Aeluma, Inc.

Cybersecurity Risk Management and Strategy

We recognize the importance of cybersecurity to our business and maintain processes and safeguards designed to protect our information systems, confidential information and intellectual property from cybersecurity threats. Our cybersecurity practices are designed to be appropriate for our size, stage of development and operations and continue to evolve as our business and cybersecurity risks develop.

During fiscal 2026, we outsourced substantially all of our information technology function to a third-party information technology services provider with dedicated cybersecurity expertise. Our service provider assists us in managing, maintaining and securing our information technology environment and in identifying and addressing cybersecurity threats and vulnerabilities.

Our cybersecurity measures include anti-malware protection, endpoint detection and response security solutions, vulnerability scanning, patch management, data backup and recovery procedures, security-awareness training and phishing testing. We also consider cybersecurity risks, as appropriate, when selecting and engaging third-party vendors and service providers.

We consider cybersecurity risk as part of our broader assessment of risks to the business. We mayengage our information technology services provider or other outside advisors to assist us in assessing or responding to cybersecurity risks. Given our size and stage of development, we have not adopted a formal cybersecurity risk management framework, such as the National Institute of Standards and Technology Cybersecurity Framework, or established a separate internal cybersecurity function.

As of the date of this Annual Report, we are not aware of any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, cybersecurity threats continue to evolve, and we cannot provide assurance that cybersecurity risks or incidents willnot materially affect us in the future. See “Item 1A. Risk Factors” for additional information regarding cybersecurity and information technology risks.

Cybersecurity Governance

Our Board of Directors oversees the principal risks facing the Company as part of its general risk oversight responsibilities. The Audit Committee assists the Board in overseeing financial reporting, internal control and other risk management matters within the scope of its responsibilities.

Given the nature of our current operations and our experience to date, we have not assigned the Board any additional duties specifically related to cybersecurity oversight or designated the Audit Committee or any other Board committee as having specific responsibility for cybersecurity risks. Cybersecurity and information technology matters may be discussed with the Board or Audit Committee as part of their broader consideration of risks facing the Company or when management determines that a matter warrants their attention.

Our Chief Executive Officer has primary management responsibility for oversight of our information technology environment and cybersecurity risk management processes, including our relationship with our third-party information technology services provider. Our service provider has personnel with cybersecurity expertise who assist management in monitoring and addressing cybersecurity threats and vulnerabilities.

If a significant cybersecurity incident were identified, management, with assistance from our service provider and other advisors as appropriate, would assess its nature, scope and potential impact, inform the Board and, as appropriate, the Audit Committee of significant matters, and evaluate whether disclosure is required under applicable securities laws and regulations.