Quarterly Activities Report and Appendix 4C

• Invoiced US$258K in Q3 2025
• Secured new contracts with U.S. University and Australian University
• Responding to several government RFPs and proposals

Whitehawk Ltd, the global online cybersecurity exchange, has provided an update on its progress for the third quarter of 2025. The company invoiced US$258K during the quarter and had US$85K in receivables as of September 30, 2025. Key highlights include securing a new contract with a U.S. University for a cyber research program, and an in-process contract with an Australian University for the company's Cyber Analyst Platform-as-a-Service to scale cyber experiential internships and academic programs. Whitehawk also provided a sole-source proposal to the U.S. Office of the Secretary of Defense for $280K across 600 critical infrastructure entities. Additionally, the company is responding to several government RFPs, including a 3-year, $1M contract with the State of Maryland for cybersecurity experiential learning, and a multi-year, $2.2M per year contract with the State of Florida to provide its Cyber Analyst Platform-as-a-Service to universities. Whitehawk continues to manage expenses below budget, with an average monthly spend of $272K. The company ended the quarter with $995K in cash and cash equivalents.

Whitehawk expects to capitalize on the new CMMC regulations for U.S. defense contractors, which go into effect on November 10, 2025. The company can now sell its automated Path to CMMC offering directly and through partnerships, targeting an estimated market of 300,000+ U.S. defense contractors.

Whitehawk is focused on expanding its cybersecurity offerings and partnerships, particularly in the U.S. and Australian government and education sectors. The company is well-positioned to benefit from the new CMMC regulations for U.S. defense contractors and is actively pursuing several large contract opportunities.