NexMetals Mining Corp.

Risk Management and Strategy

We, like other companies in our industry, face several cybersecurity risks in connection with our business. Our business strategy, results of operations, and financial condition have not, to date, been materially affected by risks from cybersecurity incidents or threats. During the reporting period, we have not, to our knowledge, experienced any material cybersecurity threats or incidents.

The Company implemented a formal cybersecurity program during 2025 using the National Institute of Standards and Technology Cybersecurity Framework (“NIST CSF 2.0”) as a guiding principle for assessing, identifying and managing material risks from cybersecurity threats. The Company’s program safeguards the confidentiality, integrity, and availability of our essential systems, information and computing resources, and is designed to detect and mitigate risks from cybersecurity threats to our data and our systems. Central to the Company’s cybersecurity program is a robust incident response plan designed to address potential cyber incidents swiftly and effectively.

It is important to clarify that our use of the NIST CSF 2.0 for guidance purposes to frame our risk identification, assessment and management processes does not equate to compliance with any specific technical standards or requirements.

The key components of our cybersecurity program include:

-20-

Cybersecurity Governance

The governance of cybersecurity risks is a critical function of our Board, which plays a key role in the oversight of cybersecurity and related technology risks. The Board is tasked with monitoring the effectiveness of our cybersecurity risk management program.

The Board is kept informed by management with respect to cybersecurity risks facing the Company and significant cybersecurity incidents.

The responsibility for day-to-day management of cybersecurity risks lies with the CISO, Mr. Brett MacKay and Chief Executive Officer, Mr. Sean Whiteford, with assistance from other members of management and contracted information technology consultants. The Company’s contracted information technology consultants consist of experienced professionals in the areas of network security and disaster recovery. This team will be at the forefront of our cybersecurity initiatives, coordinating both internal and external resources to anticipate, identify, and mitigate cyber threats. The Company receives regular updates from our third-party security consultant, leveraging intelligence from various sources, and utilizing advanced security tools to protect our digital environment.