Corporate Governance Statement 2025

Introduction 3

SSH Communications Security's Administrative Bodies 3

Annual General Meeting 3

Board of Directors 4

Election, Term of Office, and Composition of the Board 4

Board Members 2025 4

Principles Concerning Diversity of the Board of Directors 5

Description of the Operations of the Board of Directors 5

Independence of the Members of the Board 6

CEO and Executive Management Team 7

Executive Management Team Members (composition and holdings per 31 December 2025) 7

Remuneration Statement and Incentive Plans 7

Insider Management 9

Silent Period 9

Internal Auditing and Control 9

Related Party Transactions 10

Risk Management 11

Risk management principles 11

Responsibilities 11

SSH Communications Security´s largest risks and uncertainties 11

Auditors 12

Disclosure Policy 12

Business Ethics and Responsibility 13

Board of Directors (31.12.2025) 15

Executive Management Team (31.12.2025) 17

SSH Communications Security Group comprises of SSH Communications Security Corporation ("SSH") and its subsidiaries. SSH is registered in Helsinki, Finland and is a publicly listed company in Nasdaq Helsinki (SSH1V). Its subsidiaries are SSH Communications Security, Inc. (USA), SSH Government Solutions, Inc. (USA), SSH Communications Security Limited (HK), SSH Communications Security UK Limited (UK), SSH Technology Ltd. (FIN), SSH Operations Ltd. (FIN) which has a branch in Germany, and Kyberleijona Ltd. (FIN, 65% ownership) which owns SSH Secure Collaboration Ltd. (ex. Deltagon Ltd.) (100%).

SSH abides by its Articles of Association as well as principles of transparent and responsible corporate governance, and high ethical standards in its governance and decision-making. The company complies with the Finnish Limited Liability Companies Act, securities market legislation, including the market abuse regulation, rules of Nasdaq Helsinki and Finnish Corporate Governance Code 2025 adopted by the Securities Market Association. This Code is available at https://www.cgfinland.fi.

This Corporate Governance Statement has been composed in compliance with the Corporate Governance Code and securities market legislation. This statement is published as a separate report from the Report of the Board of Directors at SSH's website https://www.ssh.com.

SSH implements a one-tier governance model, where the management of the SSH Group is a responsibility of the General Meeting of shareholders, the Board of Directors, and the CEO. Duties are defined by the Finnish Limited Liability Companies Act and the company´s Articles of Association.

The General Meeting is where shareholders exercise their voting rights and is SSH's highest decision-making body, taking decisions on matters falling within its competence by virtue of the Limited Liability Companies Act and the Articles of Association.

In accordance with the company's Articles of Association, the company has a Board of Directors consisting of five to nine members. The Annual General Meeting (AGM) elects five members to the Board of Directors. In addition, under the Articles of Association, up to four members may be elected to the Board of Directors so that each shareholder holding more than 20 per cent of the Company's outstanding shares has the right to nominate one member to the Board. The Board of Directors appoints the Chief Executive Officer (CEO). The Board of Directors and CEO are responsible for the management of the Group. The Executive Management Team and other management personnel assist the CEO in his or her duties. The Board of Directors decides on the Group's administrative systems and ensures compliance with good governance principles.

The Annual General Meeting is held within six months of the completion of the company's fiscal year, at a time decided by the Board. The AGM decides on matters as required in the provisions of the Limited Liability Companies Act and Articles of Association, such as adoption of the year-end financial statements, profit distribution, and the granting of discharge from liability to the members of the Board of Directors and to the CEO. The AGM also elects five members to the Board of Directors and the auditors and decides their remuneration. Extraordinary general meeting can be called as defined in Limited Liability Companies Act. Each SSH share conveys one vote at the shareholder's meeting. Shareholders have the right to have a matter falling within the

competence of the general meeting under the Limited Liability Companies' Act to be addressed at the general meeting.

In the Extraordinary General Meeting held on 7 August 2025, the provisions of the Articles of Association concerning the number and election of members of the Board of Directors were amended as follows:

The Company shall have a Board of Directors consisting of five to nine members.

Five of the members of the Board of Directors shall be elected by the General Meeting. The term of office of the Board members elected by the General Meeting shall end with the closing of the next Annual General Meeting following their appointment.

Up to four members shall be elected to the Board of Directors so that each shareholder holding more than 20% of the Company's outstanding shares shall have the right to nominate one member to the Board of Directors. The term of office of such a Board member shall commence when the shareholder has notified the Board of Directors of the nomination and shall end when such shareholder nominates a new Board member, removes such Board member, or when such shareholder's ownership interest is no longer more than 20 per cent of the Company's outstanding shares.

The Board has a quorum when more than half of its members are present. The company's Articles of Association do not restrict the members' terms in office or present any specific selection criteria for the members. The Board elects a chairperson from among its members.

The members elected for the Board of Directors in the Annual General Meeting held on 26 March 2025 were Henri Österlund, Kai Tavakka, Christian Fredrikson, Catharina Candolin and Tuomo Louhivuori. On 1 November 2025, in accordance with the changed Articles of Association, Leonardo S.p.A., who owns over 20 per cent of the Company's outstanding shares, appointed Francesco Di Sandro to the Board of Directors.

At the organizing meeting of the Board of Directors after the Annual General Meeting, Henri Österlund was elected as the Chairman of the Board of Directors.

In the current Board of Directors, there is representation from the second largest shareholder which has a successful track record in technology investments, a very experienced expert of international cybersecurity industry, an expert of cybersecurity and defense, a technology executive experienced in services business and the technology sector, and the member appointed by the largest shareholder. 16,7% of the board members are female.

SSH has established principles on diversity in accordance with the Corporate Governance Code's recommendation number 9. SSH's principles on diversity are taken into account when considering nominations to the Board of Directors.

The company needs a wide range of expertise in the Board of Directors, bringing different perspectives to decision-making. The Board's principles of diversity are mainly based on the professional, educational, industry and geographical background of the members, also considering gender and age.

In 2025, the general meeting elected the board members according to the proposal of the largest shareholders (44,7% of the votes). Considering the scope of the company's business, the diversity principles of the board have been realized, as the board has diverse professional expertise from different professional groups in industries relevant to SSH. In particular, the wide geographical background of the board members has been successful, as most of the board members work in international positions and live in different countries. The board members have both genders and different generations, as well as enough members independent of the company or its largest shareholders.

The Board of Directors handles the company's administration and the appropriate arrangement of its operations. The Board also ensures that the supervision of the bookkeeping and asset management is appropriate. The Board makes wide-ranging and strategically important decisions concerning the company.