What changed in this filing

/stocks — the workspaceLOADING

Item 1B. Unresolved Staff Comments

2026-02-05 compared with 2025-02-07 · 32 added, 23 removed, 17 unchanged (76% of the section changed)

1 unchanged sentence

CYBERSECURITY

Our business is highly dependent on our information systems, including our ability to operate them effectively and to successfully implement new technologies, methods, and processes, as well as adequate controls and cybersecurity incident recovery plans.

We rely on our information systems to manage our business.

In addition, we must protect the confidentiality and integrity of the data of our business, employees, customers, and other third parties.

Our business involves the collection, processing, storage, and transmission of personally identifiable information and other sensitive and confidential information.

This data is wide-ranging and relates to our employees, customers, and third parties.

Our management, led by our Chief Executive Officer, has the overall responsibility for identifying, assessing and managing any material risks from cybersecurity threats, and our Board of Directors, assists in overseeing and monitoring cybersecurity risks and risk management.

Our cybersecurity posture is designed to comply with key global financial regulations and cybersecurity laws in the jurisdictions in which we operate.

This posture includes taking several proactive steps to prepare for attempts to compromise our information systems.

To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material cybersecurity risks, and protect against, detect, and respond to cybersecurity threats and incidents, we undertake the following activities:

Closely monitor emerging data protection laws and implement changes to our processes designed to comply;

Undertake reviews of our consumer-facing and internal policies and statements related to cybersecurity;

Proactively inform our customers of substantive changes related to customer data handling;

Conduct annual cybersecurity training for all our employees;

Conduct regular phishing email simulations for all employees and all contractors with access to corporate email systems to enhance awareness and responsiveness to such possible threats;

Through policy, practice, and contract (as applicable), require employees, as well as third parties who provide services on our behalf, to treat customer information and data with care;

Update and assess our cybersecurity technologies to address threats and vulnerabilities;

Carry cybersecurity insurance to protect against potential losses from incidents.

Our business is highly dependent on the availability, integrity, and security of our information systems.

These systems support, among other things, our manufacturing operations, retail and e‑commerce activity, point‑of‑sale data flows, influencer marketing infrastructure, and our expanding international operations, including Byrna Technologies Canada.

As our digital footprint and reliance on cloud‑based platforms continue to grow, our exposure to cybersecurity threats increases.

We must protect the confidentiality, integrity, and availability of data related to our business, employees, customers, and third parties.

Our operations involve the collection, processing, storage, and transmission of personally identifiable information and other sensitive or confidential data.

The Company’s cybersecurity risk‑management program is overseen by our Chief Executive Officer and senior management team, including leaders responsible for information technology, operations, finance, and compliance.

These individuals have experience overseeing the implementation of IT controls, evaluating security frameworks, and managing third‑party vendors.

Our Audit Committee oversees cybersecurity as part of its general risk‑oversight responsibilities and receives periodic updates on cybersecurity risks, incidents, and mitigation activities, as appropriate.

Our cybersecurity posture is designed to support compliance with applicable global data‑protection laws and cybersecurity regulations in the jurisdictions in which we operate.

The program incorporates preventive, detective, and responsive measures intended to maintain the availability of critical systems, reduce exposure to material risks, and enhance resiliency.

Key activities include:

Monitoring emerging data-protection and privacy laws and updating internal control processes to support compliance;

Reviewing consumer-facing and internal policies related to cybersecurity and data handling;

Providing communications to customers, where appropriate, regarding substantive changes in data-handling practices;

Conducting annual cybersecurity training for all our employees;

Running regular phishing-simulation exercises for employees and contractors with access to corporate email systems to enhance awareness and responsiveness to such possible threats;

Requiring employees and applicable third -party service providers, through policy and contract, to handle customer information with appropriate care;

Updating, enhancing, and assessing cybersecurity technologies to address evolving threats and vulnerabilities;

Maintaining cybersecurity insurance intended to mitigate potential financial losses arising from cybersecurity incidents.

As we increase our use of artificial‑intelligence‑assisted advertising and analytics tools, we also assess emerging AI‑related cybersecurity risks, including model manipulation, prompt‑based attacks, and data‑ingestion vulnerabilities.

We have begun implementing safeguards and monitoring protocols tailored to these risks.

Cybersecurity Risk Assessment Program

We do not have a formal cybersecurity risk assessment program.

We do not maintain a standalone third -party cybersecurity risk management program.

However, we assess cybersecurity risks associated with third -party service providers through a combination of contractual requirements, reliance on SOC 1 Type 2 or SOC 2 Type 2 reports for materially in-scope applications, internal reviews, and ongoing monitoring where appropriate based on the nature and criticality of the services provided.

Policies and Procedures for Third-Party Service Providers

We do not have specific policies and procedures to oversee, identify, or mitigate the cybersecurity risks associated with our use of third-party service providers, other than relying on SOC 1 Type 2 reports for materially in-scope applications.

We do not maintain a standalone third -party cybersecurity risk management program.

However, we assess cybersecurity risks associated with third -party service providers through a combination of contractual requirements, reliance on SOC 1 Type 2 reports for materially in-scope applications, internal reviews, and ongoing monitoring where appropriate based on the nature and criticality of the services provided.

Activities to Prevent, Detect, and Minimize Cybersecurity Incidents

6 unchanged sentences

updating and assessing our cybersecurity technologies such as our firewall and various cybersecurity software

Cybersecurity Incident Response and Materiality Assessment

We maintain incident response processes designed to enable timely identification, escalation, investigation, and remediation of cybersecurity incidents.

In the event of a cybersecurity incident, management evaluates the materiality of the incident, including its potential impact on our operations, financial condition, results of operations, and reputation, as well as applicable disclosure obligations under federal securities laws.

Impact of Previous Cybersecurity Incidents

At this time, we have not identified any risks from known cybersecurity threats, including as a result of prior cybersecurity incidents, that have materially affected us.

However, we face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us.

Impact on Results of Operations or Financial Condition

Cybersecurity risks and incidents have not materially affected our results of operations or financial condition.

To date, we have not identified any known cybersecurity incidents that have materially affected, or are reasonably likely to materially affect, our business, results of operations, or financial condition.

However, we face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us.

To date, we have not identified any known cybersecurity incidents that have materially affected the Company.

However, we face ongoing cybersecurity risks that, if realized, could materially affect our business, results of operations, or financial condition.

Consideration of Cybersecurity Risks in Business Strategy, Financial Planning, and Capital Allocation

1 unchanged sentence

We regularly review and update our cybersecurity posture to address emerging threats and ensure the protection of our information systems.

However, cybersecurity risks are subject to rapid technological change, evolving threat landscapes, and increasing regulatory scrutiny, and there can be no assurance that our controls and processes will prevent all cybersecurity incidents.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1B. Unresolved Staff Comments