Microvast Holdings, Inc.

Cybersecurity Risk Management and Strategy

We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments, internal IT Audit, IT security, governance, risk and compliance reviews. To defend, detect and respond to cybersecurity incidents, we, among other things: conduct proactive cybersecurity reviews of systems and applications, audit applicable data policies, perform testing to test security controls, conduct employee training, monitor emerging laws and regulations related to data protection and information security and implement appropriate changes as the need arises.

We have implemented incident response and breach management processes which have four overarching and interconnected stages: 1) preparation for a cybersecurity incident, 2) detection and analysis of a security incident, 3) containment, eradication and recovery, and 4) post-incident analysis. Such incident responses are overseen by leaders from our Information Security, Compliance and Legal team regarding matters of cybersecurity. Security events and data incidents are evaluated, ranked by severity and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational and business impact, and reviewed for privacy impact.

Microvast utilizes a set of policies, procedures, and technologies designed to prevent, detect, respond to, and recover from cybersecurity threats and incidents. These policies are regularly reviewed and updated to integrate industry best practices. Internal control evaluations are conducted routinely to ensure compliance and address any identified vulnerabilities.

Our company did not experience any cybersecurity incidents that materially impacted our operations for the year ended December 31, 2025. We remain unaware of any active threats that could significantly affect our business strategy or financial condition. For more information on cybersecurity risks, see “Risk Factors — Risks Related to Our Business and Industry.”

Cybersecurity Governance

Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Our Audit Committee is responsible for the oversight of risks from cybersecurity threats. Members of the Audit Committee receive updates on a quarterly basis from senior management, including leaders from our Information Security, Compliance and Legal teams regarding matters of cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives. Our Board members also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy.

Our cybersecurity risk management and strategy processes are overseen by leaders from our Information Security, Compliance and Legal teams. Such individuals have an average of over 20 years of prior work experience in various roles involving information technology, including security, auditing, compliance, systems, and programming. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to the Audit Committee on any appropriate items.