Netskope 10-K cybersecurity disclosure (Item 1C), fiscal 2026

Item 1C. Cybersecurity.

Cybersecurity Risk Management

We maintain a cybersecurity risk management program designed to mitigate risks from cybersecurity threats to our business, products, systems, and data, including risks associated with third-party service providers. Our cybersecurity program provides a foundation for identifying, monitoring, evaluating, and responding to cybersecurity threats and incidents, including those associated with our use of software, applications, services, and cloud infrastructure developed or provided by third-party vendors and service providers. This program includes steps for identifying the source of a cybersecurity threat or incident, including whether such cybersecurity threat or incident is associated with a third-party vendor or service provider: assessing the severity and overall risk of a cybersecurity threat or incident, implementing cybersecurity countermeasures and mitigation or remediation strategies, and informing the relevant members of our senior management team and, when appropriate, the Audit Committee and our Board of Directors.

We engage third parties, including vendors and other external service providers , to support our cybersecurity and data privacy processes. For example, we regularly engage independent third parties for penetration testing and evaluation of our various security

compliance standards. We also conduct internal assessments of our cybersecurity risk management program. We periodically review and update our cybersecurity policies, standards and procedures, including to account for material changes in the threat and operational landscapes, as well as in response to legal and regulatory developments. Our team has established a continuous improvement process through which we regularly update our risk register against the evolving capabilities of adversaries and incorporate findings from internal and external testing. Further, we require mandatory training for all employees and contractors on our cybersecurity and privacy policies. We also have processes to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers. We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that co uld adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. In addition, we perform diligence on our vendors and prospective vendors regarding their cybersecurity posture.

An incident response team is responsible for the monitoring and disposition of potential occurrences such as data breaches, intrusions, and other security incidents and implementing our detailed incident response plan. Our incident response plan includes processes and procedures for assessing potential internal and external threats, activation and notification, and post-incident recovery designed to safeguard the confidentiality, availability, and integrity of our information assets.

In fiscal 2026, and through the filing of this Annual Report on Form 10-K, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business strategy , operating results, and/or financial condition. If we were to experience a material cybersecurity incident in the future, such an incident could potentially have a material effect, including on our business strategy, operating results, or financial condition. For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto, see Part I, Item 1A, "Risk Factors" in this Annual Report on Form 10-K.

Cybersecurity Governance

Our Board of Directors oversees our overall enterprise risk management. Our cybersecurity risk management program is integrated with our overall enterprise risk management and is prioritized for Board oversight through the Audit Committee. The Audit Committee receives periodic updates from our Chief Information Security Officer ("CISO") regarding cybersecurity risks and the Company's cybersecurity program, which may include updates on threat environment, security program initiatives, incident response preparedness, and significant risk areas.

Management is responsible for day-to-day risk management activities, including identifying and assessing cybersecurity risks, establishing processes to ensure that potential cybersecurity risk exposures are monitored, implementing appropriate mitigation or remediation measures, and maintaining cybersecurity programs. Our cybersecurity program is led by our CISO, who regularly reports to senior management and provides updates to the Audit Committee. The CISO works directly with the internal security team to support oversight of cybersecurity risks across the Company.

Our CISO has substantial cybersecurity experience, and has held senior leadership positions at publicly traded companies in the technology industry. The CISO's leadership team, which consists of seasoned information security professionals with experience at globally recognized organizations, works to ensure that we maintain a robust and comprehensive approach to cybersecurity oversight.

It em 2. Properties.

We are headquartered in Santa Clara, California, where we lease approximately 43,000 square feet of office space pursuant to a lease which expires in 2030, with an option to extend for an additional 5-year period up to 2035. We lease additional offices in other locations, including Missouri, the United Kingdom, France, India, Spain, and Taiwan. We also lease space in highly secure colocation facilities for our data centers in over 80 regions across the globe.

We lease all of our facilities and do not own any real property. We believe that our existing facilities are adequate and suitable for our current needs and that, should it be needed, suitable additional or alternative space will be available as and when needed.

Ite m 3. Legal Proceedings.

From time to time, we are involved in various legal proceedings arising from activities in the normal course of business. We are not presently a party to any litigation the outcome of which, we believe, if determined adversely to us, would individually or taken together have a material adverse effect on our business, financial condition, results of operations, and cash flows. Defending any legal

proceedings is costly and can impose a significant burden on management and employees. The results of any current or future litigation cannot be predicted with certainty, and regardless of the outcome, litigation can have an adverse impact on us because of defense and settlement costs, diversion of management resources, and other factors.

It em 4. Mine Safety Disclosures.

Not applicable.