1 unchanged sentence
Cybersecurity
+Added: The following discussion of our cybersecurity program reflects conditions as of December 31, 2025, including significant enhancements implemented in response to the August 2025 cybersecurity incident described below.
+Added: On August 16, 2025, the Company was the subject of a targeted ransomware incident affecting certain internal IT systems.
+Added: Upon discovering the incident, the Company promptly activated its response protocols and implemented containment measures, including proactively shutting down most operating systems globally to manage the safety of the overall global systems environment.
+Added: The Company engaged leading cybersecurity experts to support system recovery and conduct a comprehensive forensic investigation.
+Added: The investigation determined that the attack originated through a vulnerability in a commercially available third-party firewall service provider and was not specifically targeted at Data I/O.
+Added: By September 2025, the incident had been completely contained and remediated, all global systems were restored, and the Company does not believe it has any remaining risk exposure from the incident.
+Added: The remediation and associated professional fees resulted in approximately $388,000 of one-time costs, primarily recorded in the third quarter of 2025.
+Added: The incident was reported on Form 8-K filed with the SEC on August 21, 2025.
+Added: As an outcome of the incident, the Company’s IT systems and cybersecurity posture were strengthened, with improved corporate processes and enhanced security infrastructure.
+Added: Remediation actions included enhancements to system access controls, improved network segmentation, migration of critical systems to cloud-based solutions, and expanded monitoring and review procedures.
+Added: See “Risk Factors - Cybersecurity incidents could result in loss of revenue, business disruptions, remediation costs, legal claims and proceedings, regulatory actions, reporting delays, increased insurance costs, or damage to the Company’s reputation which could adversely impact or operations and financial results.”
CYBERSECURITY GOVERNANCE
1 unchanged sentence
The Audit Committee of the Board of Directors is responsible for board-level oversight of cybersecurity risk.
−Removed: however, the full Board is typically present for Information Technology (IT) and Cybersecurity briefings.
−Removed: As part of its oversight role, the Audit Committee receives reporting about the Company’s cybersecurity program, activities, threats and incidents (if any) through periodic updates.
−Removed: The cybersecurity program is managed by our outsourced IT infrastructure team with oversight and coordination by our CFO, who reports directly to our CEO.
−Removed: Utilization of an outsourced IT infrastructure team allows Data I/O to access the necessary breadth and depth of leading cybersecurity programs, staff, expertise, and tools.
−Removed: The IT infrastructure team monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of the cybersecurity function, including the operation of the Company’s incident response plans, which include appropriate escalation to the CFO, CEO and the Audit Committee.
+Added: The cybersecurity program is managed by our outsourced IT infrastructure team with oversight and coordination by our CFO, Charles DiBona, who reports directly to our CEO.
+Added: During the third quarter of 2025, in connection with the appointment of Charles DiBona as Chief Financial Officer, the Company formalized CFO oversight of the cybersecurity program.
+Added: Following the August 2025 ransomware incident, the Audit Committee increased the frequency of cybersecurity reporting and the Company enhanced its incident response protocols.
+Added: The cybersecurity program is managed by the Company’s new outsourced IT infrastructure team, which provides 24/7 monitoring and response capabilities, with oversight and coordination by the CFO, who reports directly to the CEO.
+Added: The Audit Committee receives regular updates on cybersecurity matters, including threat assessments, incident response activities, and the status of remediation efforts.
CYBERSECURITY RISK MANAGEMENT AND STRATEGY
−Removed: The Company has processes in place to identify, assess, and monitor material risks from cybersecurity threats, which are part of the Company’s overall cybersecurity risk management and have been embedded in the information systems operating procedures and internal controls.
−Removed: Our IT function manages IT operations and continually evolves and enhances our systems to meet the constantly changing digital environment.
−Removed: Periodic cybersecurity risk assessments are performed to identify, assess, and prioritize potential risks to information, data assets, infrastructure and third-party vendors.
−Removed: The Company addresses significant risks through corrective or mitigating actions as necessary.
−Removed: The Company has also established cybersecurity and information security awareness training programs.
−Removed: Employees with access to the Company’s network receive annual training on topics such as phishing, malware, and other cybersecurity risks.
−Removed: Training is administered and tracked through online learning modules with ongoing follow-up testing.
−Removed: All employees and contractors enter into non-disclosure confidentiality agreements.
−Removed: We work to continually evolve our systems to meet the constantly changing digital environment and continue to invest in the cybersecurity and resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain.
−Removed: There have been no risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition.
−Removed: The nature of potential cybersecurity risks and threats are uncertain, and any future incidents, outages or breaches could have a material adverse effect on the Company’s business, financial conditions or results of operations.
−Removed: For more information about the cybersecurity risks we face, refer to the Risk Factors in section “Cybersecurity Risks” in Part I, Item 1A, "Risk Factors".
+Added: The Company’s cybersecurity risk management program is integrated into its overall enterprise risk management framework.
+Added: Following the August 2025 ransomware incident, the Company significantly enhanced its cybersecurity risk management processes.
+Added: These enhancements included:
+Added: patching the third-party firewall service provider through which the attack originated and evaluating replacement providers;
+Added: implementing improved network segmentation and access controls;
+Added: expanding endpoint detection and response capabilities;
+Added: enhancing backup and disaster recovery procedures;
+Added: conducting comprehensive vulnerability assessments across all IT systems;
+Added: and providing additional cybersecurity awareness training to all employees.
+Added: The Company also engaged independent cybersecurity consultants to review and validate the effectiveness of its enhanced security posture.
+Added: As of September 30, 2025, all remediation activities had been completed and all global systems had been restored to full operational status.
+Added: The Company continues to assess and adapt its cybersecurity risk management practices to address evolving threats.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.