Gloo Holdings, Inc. 10-K cybersecurity disclosure (Item 1C), fiscal 2026

Item 1C. Cybersecurity.

Cybersecurity Risk Management and Strategy

We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our information and information systems.

Our cybersecurity risk management program is designed to align with industry standards such as the American Institute of Certified Public Accountants (AICPA) Trust Services Criteria, the National Institute of Standards and Technology Cybersecurity Framework, International Organization for Standardization (ISO) 27001 standards, and privacy practices aligned to modern data protection regulations. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use these standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

Our cybersecurity risk management program is integrated into our overall risk management program, and shares common methodologies, reporting channels and governance processes that apply across the risk management program to other legal, compliance, strategic, operational, and financial risk areas.

Our cybersecurity risk management program includes controls such as:

•

Data encryption applied using a risk-based approach;

•

Secured hosting infrastructure that employs layered physical, network and operational security controls;

•

Access controls for customer data that are governed by role-based permissions, strong authentication measures and access reviews;

•

Organization safeguards such as privacy and security training and a suite of maintained security policies and procedures;

•

Business continuity and disaster recovery plans;

•

Alerting and response protocols; and

•

Internal audits, vulnerability assessments and penetration testing to validate our cybersecurity posture; and

•

Third-party security measures, including periodic audits and assessments.

In addition, our cybersecurity risk management system includes risk-based processes for identifying, assessing, and

mitigating risks related to vendors and other third parties on which we rely.

We face a number of cybersecurity risks in connection with our business. To date, our business strategy, operating results and financial condition have not been materially affected by cybersecurity incidents. See the section titled " Risk Factors—If we or our third-party service providers experience a cybersecurity breach or other incident, including any breach or incident that allows, or is perceived to allow, unauthorized access to our platform or our data, our reputation and brand, business, financial condition and results of operations could be adversely affected. "

Cybersecurity Governance

Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the Committee) oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program.

The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, where it deems appropriate, regarding cybersecurity incidents.

The Committee reports to the full board of directors regarding its activities, including those related to cybersecurity. M embers of the board of directors receive presentations on cybersecurity topics from our Director of Security & Information Technology (the Director), internal security staff or external experts as part of the board of directors' continuing education on topics that impact public companies. Our management receives briefings from the Director on our cybersecurity risk management program and escalates matters to the Committee or the board of directors as needed.

The Director is primarily responsible for assessing and managing our material risks from cybersecurity threats, supervising both our internal cybersecurity personnel and our retained external cybersecurity consultants. The Director is a credentialed executive with over a decade of leadership in information security, holding multiple professional certifications.

The Director stays informed about and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include: briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.

It em 2. Properties.

Our principal executive offices are located in Boulder, Colorado, where we lease approximately 13,800 square feet of office space. We also lease additional office space in various locations across the United States to support our operations. As of January 31, 2026, we maintained 12 additional leased facilities, including approximately 32,500 square feet in Colorado Springs, Colorado and approximately 20,000 square feet in Joplin, Missouri. We believe our facilities are adequate to meet our current needs. Additionally, we may assume leases when we acquire businesses, and we explore optimization of our overall lease footprint in conjunction with any new leases assumed in an acquisition.

Ite m 3. Legal Proceedings.

We are, and from time to time, may become involved in legal proceedings or be subject to claims arising in the ordinary course of our business. We are not presently a party to any legal proceedings that, in the opinion of our management, if determined adversely to us, would individually or taken together have a material adverse effect on our business, operating results, financial condition or cash flows. We may become involved in legal proceedings in the future, and the outcome of any such matters is inherently uncertain. If an unfavorable outcome were to occur, it could have a material impact on our business or financial results.

It em 4. Mine Safety Disclosures.

Not applicable.