FOXO TECHNOLOGIES INC.

Management isresponsible for the day-to-day handling of risks facing our Company, while the Board of Directors, as a whole and through its Audit Committee, oversees risk management, including cybersecurity risks.

We have a risk oversight committee, which is comprised of representatives from our operations management team, information technology and compliance functions. The committee assesses risks based on probability and potential impact on key business systems and processes. We have implemented multiple layers of security measures designed to protect the confidentiality, integrity and availability of our data. In addition, we engage athird-party service provider to actively monitor potential threats as well as our security defenses. The effectiveness of the cyber and information security program is tested through a combination of internal and external assessments. Updates are provided to senior management and the Audit Committee.

We have established processes to assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities, and test those systems pursuant to our cybersecurity policies, processes, and practices, which are integrated into our overall risk management program. In an effort to protect our information systems from cybersecurity threats, we have implemented information security and incident response policies as well as operating procedures. We also use various security tools that are designed to help us identify risks from cybersecurity threats, and escalate, investigate, resolve, and recover from cybersecurity incidents in a timely manner.

We face several cybersecurity risks in connection with our business. While cybersecurity threats, including those resulting from any previous cybersecurity incidents, have not materially affected, and we do not believe they are reasonably likely to materially affect, our Company, including our business strategy, results of operations, or financial condition, to date, we have, like other companies in our industry, from time to time, experienced threats and cybersecurity incidents relating to our, and our third-party vendors’, data and information systems. However, there can be no assurance that our controls and procedures in place to monitor and mitigate the risks of cyber threats, including the remediation of critical information security and software vulnerabilities, will be sufficient and/or timely and that we will not suffer material losses or consequences in the future. Additionally, we do not have in place insurance coverage designed to address certain aspects of cyber risks.