What changed in this filing

/stocks — the workspaceLOADING

Item 1B. Unresolved Staff Comments

2026-04-15 compared with 2025-04-15 · 87 added, 68 removed, 2 unchanged (99% of the section changed)

UNRESOLVED STAFF COMMENTS

a smaller reporting company, we are not required to provide this information.

As a smaller reporting company,

we are not required to provide this information.

CYBERSECURITY

Aerospace maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats.

This program, in conjunction with the Company’s enterprise risk management assessment processes, addresses cybersecurity risks

to the corporate information technology (“IT”) environment including systems, hardware, software, data, people, and processes.

underlying processes and controls of the XTI Aerospace’s cyber risk management program incorporate recognized best practices and

standards for cybersecurity and IT, including the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework

(“CSF”) and processes and controls supporting EU general data protection regulation requirements.

XTI Aerospace has an annual

assessment performed by a third-party specialist of the Company’s cyber risk management program against the NIST CSF.

risk assessment identifies, quantifies, and categorizes material cyber risks.

In addition, the Company, in conjunction with the third-party

cyber risk management specialists develop a risk mitigation plan to address such risks, and where necessary, remediate potential vulnerabilities

identified through the annual assessment process.

addition, XTI Aerospace maintains policies and procedures over areas such as information security, IT change and configuration management,

acceptable use, access on/offboarding, accounts management, risk management, and data backup and recovery to help govern the processes

put in place by management designed to protect XTI Aerospace’s IT assets, data, and services from threats and vulnerabilities.

XTI Aerospace partners with industry recognized cybersecurity providers leveraging third-party technology and expertise.

These cybersecurity

partners to the Company, including consultants and other third-party service providers, are a key part of XTI Aerospace’s

cybersecurity risk management strategy and infrastructure and provide services including, maintenance of an IT assets inventory, periodic

vulnerability testing, identity access management controls including restricted access of privileged accounts, physical security measures

at Company facilities, information protection/detection systems including maintenance of firewalls and anti-malware tools, network and

traffic monitoring and automated alerting, ongoing cybersecurity user awareness training, industry-standard encryption protocols, capacity

management, formalized processes over asset and data destruction, formalized change management processes, data backups management, infrastructure

maintenance, incident response, cybersecurity strategy, and cyber risk advisory, assessment and remediation.

Aerospace’s management team, with the Executive Vice President of IT Operations in charge of primary oversight , in conjunction

with third-party IT and cybersecurity service providers is responsible for oversight and administration of XTI Aerospace’s cyber

risk management program, and for informing senior management and other relevant stakeholders regarding the prevention, detection, mitigation,

and remediation of cybersecurity incidents.

The Company’s management team has prior experience selecting, deploying, and overseeing

cybersecurity technologies, initiatives, and processes directly or via selection of strategic third-party partners, and also relies on

threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants

engaged by XTI Aerospace for strategic cyber risk management, advisory and decision making.

Our Executive Vice President of IT Operations

has over 25 years of experience serving in various roles in information technology and information security and has relevant experience

in designing, deploying, and maintaining operations for critical IT systems, cloud infrastructure, virtualization technology, corporate

networks, data protection, privacy, and governance.

Aerospace has implemented third-party risk management processes to manage the risks associated with reliance on vendors, critical service

providers, and other third-parties that may lead to a service disruption or an adverse cybersecurity incident.

This includes a third-party

risk management policy which outlines required risk management processes, including assessment of vendors during the selection/onboarding

process, review of SOC 1 reports on an annual basis, and a regular review of vendor contracts and compliance with service level agreements.

Audit Committee of the Board of Directors oversees XTI Aerospace’s cybersecurity risk exposures and the steps taken by management

to monitor and mitigate cybersecurity risks.

The cybersecurity stakeholders, including member(s) of management assigned with cybersecurity

oversight responsibility and/or third-party consultants providing cyber risk services brief the Audit Committee on cyber vulnerabilities

identified through the risk management process, the effectiveness of XTI Aerospace’s cyber risk management program, and the emerging

threat landscape and new cyber risks on at least an annual basis.

This includes updates on XTI Aerospace’s processes to prevent,

detect, and mitigate cybersecurity incidents.

In addition, cybersecurity risks are reviewed by XTI Aerospace’s Board of Directors

at least annually, as part of the Company’s corporate risk oversight processes.

Aerospace faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results

of operations, cash flows or reputation.

XTI Aerospace acknowledges that the risk of cyber incidents is prevalent in the current threat

landscape and that a future cyber incident may occur in the normal course of its business.

However, prior cybersecurity incidents have

not had a material adverse effect on XTI Aerospace’s business, financial condition, results of operations, or cash flows.

Company proactively seeks to detect and investigate unauthorized attempts and attacks against IT assets, data, and services, and

to prevent their occurrence and recurrence where practicable through changes or updates to internal processes and tools and changes or

updates to service delivery;

however, potential vulnerabilities to known or unknown threats will remain.

Further, there is increasing

regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders,

which could subject the Company to additional liability and reputational harm.

In response to such risks, the Company has implemented

initiatives such as implementation of the cybersecurity risk assessment process and development of an incident response plan.

“Risk Factors” for more information on cybersecurity risks.

Risk Management and Strategy

We maintain a cybersecurity

risk management program designed to identify, assess, manage, mitigate and respond to cybersecurity threats.

This program is integrated

into our broader enterprise risk management processes and addresses risks to our corporate information technology (“IT”) environment,

including systems, networks, hardware, software, data, personnel and operational processes.

Our cybersecurity program

incorporates recognized industry standards and best practices, including alignment with the National Institute of Standards and Technology

(“NIST”) Cybersecurity Framework (“CSF”).

We also consider applicable data protection and privacy regulations

in jurisdictions in which we operate.

We engage independent third-party specialists to perform periodic assessments of our cybersecurity

program, including evaluations against the NIST CSF and vulnerability testing.

These assessments are designed to identify, quantify and

categorize cyber risks and potential vulnerabilities.

Based on the results of such assessments, management develops and implements risk

mitigation and remediation plans, as appropriate.

We maintain policies and

procedures governing areas such as information security, acceptable use, identity and access management, onboarding and offboarding,

change and configuration management, risk management, data protection, backup and recovery, and incident response.

We also utilize third-party

cybersecurity service providers and technology solutions to support our cybersecurity operations, including services related to:

● asset inventory management;

● network security, firewalls and endpoint protection;

● intrusion detection, monitoring and automated

● identity and privileged access management;

● vulnerability scanning and periodic testing;

● employee cybersecurity awareness training;

● encryption and data protection protocols;

● cloud infrastructure security;

● incident response support;

● cybersecurity advisory and remediation services.

Because we rely on third-party

vendors, cloud providers and service partners in our operations, we maintain a third-party risk management process designed to assess

and monitor cybersecurity risks associated with critical service providers.

This includes vendor due diligence during onboarding, review

of available independent audit reports (such as SOC reports, where applicable), evaluation of contractual security provisions, and ongoing

monitoring of vendor performance and risk posture.

Despite these efforts, we

cannot eliminate all cybersecurity risks.

The threat landscape continues to evolve, and our systems and those of our third-party providers

may be vulnerable to unauthorized access, disruption or compromise.

Management Oversight

Management is responsible for

the day-to-day oversight and administration of our cybersecurity risk management program.

The Company utilizes a senior technology advisor

as a consultant with primary responsibility for cybersecurity oversight.

This individual has extensive experience in information technology

and cybersecurity.

The senior technology advisor,

together with internal personnel and external cybersecurity service providers, oversees the prevention, detection, mitigation and remediation

of cybersecurity incidents.

Management receives information from internal monitoring tools, third-party service providers, vulnerability

assessments, and threat intelligence sources, including governmental and private sector resources.

We maintain an incident response

plan designed to provide a structured framework for identifying, escalating, investigating and responding to cybersecurity incidents,

including processes to assess materiality and comply with applicable legal and regulatory reporting requirements.

Board Oversight

The Audit Committee of our

Board of Directors oversees cybersecurity risk exposure and management’s efforts to monitor and mitigate cybersecurity risks.

and, as appropriate, external cybersecurity advisors provide periodic briefings to the Audit Committee regarding :

● the effectiveness and status of our cybersecurity

● significant cybersecurity risks and vulnerabilities;

● emerging threat developments;

● cybersecurity incidents, if any, and related

response efforts.

While the Board retains ultimate

oversight responsibility for cybersecurity risk as part of its broader enterprise risk management function, it has delegated primary committee-level

oversight to the Audit Committee, which reports to the Board on these matters.

Cybersecurity Risks and Incidents

We face risks from cybersecurity

threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation.

These risks include, among others, ransomware attacks, business email compromise, supply chain attacks, insider threats, and data breaches

affecting sensitive business, customer or employee information.

To date, we have not identified

any cybersecurity incidents that have materially affected, or are reasonably likely to materially affect, our business strategy, results

of operations or financial condition.

However, future incidents could occur, and there can be no assurance that our cybersecurity risk

management measures will prevent or mitigate all potential incidents.

In addition, evolving cybersecurity

and data protection regulations may impose additional compliance, reporting and governance obligations on us, potentially increasing our

costs and exposure to liability.

For additional information

regarding cybersecurity-related risks, see Item 1A.

“Risk Factors.”

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1B. Unresolved Staff Comments