SharonAI Holdings Inc. 10-K cybersecurity disclosure (Item 1C), fiscal 2025

Item

1C. Cybersecurity

Risk

Management and Strategy

We

recognize the importance of assessing, identifying, and managing risks associated with cybersecurity threats. Accordingly, we address

these risks by implementing and maintaining processes, and technologies designed to prevent, detect, and mitigate incidents that could

pose cybersecurity risk. We are equally subject to various cybersecurity risks that could adversely affect our business, financial condition,

and results of operations, including: intellectual property theft; fraud; extortion; harm to employees or customers; interruption of

business activities and activities of our customers; violation of privacy laws; litigation and legal risk; and reputational risk. In

adopting our risk assessment and management program, we are committed to safeguarding our systems and data.

We

have implemented a risk-based approach, guided by Federal Information Processing Standards Publication 199, to identify, classify, and

appropriately assess the range of cybersecurity threats that could affect our business and information systems. We also rely on information

technology and third-party vendors to support our operations, including our secure processing of personal, confidential, sensitive, proprietary,

and other types of information. Our cybersecurity risk management program is integrated into our overall enterprise risk management program,

and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program

to other legal, compliance, strategic, operational, and financial risk areas.

Additionally,

we monitor emerging laws, industry standards, and regulations related to information security and data protection. Although we have not

experienced any cybersecurity incidents or threats that have materially affected or are reasonably likely to materially affect our business

strategy, results of operations, or financial condition to date, and though we are actively monitoring our networks and access points

by implementing security updates regularly, we cannot provide any assurance that there will not be incidents or threats in the future

that may materially affect us, including our business strategy, results of operations, or financial condition .

Our

cybersecurity policies, standards, processes, and practices are regularly assessed and these assessments incorporate various

activities including information security assessments and independent reviews of our information security control environment and

operating effectiveness. We utilize managed detection and response systems, endpoint protection, content filtering aimed at blocking

malware and software to eliminate phishing, ransomware, and fraud. We also utilize multi-factor authentication on all sensitive

applications and information entry-points, review access to data regularly, and have failover-protected business disaster recovery

and backup storage systems. As part of our broader security platform monitoring, we conduct comprehensive vendor risk assessments,

evaluating third-party software and service providers based on their security posture and compliance credentials. Where possible, we

prioritize vendors that maintain externally audited security compliance frameworks, such as SOC 2, ISO 27001, or equivalent

certifications, to ensure that our supply chain and technology ecosystem meet rigorous security standards. The Company conducts

cybersecurity training and testing programs on a structured annual basis, with formal assessments completed at least once per year.

Beyond these scheduled reviews, testing is maintained as a constant and ongoing process, incorporating continuous monitoring,

simulated phishing exercises, and real-time threat evaluation to ensure that our security posture remains adaptive and resilient

throughout the year.

Governance

Pursuant

to our risk management policy, responsibility for the implementation of our risk management policy resides with the Chief Financial Officer .

Management performs a periodic assessment (at least annual) of compliance, financial, IT, and fraud risks. Responses are consolidated

and reviewed with management and the Audit and Risk Management committee . The result of the risk assessment effort is leveraged to formalize

management's operating effectiveness testing plan for the next year. The Audit and Risk Management committee receives an update

on the Company's risk management process, risk trends and any incidents at least annually from the management team . In the event

of any incident, the Company expects to notify the Audit and Risk Management committee immediately, or as soon as possible .

For

additional information regarding cybersecurity risks, see Item 1A "Risk Factors."