End User Terms of Service

Preamble

These Terms of Service (“End User Terms”) govern the use of the Managed Services and the
Counter Threat Operating System Platform dashboard (“CTOS Platform”) provided by iCOUNTER, Inc. (“iCOUNTER”). “End User” means the business or other legal entity identified in an order form or service description for the Managed Services (each, an “Order Form”), together with its
authorized employees, contractors, and agents (“Authorized Users”). The individual accepting
these End User Terms represents that the individual has authority to bind the End User. By clicking to accept these End User Terms or accessing or using the Managed Services or the CTOS Platform after being presented with these End User Terms, the End User agrees to be bound by them.

1. Managed Services

iCOUNTER will provide the End User with managed third-party threat detection and response services, which perform continuous reconnaissance across the End User's extended third-party ecosystem using human intelligence, technical intelligence, and adversary infrastructure monitoring.

The Managed Services include: (a) Validated Connectivity Inventory: enumeration of third parties based on verified bi-directional data exchange; (b) Risk Intelligence: identification of active or imminent third-party compromise using AI-assisted intelligence; (c) Prescriptive Remediation: actionable countermeasures with defensible evidence for third parties to take corrective actions; (d) CTOS Platform Access: iCOUNTER will provide the End User access to the CTOS Platform for the purpose of monitoring risk events, communications, and mitigations; (e) Managed Service Delivery: iCO UNTER analysts manage the CTOS Platform to track risk events, communicate with impacted third parties, and track third-party mitigations; and (f) Quarterly Business Reviews: quarterly reviews summarizing alerts, mitigations, and current risk profile.

iCOUNTER may modify the CTOS Platform to improve security, usability, or functionality, providedvthat (a) such modifications will not decrease the functionality or level of security of the CTOS Platform, and (b) iCOUNTER will provide the End User with reasonable advance written notice of any material modifications.

2. Platform Access and Restrictions

(a) Access. iCOUNTER grants the End User and its Authorized Users a nonexclusive, non-
transferable, non-sublicensable right to access and use the dashboard interface within the CTOS Platform during the subscription term for the purpose of monitoring risk events, trackingmitigations, and managing communications related to the End User’s third-party ecosystem,including sharing relevant alerts, risk information, and mitigation requirements with monitoredthird parties. The End User is responsible for its Authorized Users’ compliance with these EndUser Terms. The End User may not disclose or make available to any third party any iCOUNTERProprietary Technology or any other iCOUNTER confidential information accessible through theCTOS Platform.

(b) Restrictions. The End User will not, and will not permit any third party to:

• reverse engineer, decompile, disassemble, or attempt to derive the source code,
  algorithms, or underlying structure of the CTOS Platform;
• copy, modify, or create derivative works based on the CTOS Platform;
• use the CTOS Platform or the Managed Services to develop a product or service that
  competes with the CTOS Platform or the Managed Services;
• sublicense, resell, or distribute access to the CTOS Platform;
• remove or alter any proprietary notices on the CTOS Platform;
• use any data, intelligence, reports, outputs, or other materials provided by
  iCOUNTER for the purpose of training, developing, or refining any artificial intelligence or
  machine learning model; or
• allow any direct competitor of iCOUNTER to access, use, or view the CTOS Platform
  or the Managed Services.

These restrictions survive expiration or termination of these End User Terms. The End User is responsible for maintaining the confidentiality of account credentials and must promptly notify iCOUNTER of any suspected unauthorized access. iCOUNTER may suspend access to the Managed Services or the CTOS Platform to prevent or address a security threat, suspected misuse, or violation of these End User Terms, provided that iCOUNTER will use commercially reasonableefforts to give notice and restore access promptly after the applicable issue is resolved.

‍3. Intelligence Disclaimer

The End User acknowledges that the Managed Services and the CTOS Platform provide cyber
threat intelligence designed to supplement, and not replace, the End User’s own cybersecurity
program.

No threat intelligence service can guarantee identification or prevention of all threats. Intelligence outputs may contain errors, inaccuracies, incomplete information, or false positives, and iCOUNTER does not warrant the accuracy, completeness, or timeliness of any intelligence, report, alert, risk determination, or other output.

The End User is solely responsible for maintaining its own information security program and for
any decisions or actions taken based on information provided through the Managed Services or the CTOS Platform. iCOUNTER does not provide data breach notification services. Mandatory or contractual reporting requirements remain the End User’s responsibility.

With respect to remediation, iCOUNTER’s obligation is limited to providing actionable mitigation guidance and recommended remediation steps to the End User. iCOUNTER is not responsible for implementing remediation actions on behalf of the End User or any monitored third party, and nothing in these End User Terms or any Order Form creates an obligation for iCOUNTER to take direct action on any network, system, or application belonging to the End User or a monitored third party.

4. Intellectual Property

(a) Ownership. "iCOUNTER Proprietary Technology" means the CTOS Platform, and all software (including source and object code), algorithms, machine learning models, threat intelligence data, databases, trade secrets, know-how, methodologies, platform architecture, intermediary work products, and all related technology used by iCOUNTER to provide the Managed Services, and all modifications, enhancements, and improvements thereto. iCOUNTER retains all right, title, and interest in and to the iCOUNTER Proprietary Technology. Nothing in these End User Terms conveys any ownership interest in the foregoing to the End User.

(b) Feedback. Any feedback, suggestions, or enhancement requests the End User provides
regarding the Managed Services or the CTOS Platform (“Feedback”) is non-confidential and may
be used by iCOUNTER for any purpose without acknowledgment or compensation. The End User
hereby assigns to iCOUNTER all right, title, and interest in any Feedback.

5. Confidentiality

(a) Each party will hold the other party’s confidential information in confidence using at least reasonable care and will not disclose it except as necessary to perform under these End User Terms or as required by law. If disclosure is required by law, the receiving party will, to the extent legally permitted, provide the disclosing party with prompt written notice and reasonable
assistance, at the disclosing party’s expense, in seeking confidential treatment or a protective
order. Without limiting the foregoing, iCOUNTER confidential information includes the iCOUNTER
Proprietary Technology, pricing, discount structures, and security documentation, and End User confidential information includes Customer Data.

(b) Confidential information excludes information that: (i) is or becomes publicly available without
breach; (ii) was independently developed without use of the disclosing party’s confidential
information; (iii) was received from a third party without restriction; or (iv) was previously known to
the receiving party. Each party’s confidentiality obligations will continue during the subscription
term and for five (5) years thereafter, except that obligations relating to trade secrets will continue
for so long as the information remains a trade secret under applicable law.

6. Data

(a) Customer Data. The End User retains ownership of data it provides to iCOUNTER or uploads to the CTOS Platform (“Customer Data”). iCOUNTER will use Customer Data solely to provide the Managed Services.

(b) Threat Intelligence. Threat intelligence observed or collected by iCOUNTER in the course of providing the Managed Services, including adversary tactics, techniques, procedures, and indicators of compromise, is not Customer Data and remains iCOUNTER’s property.

(c) Aggregated Data. iCOUNTER may use aggregated, de-identified data that does not identify the End User for product improvement and benchmarking purposes.

(d) Data Export and Deletion. Upon the End User’s written request made prior to or within thirty
(30) days after expiration or termination of the subscription term, iCOUNTER will make Customer
Data available for export in a commonly used format. Following expiration of such thirty (30) day
period, iCOUNTER may delete Customer Data in accordance with its standard retention practices
and will delete Customer Data upon the End User’s written request, except to the extent retention is required by law or the Customer Data remains in routine backups that are protected from further use and deleted in the ordinary course. Upon request, iCOUNTER will provide written confirmation of deletion.

(e) Data Security and Privacy. iCOUNTER will maintain commercially reasonable administrative,
technical, and physical safeguards designed to protect Customer Data against unauthorized
access, use, alteration, or disclosure. iCOUNTER will notify the End User without undue delay
after confirming unauthorized access to or acquisition of Customer Data in iCOUNTER’s
possession or control and will provide information reasonably necessary for the End User to
assess and respond to the incident. If iCOUNTER processes personal information on the End
User’s behalf, the parties will enter into any data processing addendum reasonably required by
applicable law. iCOUNTER’s collection and use of personal information through its websites and
the CTOS Platform are also subject to its then-current Privacy Policy.

7. Warranties and Disclaimers

(a) iCOUNTER warrants that it will provide the Managed Services in a professional and
workmanlike manner consistent with industry standards. iCOUNTER warrants that the CTOS
Platform will perform in substantial conformity with the applicable documentation during the
subscription term.

(b) EXCEPT AS SET FORTH IN SECTION 7(a), iCOUNTER PROVIDES THE MANAGED SERVICES AND THE CTOS PLATFORM “AS IS.” iCOUNTER DISCLAIMS ALL OTHER WARRANTIES, EXPRESS, IMPLIED, OR STATUTORY, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, ACCURACY, COMPLETENESS, TIMELINESS, AND NONINFRINGEMENT.

8. Limitation of Liability

(a) NEITHER PARTY WILL BE LIABLE TO THE OTHER FOR ANY INDIRECT, SPECIAL, INCIDENTAL, CONSEQUENTIAL, PUNITIVE, OR EXEMPLARY DAMAGES, INCLUDING LOST PROFITS, LOST DATA, OR BUSINESS INTERRUPTION, ARISING OUT OF OR RELATED TO THESE END USER TERMS, REGARDLESS OF THE THEORY OF LIABILITY.

(b) EACH PARTY’S TOTAL AGGREGATE LIABILITY UNDER THESE END USER TERMS WILL NOT EXCEED THE FEES PAID OR PAYABLE FOR THE MANAGED SERVICES DURING THE TWELVE (12) MONTHS PRECEDING THE EVENT GIVING RISE TO THE CLAIM.

9. Indemnification

(a) By iCOUNTER. iCOUNTER will indemnify, defend, and hold harmless the End User from any
third-party claim that the Managed Services or the CTOS Platform as provided infringe a third
party’s intellectual property rights. iCOUNTER will have no obligation to the extent a claim arises
from: (1) modification of the Managed Services or the CTOS Platform by a party other than
iCOUNTER; (2) use in combination with products, services, or materials not provided or approved
by iCOUNTER; (3) use contrary to these End User Terms or applicable documentation; (4)
continued use after iCOUNTER provides notice to discontinue use; or (5) Customer Data or
specifications provided by the End User. If iCOUNTER determines that an infringement claim is likely, iCOUNTER may, at its option and expense: (A) obtain a license for the End User to continue using the affected component; (B) replace or modify the affected component to make it non-infringing; or (C) if neither of the foregoing is commercially practicable, terminate the affected subscription and refund any prepaid fees covering the remainder of the subscription term. This Section 9(a) states iCOUNTER’s entire obligation and the End User’s exclusive remedy for any intellectual property infringement claim.

(b) By End User. The End User will indemnify, defend, and hold harmless iCOUNTER from any
third-party claim arising out of (i) the End User’s breach of Section 2(b) (Restrictions) or Section 5 (Confidentiality), (ii) the End User’s violation of applicable law, or (iii) the End User’s gross
negligence or willful misconduct.

(c) Procedures. The indemnified party will provide prompt written notice and grant the indemnifying party sole control of the defense and settlement, with reasonable cooperation at the indemnifying party’s expense. The indemnifying party may not settle a claim in a manner that admits fault by, imposes nonmonetary obligations on, or fails to provide an unconditional release to the indemnified party without the indemnified party’s prior written consent, which may not be unreasonably withheld, conditioned, or delayed.

10. Term and Termination

(a) Term. These End User Terms are effective upon the End User’s acceptance of these End User Terms or first access to the Managed Services or the CTOS Platform, whichever occurs first, and continue for the duration of the subscription term specified in the applicable Order Form, including any renewals.

(b) Termination for Cause. Either party may terminate these End User Terms upon thirty (30) days’ written notice if the other party materially breaches and fails to cure within the notice period.

(c) Effect of Termination. Upon termination, the End User’s access to the CTOS Platform will
cease. Sections 2(b) (Restrictions), 3 (Intelligence Disclaimer), 4 (Intellectual Property (Confidentiality), 6 (Data), 7(b) (Disclaimers), 8 (Limitation of Liability), 9 (Indemnification), and 11
(General Provisions) survive termination to the extent necessary to give them effect.

11. General Provisions

(a) Governing Law. These End User Terms are governed by the laws of the State of Texas, without regard to conflict of laws principles. Each party consents to the exclusive jurisdiction and venue of the state and federal courts located in Dallas, Texas.

(b) Entire Agreement. These End User Terms, together with the applicable Order Form and any
policies or addenda expressly incorporated by reference, constitute the entire agreement
between the parties regarding the End User’s use of the Managed Services and the CTOS Platform
and supersede all prior or contemporaneous communications and agreements regarding that
subject matter. If there is a conflict, the applicable Order Form will control over these End User
Terms only to the extent the Order Form expressly identifies the provision of these End User Terms that it overrides.

(c) Severability. If any provision is held unenforceable, the remaining provisions remain in full force and effect.

(d) No Waiver. No failure or delay in exercising any right operates as a waiver of that right.

(e) Notices. All notices must be in writing and sent to the addresses specified in the applicable
Order Form or, in the case of notices to iCOUNTER, by email to iCOUNTER’s Legal Department at
legal@iCOUNTER.com.

(f) Assignment. The End User may not assign or transfer these End User Terms, by operation of law
or otherwise, without iCOUNTER's prior written consent. iCOUNTER may assign these End User
Terms to an affiliate or in connection with a merger, reorganization, sale of substantially all
assets, or similar transaction. Any attempted assignment in violation of this Section is void.

(g) Force Majeure. Neither party will be liable for delay or failure to perform caused by
circumstances beyond its reasonable control, including natural disasters, acts of government,
labor disputes, internet or telecommunications failures, utility failures, civil unrest, war,
terrorism, or cyberattacks, except that this Section does not excuse payment obligations.

(h) Relationship. The parties are independent contractors. These End User Terms do not create
any partnership, joint venture, agency, fiduciary, or employment relationship between the parties.

(i) No Third-Party Beneficiaries. These End User Terms do not confer any rights or remedies on any person or entity other than the parties and their permitted successors and assigns.

(j) Export Controls and Sanctions. The End User will not access or use the Managed Services or
the CTOS Platform in violation of applicable export control, economic sanctions, or import laws and regulations, or permit access or use by any person or entity prohibited under such laws and regulations.

(k) Changes to These End User Terms. iCOUNTER may update these End User Terms from time to time. iCOUNTER will provide reasonable advance notice of any material update, and the updated End User Terms will apply upon the effective date stated in the notice or upon the End User's acceptance, as applicable. Changes will not apply retroactively unless required by law or agreed by the End User.

(l) Electronic Communications and Acceptance. The End User consents to receive notices and
other communications electronically at the email address specified in the applicable Order Form
or associated with the End User’s account. Electronic acceptance of these End User Terms has the same effect as a handwritten signature.