TEN Holdings, Inc.

We recognize the importance of safeguarding the security of our computer systems, software, networks, and other technological assets. We have implemented cybersecurity measures and protocols for assessing, identifying, and managing material risks from cybersecurity threats, which areintegrated into our overall risk management framework. We aim to ensure a comprehensive and proactive approach to safeguarding our assets and operations.

As a part of our overall risk management, the Company has engaged athird-party service provider to advise as to our maintenance of cybersecurity and risk management. The Company has instituted a comprehensive cybersecurity risk management program that employs various methods to monitor and assess our threat environment and risk profile. These methods include the use of manual and automated tools, conducting scans of the threat environment, evaluating our and our industry’s risk profile, evaluating any threats reported to us and conducting periodic vulnerabilities assessments. We have company-wide policies and procedures in place that further enhance our ability to identify and manage cybersecurity risks. Our employees receive ongoing training under our security policies. Any incidents identified by the third-party service provider are to be reported promptly to the Board.

The Head of Technology, with over 15 years of cybersecurity-related experience, is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining our cybersecurity program. The Head of Technology shares weekly and monthly updates with the management team, and in the event a material risk is identified, the management team is notified immediately. The Board, with input from the Head of Technology and other members of the management team, as appropriate, regularly discusses cybersecurity risks at meetings of the Board.

Although risks from cybersecurity threats have not, to date, materially affected us, and we do not believe they are reasonably likely to materially affect us, our business strategy, results of operations or financial condition, we may, from time to time, experience threats to and security incidents related to our data and systems. In the year ended December 31, 2025, we did not detect any cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.