecurity incidents that meet established escalation thresholds are reported internally and, where appropriate, escalated to the Board. Management provides updates regarding any such incident until it has been addressed. Members of the Board and the Information Technology Steering Committee also engage in periodic discussions with management regarding cybersecurity-related developments and risk management activities.

The Company’s cybersecurity risk management and strategy processes are led by the Director of IT, in coordination with executive leadership. Collectively, management has over 25 years of experience across roles involving information security management, cybersecurity strategy development, and the implementation of information security programs. In addition, the Company’s Chief Executive Officer, who holds CISSP certification, provides executive oversight and strategic guidance related to cybersecurity risk management and mitigation.