Financial Statements 2025

Financial Statements and Report of the Board of Directors

‌TABLE OF CONTENTS

TABLE OF CONTENTS 2

REPORT OF THE BOARD OF DIRECTORS FOR 1 JAN - 31 DEC 2025 3

CONSOLIDATED FINANCIAL STATEMENTS 15

CONSOLIDATED COMPREHENSIVE INCOME STATEMENT 16

CONSOLIDATED STATEMENT OF FINANCIAL POSITION 17

CONSOLIDATED CASH FLOW STATEMENT 19

STATEMENT OF CHANGES IN CONSOLIDATED EQUITY 20

NOTES TO THE CONSOLIDATED FINANCIAL STATEMENTS 22

PARENT COMPANY FINANCIAL STATEMENTS 55

PARENT COMPANY INCOME STATEMENT 56

PARENT COMPANY STATEMENT OF FINANCIAL POSITION 57

PARENT COMPANY STATEMENT OF FINANCIAL POSITION 58

PARENT COMPANY CASH FLOW STATEMENT 59

NOTES TO THE PARENT COMPANY FINANCIAL STATEMENTS 60

DIVIDEND PROPOSAL AND SIGNATURES 69

‌Report of the Board of Directors for 1 Jan - 31 Dec 2025

Consolidated net sales for January-December totaled EUR 21.6 (EUR 22.2 million), a decrease of 2.4%, year on year.

A significant part of SSH Communications Security's invoicing is US dollar-based. On average the

U.S. dollar has weakened 4.4% against the euro in 2025, while in 2024 the exchange rate remained relatively stable. With comparable exchange rates, in 2025 the year-to-date net sales decrease was 0.8% compared to 2024.

Operating loss for the financial year amounted to EUR -2.2 million (EUR -0.3 million), with net loss totaling EUR -2.3 million (EUR -0.8 million).

Sales, marketing, and customer support expenses amounted to EUR -9.4 million (EUR -9.2 million), while research and development expenses totaled EUR -9.9 million (EUR -8.9 million) and administrative expenses EUR -4.6 million (EUR -4.6 million). Operating expenses increased by 504

% compared to the previous year.

The financial position of SSH Communications Security was improved during the financial year, primarily due to the investment made by Leonardo S.p.A. in the company. The consolidated balance sheet total on December 31, 2025, stood at EUR 47.4 million (EUR 30.1 million), of which cash and cash equivalents accounted for EUR 11.0 million (EUR 2.9 million), or 23.1% of the balance sheet total. In 2025, the company's short-term liquid assets amounted to EUR 10.0 million, while in 2024 the company held no such investments. As of the reporting date, the company has fully repaid all interest-bearing loans, including a premium loan from Elo Mutual Pension Insurance Company, amounting to EUR 0.75 million. On December 31, 2025, gearing, or the ratio of net liabilities to shareholders' equity, was -38.2% (-8.9%), and the equity ratio stood at 78.7% (52.8%).

The reported gross capital expenditure for January-December totaled EUR 0.4 million (EUR 1.5 million). The reported financial income and expenses of EUR -0.4 million (EUR -0.3 million) consisted mainly of exchange rate gains or losses, interest expenses, interest expenses arising from revenue contracts, and interest on lease liabilities.

The Group had a cash flow of EUR 1.1 million (EUR 2.7 million) from business operations, and investments showed a cash flow of EUR -10.1 million (EUR -1.4 million). Cash flow from investments includes investment in financial assets of EUR -10.0 million (EUR 1.5 million) and receiving government grants of EUR 0.3 million (EUR 0.3 million). Cash flow from financing totaled EUR 17.2 million (EUR -0.6 million). Cash flow from financing includes EUR 20.0 million received from the directed share issue to Leonardo S.p.A, a change in debt of EUR -0.75 million (EUR -0.5 million), and proceeds from shares subscribed with option rights of EUR 0.6 million (EUR 0.3 million). During 2025, the Group repurchased 2.2 million of the principal from the hybrid instrument and paid

0.4 million interest related to the repurchase of the principal. Total cash flow from operations, investments, and financing was EUR 8.2 million (EUR 0.7 million).

Research and development expenses for January-December totaled EUR -9.9 million (EUR -8.9 million), the equivalent of 45.7% of net sales (40.0%). During January-December, the company has capitalized new product R&D costs in the amount of EUR 0.4 million (EUR 1.4 million). Depreciation from R&D capitalization assets was EUR -1.6 million (EUR -1.7 million).

The Group's research and development activities aim to respond to emerging information security threats and improve product competitiveness, quality, and usability. Also, to increase the mutual integration of products. All product lines have their own R&D team, and in addition, SSH has a shared technology team that serves all product lines of the company. Development costs are capitalized to the balance sheet as intangible assets, depending on the point in the lifecycle of the product.

The Group's goodwill is based on the acquisition of Secure Collaboration (former Deltagon). The acquisition was closed on 26 April 2021. The transaction strengthened SSH's position as a supplier of encrypted communication solutions broadening SSH's offerings portfolio and customer base. The acquisition also supported the Group's transition to a subscription-based business model.

The Group's customer-related intangible assets are based on the acquisition of Secure Collaboration (former Deltagon) and were considered as key acquired intangible assets. Other immaterial rights include obtained technology, patents, trademarks, and technology rights. The Group's patent portfolio has been developed since 1997. SSH's key intellectual property is protected with trademarks, copyrights and other available means. Obtained technology was recognized in Secure Collaboration acquisition.

Substantial risks that might affect the profitability of the company have been reviewed and updated to reflect the current macroeconomic environment.

The largest risks are:

• Cybercrime, including, e.g., ransomware

• Delays in product development and closing new business as well as phasing of new business cases

• Ability to execute the strategy

• Ability to retain and recruit key personnel

• Maintaining the ability to innovate and develop the product portfolio including intellectual property rights (IPR)

• IPR litigation and utilization of the patent portfolio

• A large portion of the company revenue is invoiced in USD currency, and possible significant fluctuation in USD currency rates during the year could have unpredictable effects on profitability. The company decides on hedging of USD-based contracts case by case.

• Uncertainty in the macroeconomic environment, which can affect both the company's operational costs and financial expenses, as well as customer decision-making and product demand. Factors causing uncertainty include, for example, high inflation and increased market interest rates, a global pan-demic, or an international conflict such as war.

The principles and organization of risk management of SSH Communications Security can be read

from the company's website https://www.ssh.com.

SSH Communications Security Group had 135 (134) employees at the end of December, which increased by 1 employee from the end of 2024. The average age among employees was 42 years (41 years). Approximately 21.5% (20.9%) of the employees were women and 78.5% (79.1%) men. At the end of the period, 40.0% (35.8%) of the employees worked in sales, marketing, and customer services, 47.4% (51.5%) in R&D, and 12.6% (12.7%) in corporate administration.

At the end of the financial period, the parent company had 91 (87) employees on its payroll. On average, the parent company had 89 (96) employees during the period under review. Parent company salaries, bonuses, and other personnel expenses during the financial period totaled EUR 8.5 million (9.1 million).

The Annual General Meeting of SSH Communications Security Oyj was held on March 26, 2025. Henri Österlund, Kai Tavakka, Christian Fredrikson, Catharina Candolin and Tuomo Louhivuori were elected as directors of the company's Board of Directors. At the inaugural meeting of the Board of Directors, Henri Österlund was elected as the Chairman.

The Extraordinary General Meeting held August 7, 2025 approved the Board of Directors' proposal that the Section 4 of the Articles of Association of the Company is amended to include the following: Up to four members may be appointed to the Board of Directors so that each shareholder holding more than 20 percent of the Company's outstanding shares is entitled to appoint

one member to the Board of Directors. On 24 October 2025, Leonardo S.p.A. appointed Francesco Di Sandro as a member of the Board of Directors of the Company.

The Authorized Public Accountant Firm Ernst & Young Oy was re-elected as the auditor of the company. Ernst & Young Oy informed the company that Maria Onniselkä, Authorized Public Accountant, will continue as the accountant with the main responsibility.

At the end of 2025, the Group Management Team consisted of three members: Rami Raulas, Chief Executive Officer

Michael Kommonen, Chief Financial Officer Miikka Sainio, Chief Technology Officer

According to the Articles of Association, the highest decision-making power in the company is wielded by the shareholders at the shareholders' meeting. The Annual General Meeting (AGM) is held within six months of the completion of the company's financial period, at a time decided by the Board. The AGM decides the number of members of the Board of Directors and elects them. Additionally, under the Finnish Limited Liability Companies Act, the AGM has the authority to amend the company's Articles of Association, adopt the financial statements, approve the amount of dividends, and select the company's auditors. Each SSH Communications Security Corporation share conveys one vote at the shareholder's meeting. Under the Articles of Association, the CEO is appointed by the Board of Directors.

SSH Communications Security abides by its Articles of Association as well as principles of transparent and responsible corporate governance, and high ethical standards in its governance and decision-making. The company complies with the Finnish company and securities market legislation, including the market abuse regulation, rules of Nasdaq Helsinki and Finnish Corporate Governance Code 2025 adopted by the Securities Market Association.

For more information see our Corporate Governance Statement that is published annually as a

separate report and can be found at SSH's website.

SSH Communications Security is committed to systematically maintain and develop the responsibility and sustainability of the business through its strategy, operations, and actions. The company is committed to operate in socially and ethically responsible way.

The company's ethical principles emphasize values that are important to SSH, such as antibribery, position and treatment of employees, and safety and behavioral culture within workplaces.

SSH Communications Security is a responsible employer and treats all employees equally. The company does not approve harassment or discrimination in any form and for that, the company has created internal guidelines and organized training. The company constantly develops the safety and comfort of its workplaces as well as the management of work-related stress and coping with the workload. In addition, the company offers its employees physical, cultural, and other benefits.

SSH Communications Security regards the diversity of its personnel as an essential strength and encourages the appraisal and adoption of diversity throughout the organization including top management.

The company has a separate Anti-Bribery and Anti-Corruption Policy as well as an equality plan focusing on equal and fair treatment of its employees.

The company has also a whistleblowing policy in place to ensure that employees and third parties, if they wish, can report anonymously suspected serious deficiencies, abuses, and crimes within the SSH Group.

SSH has established a Code of Conduct for responsible and transparent activities, employee satisfaction, and ethics for all employees worldwide.

Small and medium sized companies are exempt from the requirements to disclose information according to Regulation (EU) 2020/852 of the European Parliament and of the Council of 18 June 2020 on the establishment of a framework to facilitate sustainable investment and amending Regulation (EU) 2019/2088 (the "Taxonomy Regulation"). Therefore, SSH has not disclosed Taxonomy Regulation information in the reports for fiscal year 2025.

The reported trading volume of SSH Communications Security shares totaled 23,360,100 shares (valued at EUR 65,644,531) during the reporting period. The highest quotation was EUR 5.66, and the lowest EUR 0.94. The volume-weighted average share price for the period was EUR 2.81, and the share closed at EUR 3.15 (December 31, 2025).

Leonardo S.p.A is the largest shareholder of SSH, with 24.5% of the company shares and votes. Accendo Capital is the second largest shareholder of SSH, with 20.8%, and Tatu Ylönen holds 12.8% of the company's shares. More information about the shareholding can be obtained from the company's website, ww.ssh.com.

The company has the following subsidiaries:

• SSH Communications Security, Inc. and SSH Government Solutions, Inc. in the USA

• SSH Communications Security Ltd. in Hong Kong

• SSH Commsec Singapore Pte. Ltd in Singapore

• SSH Communications Security UK Ltd. in the UK

• SSH Operations Ltd., Kyberleijona Ltd., SSH Technology Ltd., and SSH Secure Collaboration Ltd. in Finland. SSH Operations Ltd. has a branch in Germany.

State Security Networks Group Finland (Suomen Erillisverkot Oy) became a non-controlling interest holder of Kyberleijona Oy on August 14, 2018 with 35% ownership. SSH Communications Security Oyj owns 65% of the shares in Kyberleijona Oy.

During the review period, no dividend or return of capital has been distributed.

The company's registered share capital on December 31, 2025, was EUR 1,636,244, consisting of 54,541,473 shares.

During 2025, Leonardo S.p.A. invested in the Company by subscribing to 13,333,333 new shares at a subscription price of EUR 1.50 per share, thereby raising EUR 19,999,999.50 for the company. The increase in share capital was EUR 400,000.

In 2025, share capital increased by EUR 7,203 through the subscription of stock options. Stock options were exercised in the financial year 2025 with 240,109 shares.

The Annual General Meeting approved the Board of Directors' proposal to authorize the Board of Directors to decide upon the issuing of a maximum of 4,000,000 shares as a share issue against payment or without payment or by giving stock options or other special rights entitling to shares, in accordance with Chapter 10 Section 1 of the Finnish Companies Act, either according to the shareholders' pre-emptive right to share subscription or deviating from this right, in one or more tranches. Based on the authorization, it can be either issuing of new shares or transfer of own shares, which the company possibly has in its possession.

Based on the authorization, the Board of Directors shall have the same rights as the Annual General Meeting to decide upon the issuing of shares and special rights (including stock options) in accordance with Chapter 10 Section 1 of the Finnish Companies Act. Thereby, the authorization to be given to the Board of Directors includes, inter alia, the right to deviate from the sharehold-ers' pre-emptive rights with directed issues providing that the company has a weighty financial reason for the deviation.

Furthermore, the authorization includes the Board of Directors' right to decide upon who are entitled to the shares and/or stock options or special rights in accordance with Chapter 10 Section 1 of the Finnish Companies Act as well as upon the related compensation, subscription and payment periods and upon the registering of the subscription price into the share capital or invested non-restricted equity fund within the limits of the Finnish Companies Act.

The authorization can be used as part of the company's incentive and commitment programs up to a maximum of 2,000,000 shares.

The authorization will be valid until the next Annual General Meeting but will however expire at the latest on June 30th, 2026.

The Annual General Meeting approved the Board of Directors' proposal to authorize the Board of Directors to decide upon acquisition of a maximum of 2,000,000 own shares of the company with assets belonging to the company's non-restricted equity, which represents approx. 4,9 % of all shares in the company. The shares can also be acquired otherwise than in proportion to the holdings of the existing shareholders. The maximum compensation to be paid for the acquired shares shall be the market price at the time of purchase, which is determined by public trading.

The Board of Directors proposes that the authorization for the acquiring of the company's own shares would be used, inter alia, in order to strengthen the company's capital structure, to finance and realize corporate acquisitions and other arrangements, to realize the share-based incentive programs of the company or otherwise to be kept by the company, to be transferred for other purposes or to be cancelled. The acquisition of shares reduces the company's distributable non-restricted equity.

Decision concerning the acquiring of own shares cannot be made so that the combined amount of the own shares, which are in the possession of, or held as pledges by, the company or its subsidiaries exceeds one-tenth of all shares. The Board of Directors shall decide upon all other matters related to the acquisition of shares.

The authorization will be valid until the next Annual General Meeting, but will however expire at the latest on June 30th 2026.

The Company and Leonardo S.p.A. on 1 July 2025 entered into a framework investment agreement, whereby the parties have agreed on their future strategic cooperation and the terms on which Leonardo S.p.A. will make an investment in the Company by subscribing for new shares in the Company (the "Transaction").

To consummate the Transaction, the Extraordinary General Meeting approved the Board of Di-rectors' proposal to authorize the Board of Directors to decide on the share issue against the payment on the following terms:

The authorization entitles the Board of Directors to decide on the issuing of a maximum of 13,333,333 shares as a directed share issue against payment in deviation from the shareholders' pre-emptive rights in one or several instalments. Based on the authorization, either new shares can be issued, or own shares, which the Company possibly has in its possession, can be transferred.

The authorization can be used to execute the Transaction.

Based on the authorization, the Board of Directors has the same right as the Extraordinary General Meeting to decide on the issuing of shares against payment. Thereby, the authorization to be given to the Board of Directors includes, inter alia, the right to deviate from the shareholders' pre-emptive rights with directed issues providing that the Company has a weighty financial reason for the deviation in respect of the share issue against payment.

The authorization also includes the Board of Directors' right to resolve on the consideration paid for or in relation to the shares, subscription and payment periods, as well as the allocation of the subscription price to the Company's share capital or fund for invested unrestricted equity, within the limits permitted by the Finnish Companies Act.

The authorization will be valid until 30 April 2026. The authorization does not reverse previous authorizations granted to the Board of Directors concerning the issuing of shares, stock options and other special rights.

Hybrid capital securities in the amount of EUR 12 million were issued in March 2015 and subscribed by institutional investors. The capital securities bear a fixed interest rate of 11.5 percent. The capital securities have no maturity date, but the issuer has the right to redeem them after 3 but before 5 years from the issue date, upon certain conditions, or after 5 years from the issue date. The investors had the right to convert the capital loan into the Company's shares at EUR

4.76 per share until 30 March 2020.

A hybrid capital security is an instrument that is subordinated to the Company's other debt obligations, and it does not have a maturity date (i.e. it is perpetual). It is treated as equity in the balance sheet in financial statements. Unpaid interest is cumulated but presented in the financial

statements only after Board of Directors' interest payment decision. Paid interest on the hybrid capital securities decreases the retained earnings of the group and the parent company. Hybrid capital securities do not confer on their holders any shareholder rights and do not dilute the holdings of the current shareholders.

Payment of the hybrid loan interest and repurchase of the principal are subject to the Board of Directors' decision. The Group's Board of Directors had decided that interest on the hybrid capital securities was not paid in March 2024 and 2025. The accumulated interest on hybrid capital securities at the end of 2025 was EUR 3,416,276. During 2025, the company purchased EUR 2.2 million of the loan principal. The interest paid when repurchasing the principal of the hybrid capital securities decreases the retained earnings of the group and the parent company.

The share-based payments of SSH Communications Security are stock options. Stock option programs have been in effect in the reporting period or in the comparison year.

The Board of Directors decided on March 26, 2025 on a new stock option program 2025A. The maximum number of stock options is 980,000. The share subscription period will be from February 23, 2027 to March 31, 2029. The share subscription price for the shares is EUR 1.24.

On March 27, 2024 the Board of Directors decided on a stock option program 2024A. The maximum number of stock options is 980,000. The share subscription period will be from February 24, 2026 to March 31, 2028. The share subscription price for the shares is EUR 1.83.

Each option gives the right to subscribe to one new share at a price and at a time specified in the terms of the stock option plan. The option rights will be canceled in case the employee leaves the company before the subscription time has begun. There are no other conditions to the beginning of the option rights.

The shares subscribed with the granted option rights include the rights to any dividend payable for the reporting period during which the shares were subscribed. Other shareholder rights commence as soon as the increase in the share capital has been registered in the Trade Register. More information on stock option plans is given in note 20 in the consolidated financial statements.

During the reporting period, there have not been any significant transactions with related parties, other than agreed remuneration with executive management and board.

On 9 January 2026, SSH Communications Security announced that David Wishart, VP EMEA, was appointed a member of the Executive Management Team, and Harri Pendolin was appointed Chief Product Officer and a member of the Executive Management Team, effective 1 February 2026.

We expect net sales to grow during 2026 compared to 2025. We estimate EBITDA and cash flow from operating activities to be positive for 2026.

The parent company's distributable funds are EUR 11,459,637.55 of which the loss for the financial year is EUR -2,106,061.96. The Board of Directors proposes to the Annual General Meeting on 26 March, 2026 that no dividend or return of capital shall be distributed. It is proposed that the loss of the financial year shall be entered to the retained earnings in the shareholders' equity.

1. Earnings per share is impacted by the accrued unpaid interest of hybrid capital securities. Stock options are excluded from the EPS diluted when the result is negative.

2. The 2024 figure has been corrected to include only the interest on the hybrid loan for the relevant period.

SSH Communications Security presents an alternative performance measure, which is not defined by IFRS standards. Alternative performance measures should not be considered as substitutes for performance measures in accordance with the IFRS.

EBITDA = Operating profit/loss + depreciation, amortization, and impairment

The following table presents the reconciliation of EBITDA to the operating profit/loss.

Operating profit = profit/loss for the period + income taxes + financial income and expenses

Return on Equity, % (ROE) = Profit/loss for the financial year x 100

Equity (average during the financial year)

Return on Investment, % (ROI) = Profit/loss before taxes x 100

Balance sheet total - Non-interest-bearing debts (average dur-

ing the financial period)

Equity Ratio, % = Equity x 100 Balance sheet total - Advance payments received

Earnings Per Share (EPS) =

Profit/loss for the financial period attributable to owners of the

parent company - Interest on hybrid capital securities Average number of outstanding shares during the financial

period

Diluted Earnings Per Share (EPS) =

Profit/loss for the financial period attributable to owners of the

parent company - Interest on hybrid capital securities Adjusted average number of shares considering dilution effect

Dividend Per Share = Dividend

Number of outstanding shares during the financial period

Dividend Pay-out Ratio, % = Dividend per share x 100

Earnings per share

Equity Per Share =

Equity

Number of outstanding shares on the financial statement date, adjusted for share issue

x 100

Gearing, % = Interest-bearing debt - Liquid assets x 100 Equity

1) The 2024 figure has been corrected to include only the interest on the hybrid loan for the relevant period.

CONSOLIDATED STATEMENT OF FINANCIAL POSITION

1. GENERAL ACCOUNTING PRINCIPLES Basic information about the Group

   SSH Communications Security Corporation helps organizations access, secure and control their digital core - their critical data, applications and services. In the rapidly growing global data economy, secure access that enables digital transformation at business velocity is the new competitive advantage.

   Our thousands of customers include Fortune 500 companies, the world's largest financial institutions, and major organizations in all verticals. Our solutions guard against the rapidly changing threat landscape that includes both internal and external actors.

   We generate shareholder value from a combination of our world-leading expertise, proven enterprise-class solutions, professional services, support offering, and from our strong IP portfolio and well-established licensing operations.

   The SSH Communications Security Group consists of SSH Communications Security Corporation and its subsidiaries. SSH Communications Security Corporation (corporate id 1035804-9) is domiciled in Helsinki, Finland and is a publicly traded company, whose share is quoted on NASDAQ Helsinki Oy (SSH1V). SSH Communications Security Corporation has its registered office at address Karvaamokuja 2D, 00380 Helsinki, Finland.

   The SSH Communications Security Board of Directors approved this financial statement for publication at its meeting on 16 February 2026. Under the Finnish Limited Liability Companies Act, the shareholders can accept or reject the financial statement at the AGM held after its publication. A copy of the financial statements is published as a part of the company's annual report.

   The annual report is available on the company website at www.ssh.com, or at the head office of SSH Communications Security Corporation. All stock exchange bulletins are available on the company website www.ssh.com.

   In accordance with the European Single Electronic Format (ESEF) reporting requirements, SSH has published the Board of Directors' report and the financial statements as an XHTML file, which is the official version of the report. In line with the ESEF requirements, the primary statements of the consolidated financial statements have been labelled with XBRL tags, and the notes to the financial statements with XBRL block tags.

   The PDF version of the Financial Statements and report of the Board of Directors report is voluntary publication.

   Basis of preparation of financial statements

   The consolidated financial statements have been prepared in compliance with the International Financial Reporting Standards (IFRS). The forementioned standards are the standards and interpretations thereof approved for use in the EU pursuant to Regulation (EC) No. 1606/2002 implemented in the Finnish Accounting Act and legislation based thereon. The notes to the consolidated financial statements are also compliant with Finnish accounting and company legislation.

   The consolidated financial statements are based on original acquisition costs unless otherwise noted in the accounting principles. The consolidated financial statements are presented in full euros unless otherwise stated.

   Converting Foreign Currency Transactions

   Items of each subsidiary included in the consolidated financial statements are measured using the currency of the operating environment of that subsidiary ('functional currency'). The consolidated financial statements are presented in euros, which is the functional and reporting currency of the parent company.

   Transactions in Foreign Currency

   Foreign currency denominated transactions are recognized at the exchange rate of the functional currency on the transaction date. In practice, the exchange rate used is approximately the rate of the transaction date. Outstanding receivables and liabilities in foreign currencies are measured using the exchange rates on the balance sheet date. Exchange rate differences are recorded in the income statement. Exchange rate gains and losses on financing are included in financing income and costs.

   Translation of Financial Statements of Foreign Subsidiaries

   The comprehensive income statements and cash flow statements of subsidiaries whose functional currency is other than EUR are translated into euros using the exchange rate of the transaction dates. In practice, the translations are done once a month using the monthly average exchange rate. Balance sheet items are translated into euros with the exchange rate of the balance sheet date. The translation of the comprehensive profit/loss for the financial period using different exchange rates in the comprehensive income statement on the one hand and in the balance sheet on the other causes a translation difference recognized under Group equity under other comprehensive profit/loss items.

   Translation differences generated through elimination of the acquisition costs of foreign subsidiaries and translation of equity items accrued after acquisition are recognized under other comprehensive profit/loss items. When a subsidiary is sold, accumulated translation differences are recognized in the income statement as part of the gain or loss on the sale.

   Use of estimates

   Preparation of the consolidated financial statements in accordance with IFRS requires management to make estimates and assumptions affecting the reported amounts of assets, liabilities, income, and expenses, as well as the disclosure of contingent assets and liabilities. The estimates and assumptions are based on historical experience and other factors that are believed to be reasonable under the circumstances, which form the basis of making the judgments about carrying values. These estimates and assumptions are reviewed on an ongoing basis, and possible effects of changes in estimates and assumptions are recognized during the period they are changed.

   The estimates and assumptions that have a significant risk of causing adjustment to the carrying value of assets or liabilities within the next financial year relate to restructuring plans, impairment testing, claims, onerous contracts, and provisions.

   New and amended standards and interpretations

   During 2025, there were no changes in the Group's accounting principles.

   Changes that become effective later

   The Group will adopt new and amended standards and interpretations as of the effective date or, if the date is other than the first day of the financial year, from the beginning of the subsequent financial year. There are no new or amended IFRS standards that are expected to have a material impact on the Group from 1 January 2026.

   IFRS 18 Presentation and Disclosure in Financial Statements is effective from 1 January 2027 and applies retrospectively. IFRS 18 Presentation and Disclosure in Financial Statements will replace IAS 1 Presentation of Financial Statements. Adaptation of IFRS 18 will be mandatory. IFRS 18 aims to enhance transparency and improve comparability of the presentation and disclosure in the financial statements.

   SSH plans to adopt the IFRS 18 accounting standard initially 1 January 2027, however early adoption is permitted. IFRS 18 will impact income statement presentation and disclosing information in notes. The Group's accounting policies will be amended to include the disclosures for Management performance measures (MPMs) and operating profit according to the IFRS 18. Adaptation of IFRS 18 may impact restructuring income statement including the classification of income and expenses (operating, investing, financing) to ensure that grouping the information in the financial statements is presented according to the standard IFRS 18.

2. SEGMENT INFORMATION

   SSH Communications Security Oyj has one reportable segment; the software business, due to business model, the nature of its operations and its governance structure.

   SSH's operations have similar financial characteristics and are similar in terms of the nature of product and service production processes, types of customers, geographical characteristics, methods used in product or service distribution or service provision.

   Segment reporting is consistent with the internal reporting submitted to the chief operating decision-maker. The Executive Management Team acts as the chief operating decision-maker, responsible for allocating resources and assessing performance as well as making strategic decisions.

3. NET SALES

   Accounting principles

   Revenue Recognition

   SSH Communications Security net sales derive mainly from software license sales and subscriptions, related support and maintenance fees, and consulting fees. Net sales comprise the invoiced value for the sale of goods and services adjusted with any discounts given, sales taxes, and exchange rate differences.

   The revenue from product sales is recognized at the time when significant risks and rewards of the product or the right of use of the product have been transferred to the buyer and there is a binding contract between the parties, the delivery has taken place in accordance with the contract, the amount of revenue can be measured reliably, and it is probable that the economic benefits associated with the transaction will accrue to the Group. Control is transferred to the buyer at the point of time.

   Maintenance sales, or revenue from support and maintenance contracts, are recognized evenly on an accrual basis throughout the contract period. Revenues from services are recognized when the service has been delivered and it is probable that the economic benefits associated with the transaction will accrue to the Group. Revenues from subscription contracts are recognized evenly on an accrual basis throughout the contract period. Revenues from hardware sales are recognized at the time when control of the hardware is transferred to the buyer. In case the hardware component is not determined to be distinct from the other performance obligations in the contract, revenue from hardware is recognized over time throughout the contract and classified as revenue from subscription contracts.

   The revenue of royalties from licenses is recognized at the time of payment. Revenue from royalties is not material to the Group.

   The Group customarily receives short-term advance payments from customers, but also from time-to-time substantial long-term advance payments for subscription or support and maintenance fees. In these cases, the financing component is accounted for and interest expenses are recorded for the duration of the advance payment.

   Assets recognized from the costs to fulfill a contract with a customer

   The Group recognizes the costs to fulfill a contract with a customer as an asset when expecting to recover the costs, the costs relate directly to a contract that can be identified, and the costs generate resources that are used to satisfy a performance obligation.

   Costs recognized as an asset are costs of hardware that relate directly to a contract that is subscription based. Amortization of costs is calculated on a straight-line basis over the period of a contract to which the assets recognized from the costs relates to. Amortized costs are recognized as costs of goods sold.

   Incremental costs of obtaining a contract

   The Group recognizes the incremental costs of obtaining a contract as an asset when expecting to recover the costs, the costs relate directly to a contract that can be identified, and the costs generate resources that are used to satisfy a performance obligation.

   Incremental costs recognized as an asset are sales incentive commissions paid to an employee, that relate directly to a contract that is subscription based. Amortization of costs is calculated on a straight-line basis over the period of a contract to which the assets recognized from the costs relates to. Amortized costs are recognized as commission costs in salaries and staff related costs.

In 2025 or 2024, no customer's revenue accounted for more than ten percent of the Group's

net sales.

Obligations for returns are defined to cover the value of hardware purchase price when the company is not able to provide hardware return service based on agreed service level. The return value excludes the value of licenses and other services sold.

The warranty for hardware items is limited to 12 months. Warranty may be extended up to five years by purchasing the warranty service.

Revenues presented based on the basis of customer location and non-current assets presented on the basis of their location:

1. OTHER OPERATING INCOME

   Accounting principles

   Grants

   Grants received from the government for the purchase of tangible assets are entered into as a deduction of the book value of the asset when there is reasonable assurance that the company will receive the grant and will comply with the conditions attached to the grant. Grants are recognized as income over the life of a depreciable asset by way of a reduced depreciation. Government grants that are intended to compensate for costs are recognized as income over the same period as the related costs are recognized. These government grants are presented under other operating income.

In the year 2025, other operating incomes include EUR 0.2 million received from government grants (EUR 0.4 million).

1. OTHER OPERATING COSTS

   EUR	2025	2024
   Employee benefit expenses Wages and salaries	-11,812,996	-12,250,393
   Pensions, defined contribution plan	-1,524,155	-1,609,391
   Other social security costs	-585,681	-653,563
   Stock options issued	-351,495	-375,352
   Total	-14,274,328	-14,888,699

   Information about remuneration of the key management personnel is presented in note 26. Related party transactions and information on the options granted is presented in the note 20.

   Share-based payments.

   Number of personnel	2025	2024
   Average during the financial period	132	145
   At the end of the financial period	135	134
   Personnel distribution by function on 31 Dec Sales, marketing, and customer support	54	48
   Research and development	64	69
   Administration	17	17
   Total	135	134
   Research and development costs recognized as costs
   EUR	2025	2024
   Total	-9,879,892	-8,862,262
   Other operating costs
   EUR	2025	2024
   External services	-4,940,659	-4,164,123
   Depreciation	-3,278,886	-3,684,706
   Other costs	-1,375,057	-1,281,151
   Total	-9,594,602	-9,129,980

   Auditor's fees

   Auditor's fees categorized into service groups were:

   EUR	2025	2024
   Principal auditor Ernst & Young Oy
   Statutory auditing	-100,689	-107,674
   Other auditing services	-12,997	-17,900
   Other auditing firms:
   Statutory auditing	-32,971	-20,443
   Other services	-500	-408
   Total	-147,157	-146,425

2. DEPRECIATIONS AND IMPAIRMENTS

   EUR	2025	2024
   BY ASSET CATEGORY Machinery and equipment	144,082	171,550
   Right-of-use assets	381,227	489,948
   Software & other intangible assets	1,198,137	1,363,451
   Capitalized development costs	1,555,441	1,659,757
   Total	3,278,887	3,684,705

   EUR	2025	2024
   BY FUNCTION Sales and marketing	6,899	20,270
   Research and development	1,925,740	2,224,350
   Administration	1,346,247	1,440,085
   Total	3,278,886	3,684,705

3. FINANCIAL INCOME

   EUR	2025	2024
   Interest revenue	91,357	33,934
   Exchange rate gains, loans and other receivables		62,929
   Total	91,357	96,863

4. FINANCIAL COSTS

   EUR	2025	2024
   Exchange rate losses, loans, and other receivables	-240,177	-71,933
   Interest arising from revenue contracts	-40,842	-83,945
   Interest on lease liabilities	-61,385	-128,359
   Other financial costs	-106,157	-144,402
   Total	-448,562	-428,640

5. INCOME TAXES

The amount of Group's unused tax losses, for which no deferred tax asset has been recognized based on the prudence principle, is EUR 7.5 million (EUR 7.2 million). EUR 3.8 million (EUR 3.2 million) of the tax losses are in Finland, and EUR 3.7 million (EUR 4.0 million) in the USA. The tax losses expire in Finland between the years 2026-2034, and in the USA between the years 2026-2044. The amount of unrecognized deferred tax assets from the tax losses is EUR 1.5 million (EUR 1.7 million). The figures include use of losses in 2025 which have not yet been confirmed in taxation.

In addition, the parent company has EUR 47.2 million (EUR 44.5 million) research and development expenses and depreciations not deducted in taxation and the amount of unrecognized deferred tax assets resulting from those is EUR 9.4 million (EUR 9.1 million).

The Group's subsidiaries do not have earnings that would cause tax consequences when repatriated.