TEN Holdings, Inc.

We recognize the importance of safeguarding the security of our computer systems, software, networks, and other technology assets. We have implemented cybersecurity measures and protocols for assessing, identifying, and managing material risks from cybersecurity threats, which areintegrated into our overall risk management framework. We aim to ensure a comprehensive and proactive approach to safeguarding our assets and operations.

As a part of our overall risk management, the Company has engaged athird-party service provider to advise as to our maintenance of cybersecurity and risk management. The Company has instituted a comprehensive cybersecurity risk management program that employs various methods to monitor and assess our threat environment and risk profile. These methods include the use of manual and automated tools, conducting scans of the threat environment, evaluating our and our industry’s risk profile, evaluating any threats reported to us and conducting periodic vulnerabilities assessments. We have company-wide policies and procedures in place that further enhance our ability to identify and manage cybersecurity risks. Our employees receive ongoing training under our security policies. Any incidents identified by the third-party service provider are to be reported promptly to the board of directors.

Our management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and, when formally adopted, implementing and maintaining our cybersecurity program.

Although risks from cybersecurity threats have not to date materially affected, and we do not believe they are reasonably likely to materially affect, us, our business strategy, results of operations or financial condition, we may, from time to time, experience threats to and security incidents related to our data and systems. In the year ended December 31, 2024, we didnot detect any cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.