F-Secure Corporation in 2025

F-Secure Corporation is a globally operating consumer cybersecurity company. F-Secure designs and offers a comprehensive range of award-winning consumer cybersecurity products and services that are AI-powered and human-centered. These products and services protect consumers’ digital moments against scams, and are contextually relevant, resonate emotionally and proactively helpful.

F-Secure is the global leader in providing consumer cybersecurity through Communication Services Providers (CSPs) and has become undisputed leader among world’s largest CSPs. Additionally, F-Secure partners with Service Providers such as banks and insurance companies, and sells services directly to consumers through its web store mobile and app stores. The company was reborn through the demerger of the consumer business from WithSecure Corporation in June 2022. In 2023, F-Secure strengthened its footprint in the US and among CSPs by the acquisition of Lookout Life, a US-based consumer mobile security business of Lookout Inc.

F-Secure's main product and service portfolios are:

Security Suite: F-Secure Total, which is an all-in-one consumer cybersecurity application that provides complete protection against scams as well as security, privacy and identity protection on all consumers’ personal devices.

Embedded Security: Comprehensive portfolio of consumer cybersecurity capabilities available as Software Development Kits (SDKs) and cloud Application Programming Interfaces (APIs) that can be embedded into Service Provider’s app or service. Embedded Security portfolio also includes F-Secure Sense, an SDK based solution that provides whole home protection embedded inside a Wi-Fi-router. Embedded Security typically has a lower gross margin than Security Suite due to lower pricing, and higher expected volumes. The partner is responsible for the implementation of the solution.

Services: F-Secure Security Business Platform based scalable expert and cloud-based services supporting both Security Suite and Embedded Security business such as delivery and integration, customer care, and partner success services that support F-Secure’s Partner Business. Furthermore, during 2025, F-Secure piloted "Horizon," an AI-native self-service SaaS platform designed to scale the number of Service Providers the company can serve.

F-Secure operates globally in over 100 countries and has tens of millions of subscribers in all channels. F-Secure products are sold to consumers through approximately 200 CSPs, retailers, banks, insurance companies and directly through online and app stores.

F-Secure shares are listed on the main list of Nasdaq Helsinki.

Presentation of financial information

Figures in brackets refer to the corresponding period in the previous year, unless otherwise stated. Percentages and figures presented herein may include rounding differences and therefore may not add up precisely to the totals presented.

Financial performance

F-Secure currency neutral growth was 0.6%. Reported revenue remained at previous year's level (-0.4%) and was EUR 145.7 million (EUR 146.3 million).

Deferred revenue decreased by 5.2% from December 2024, mainly due to normal seasonal variation in billings of some large partner contracts but also due to reduced engagement with retail partners.

Currency neutral revenue in the Partner channel increased by 1.8%. Reported revenue increased by 0.6% and was EUR 119.0 million (EUR 118.2 million). Partner channel revenue in North America was weak due to US dollar fluctuations.

At comparable exchange rates, Security Suite revenue increased by 0.7%. Reported revenue decreased by -0.2% and was EUR 95.6 million (EUR 95.7 million). Total conversion continued well and average revenue per user (ARPU) increased. In the Nordics, activity was strong in Sweden and Finland. The DACH region¹ continued to perform well except for Germany, where revenue declined significantly due to ongoing challenges faced by a key partner in its core business. Progress in North America was weak partly due to lower price levels of an existing customer and modest performance of customers with legacy products.

At comparable exchange rates, revenue from Embedded Security increased by 6.7%. Underlying business in Japan was good throughout the period, although in the fourth quarter it was weaker than in the previous quarters. First quarter revenue was negatively impacted by one-time revenue recognition timing adjustment of EUR 0.3 million related to Japan. Growth was supported by good development in the US, where the majority of revenue is attributable to Embedded Security. Reported revenue increased by 4.0% and was EUR 23.4 million (EUR 22.5 million).

Currency neutral revenue and reported revenue from Direct channel decreased by -4.5% and was EUR 26.8 million (EUR 28.0 million). The decline in revenue is especially due to weak performance in North America. Service renewal rates were high and ARPU development was healthy. However, the number of users declined throughout the year due to low level of paid customer acquisition investments as per current strategy.

F-Secure reports Partner channel revenue divided into its main product portfolios: Security Suite and Embedded Security. This reporting approach aims to increase transparency in the development of the company's product mix, as the portfolios have different levels of profitability.

Revenue by sales channel

Revenue by geography

Gross margin declined and totaled 123.4 million (EUR 126.0 million) or 84.7% of revenue (86.2%) due to lower-than-expected volumes as well as a higher proportion of the lower-margin Embedded business.

Operating expenses excluding depreciation and amortization and items affecting comparability were EUR -72.3 million (EUR -73.3 million). Sales and marketing costs declined and were EUR -32.2 million (EUR -33.4 million). The decrease was driven by reduced engagement with retail partners resulting in lower marketing costs. Research and development (R&D) costs were EUR -24.7 million (EUR -25.4 million). R&D activity increased somewhat, but a higher level of capitalization led to lower level of R&D expenses during the year. Administration costs were EUR -15.4 million (EUR -14.5 million). Administration costs increased due to a few one-off costs.

Depreciation and amortization excluding purchase price allocation (PPA) amortization increased due to the higher R&D capitalization during the last couple of years and totaled EUR -8.5 million (EUR -5.8 million). PPA amortizations related to the Lookout consumer security business acquisition totaled EUR -7.9 million (EUR -7.8 million).

Adjusted EBITA amounted to EUR 50.3 million or 34.5% of revenue (EUR 52.2 million, 35.7%). EBIT was EUR 35.5 million and 24.4% of revenue (EUR 38.4 million, 26.3%), the decline was due to lower EBITA level and higher amortizations of capitalized R&D expenses. The comparison period included EUR -1.4 million of items affecting comparability attributable to restructuring and change negotiations.

In January–December 2025, cash flow from operating activities before financial items and taxes amounted to EUR 54.0 million (EUR 53.9 million). Cash flow from operations was EUR 43.6 million (EUR 38.8 million). Despite the higher capitalization during the year, the cash conversion rate remained stable, being 79.1% (80.5%). Cash at the end of December 2025 stood at EUR 10.8 million (EUR 8.1 million).

At the end of December 2025, F-Secure net debt amounted to EUR 145.6 million (EUR 163.6 million) and the net debt to adjusted EBITDA ratio was 2.8x. All the Group’s loan agreements include a quarterly measured financial covenant based on the ratio between net debt and EBITDA. The Group has met these covenant terms and conditions on the reporting date. The equity ratio was 21.5% (17.4%).

Total assets were EUR 261.1 million (EUR 270.6 million) at the end of December 2025.

As of 31 December 2025, current lease liabilities were EUR 1.7 million (EUR 0.7 million), and non-current lease liabilities were EUR 3.4 million (EUR 0.5 million). The lease liabilities relate to leases for office premises and cars. The increase in lease liabilities relates to the new lease agreement for headquarter office premises which was recorded in the balance sheet as a right-of-use asset (EUR 4.0 million) and lease liability in July 2025 when the lease term started.

In January–December 2025, capex was EUR 12.8 million (EUR 11.1 million) and was related to investments in technology and headquarter premises (EUR 0.7 million).

1. Germany, Austria, and Switzerland.

Acquisitions and financial arrangements

F-Secure hasn't made any acquisitions during the reporting period.

During the reporting period, in June 2025, F-Secure signed and withdrew a EUR 35 million loan with Nordic Investment Bank (NIB). The loan is the first step of refinancing the company’s loan portfolio. The loan has a seven-year maturity, and the first two years of the loan are repayment-free. This extends the average maturity of the company’s debt structure.

Financing package with Danske Bank A/S and OP Corporate Bank plc was extended in March 2025 and this loan matures in 2028. The financing package consists of two facilities, (i) a EUR 202 million amortizing term loan to finance the acquisition, and (ii) a EUR 20 million revolving loan facility to be used for general corporate purposes. During the reporting period, F-Secure has repaid EUR 45.0 million of the term loan in total: EUR 30.0 million of scheduled repayments and EUR 15.0 million of additional repayment. The revolving credit facility is undrawn at the reporting date.

Group structure and changes

F-Secure's subsidiary in Brazil, F-Secure do Brasil Tecnol. da Informãcao Ltda, was closed during 2025.

Loans, liabilities and guarantees from related parties

F-Secure Corporation's receivables from companies within the same group are presented in Note 12. Receivables of the parent company’s financial statements. The company has not provided any other loans, liabilities, or guarantees to related parties.

Significant events during the financial year

On 8 July 2025, F-Secure lowered its outlook for the full year 2025 revenue and adjusted EBITA. From an operational perspective, the adoption of new security services by Tier 1 customers has progressed slower than expected. In addition, the closing of new Tier 1 deals, both with existing and new partners, has been delayed due to factors such as organizational changes, shifting priorities, limited resources, and evolving business cases.

More than 10 percent weakening of the U.S. dollar during the first half of the year has a strong impact, resulting in a negative effect of more than EUR 3 million on full-year forecast compared to the level at the beginning of 2025.

The revised profitability guidance reflects the revenue decline outlined above. While cost control has remained disciplined, F-Secure’s business model limits the ability to fully offset the lower revenue through cost reductions alone.

Despite these challenges, F-Secure maintains a strong opportunity pipeline and remains optimistic about future growth.

Updated outlook for 2025
Growth: F-Secure expects low single-digit currency-neutral revenue growth for 2025. Profitability: The group’s adjusted EBITA margin is expected to be in the range of 32%–35% in 2025 (in 2024: 35.7%).

Previous outlook for 2025 was issued on 6 February 2025:
Growth: F-Secure expects mid-single digit revenue growth for 2025. Profitability: The group’s adjusted EBITA is expected to be approximately on the same level as in 2024 (EUR 52.2 million).

On 20 November, F-Secure announced that the company is negotiating a significant strategic partnership agreement with one of the world’s leading Tier 1 Communications Service Providers (CSP). The ongoing negotiations relate to delivering F-Secure’s embedded solutions to the customer. This agreement demonstrates F-Secure’s capability to serve the world’s leading CSP’s with innovative, highly scalable cybersecurity services. The agreement under negotiation contains a minimum guaranteed revenue, starting from the service launch to customers. Negotiations are ongoing and the company will publish a release with additional details once the agreement has been signed. The launch is expected to take place in the second quarter of 2026.

Research and development

F-Secure Corporation research and development expenditure amounted to EUR 30.9 million (EUR 29.3 million) in 2025, representing 21.2% (20.0%) of revenue and 34.9% (33.1%) of all expenditures. Additionally, capitalized investments in technology were EUR 11.7 million (EUR 11.0 million).

In 2025, F‑Secure’s Technology function focused on scam protection, simplifying our product and systems landscape, improving delivery discipline, and strengthening the foundations for efficient growth and Tier 1 readiness. Our objective is clear: a technology base that supports consistent execution and a lower cost to serve, contributing to strong profitability over the long term. We also continued to invest in our distribution capabilities with partners. With the developments made in our standardized Software Development Kit (SDK) approach in 2025 we will scale to serve more Tier 1 partners in 2026. This “build once, deploy broadly” model is intended to scale reach while protecting unit economics.

A major theme throughout the year was advancing our “one platform, many segments” program. We continued to bring products onto a single, unified SaaS platform and SDKs that can support multiple customer segments. This reduces duplication, increases reliability, and allows us to direct more investment toward innovation. This remains in progress by design; as key technology cutovers complete during 2026.

Within our engineering work, we emphasized practical, AI‑native efficiency. The use of assistive tools, internal data and model services, and repeatable methods helped targeted teams shorten delivery cycles and reduce rework. In teams adopting AI‑assisted workflows, we saw around 30% improvement in cycle time; in selected new‑build teams, time to initial capability improved by up to tenfold in pilots. We scaled these practices deliberately—prioritizing quality, security and service continuity. In parallel, we strengthened our internal data and automation foundations. This groundwork is not customer‑facing or imminently visible on its own; its purpose is to enable a steady flow of product improvements in 2026 and beyond.

Our advances in scam protection were recognized with an AI award in 2025. We continued to deepen our understanding of online fraud through ongoing research and market assessment, including work on deepfake detection and cross‑channel scams. These insights inform our product roadmap and partner discussions—supporting identity and account‑protection features—and help us focus on areas that matter most to consumers and operators.

Looking ahead to 2026, our priorities are to complete the most important migrations, retire remaining legacy systems, and bring the gains from our internal foundations into visible product improvements. We will extend standardized partner integrations to additional operators and segments while maintaining a single platform and a single codebase. As capacity shifts from refactoring to new product work—particularly in the second half of 2026—we expect clearer operating leverage: lower structural costs, more predictable delivery, and a distribution model that scales efficiently across households and connected devices.

We are executing methodically, with a focus on cost discipline, service quality, predictable outcomes, and selected product innovation initiatives. The work we did in 2025 lays the groundwork for 2026 to harvest the benefits—supporting a simpler, faster, and more economical technology foundation aligned with long‑term, stable profitability.

Personnel, management, board of directors and auditor and sustainability auditor of the company

At the end of December 2025, F-Secure had 549 (529) employees. The average number of personnel in 2025 was 526 (519). Wages and salaries were EUR 34.0 (36.1) million in 2025.

F-Secure’s most important intangible resource is our personnel, which is critical for implementing our strategy. This includes i) our product and technology organizations, who ensure the competitiveness of our product portfolio and our ability to protect consumers’ digital moments through research and innovation, ii) our sales, marketing, and services organizations, through which we can serve our partner segments and consumers. In addition, our business support organizations (e.g. corporate development, finance and people & culture) ensure our smooth daily operational activities.

In 2025, we built the foundation for F-Secure's AI-native future. We launched our AI Learning Academy, upskilling our entire organization in AI capabilities critical to our product innovation and partner service excellence. We fostered AI-experimentation and introduced AI-powered tools to enhance employee experience and team performance. Most significantly, we established the standards for high-performing teams across the organization, strengthening collaboration and accountability that accelerate our time-to-market and enhance our ability to protect consumers' digital moments. These changes position F-Secure as an agile, AI-first organization ready to lead in the evolving cybersecurity landscape.

During 2025 the following changes to F-Secure Leadership Team were announced:

• Toby White, Chief Technology Officer (CTO) and a member of the Leadership Team decided to leave F-Secure at the end of July, 2025.

• Santeri Kangas was appointed CTO and a member of the Leadership Team as of 1 October 2025.

• TL Viswanathan, F-Secure Chief Product Officer, served as interim CTO from August until 1 October 2025.

• Sari Somerkallio, CFO and a member of the Leadership Team, decided to leave the company on 30 April 2026.

• Robin Pulkkinen was appointed as Chief Financial Officer (CFO) and a member of the Leadership Team, and he will start in this position no later than June 2026.

After the review period, on 13 January 2026, company announced the appointment of a new Chief Strategy Officer (CSO). F-Secure's SVP, Corporate Development and a member of the Leadership Team, Antero Norkio, decided to leave the Company on 30 January 2026. Jyrki Tulokas was appointed CSO and a member of the Leadership Team of F-Secure Corporation, effective 2 February 2026.

At the end of December 2025, the composition of the Leadership Team was the following:

Members of the Board of Directors of F-Secure are Pertti Ervi (Chair of the board), Alessandro Adriani, Roxana Diaconescu, Cornelia Schaurecker, Petra Teräsaho, Tommi Uitto and Rachit Mittal. Rachit Mittal belongs to the personnel of the F-Secure Corporation. One member of the Board of Directors is elected from among F-Secure personnel. An election is arranged annually for F-Secure personnel and each permanent employee, except the people belonging to the company’s Leadership Team, is eligible to stand as a candidate. The representatives of the Board of Directors interview persons who have obtained the highest number of votes in the elections and choose a candidate from amongst them to be proposed for election as a member of the Board by the Annual General Meeting.

The term of office of members of the Board of Directors ends at the close of the annual general meeting of shareholders following their election.

The auditor and also authorized sustainability auditor of F-Secure Corporation is the Authorized Public Accountant PricewaterhouseCoopers Oy with Samuli Perälä, APA, as the auditor and authorized sustainability auditor with the principal responsibility.

Share-based incentive plans

F-Secure has share-based incentive plans for the key personnel of the company. The share-based long-term incentive plans include a Performance Share Plan (PSP), Performance Matching Share Plan (PMSP) and Restricted Share Plan (RSP) as a complementary share-based incentive plan for individually selected key employees in specific situations. Members of the Leadership Team and selected key employees can participate in either PSP or PMSP according to their choice, not both plans. The purpose of the share-based long-term incentive plans is to align shareholders’ and management’s interests, motivate and incentivize key individuals to focus on F-Secure’s long-term success and targets and to commit key resources in the company.

In addition, F-Secure has an Employee Share Savings Plan (ESSP). The ESSP consists of annually commencing plan periods, each one comprising a 12-month savings period and a holding period following the savings period. The ESSP is offered to all F-Secure employees. The employees have an opportunity to save a proportion of their salaries and invest those savings in F-Secure shares. The savings are used for acquiring F-Secure shares quarterly after the publication of the respective interim reports. As a reward for the commitment, F-Secure grants the participating employees a gross award of one matching share for every two shares acquired with their savings. Continuity of employment and holding of acquired shares for the duration of the holding period are the prerequisites for receiving the award.

More information on the programs is provided in Note 19 Share-based payment transactions of the Financial Statements, as well as in the Remuneration Report, which is published separately from the Board of Directors report.

Shares and shareholders

At the end of December 2025, the registered share capital of F-Secure was 80,000 euros and the company had 174,707,070 fully paid shares. F-Secure has one share class and the company’s shares are included in a book-entry system.

Information on the authorizations held by the Board of Directors in 2025 to issue shares and special rights entitling to shares, to transfer shares and repurchase own shares, is available in the section on the Annual General Meeting 2025.

The closing price of the share at the end of December 2025 was EUR 1.93. In January–December 2025, the highest price paid was EUR 2.03 and the lowest EUR 1.59. In January–December 2025, the share’s volume weighted average price was EUR 1.73. The share trading volume was EUR 80 million or 46 million shares. On 31 December 2025, the company’s market capitalization was EUR 338 million.

The number of registered shareholders at the end of December 2025 was 35,317, including nominee registers. The proportion of nominee-registered and direct foreign shareholders was 9.52% of the company’s shares at the end of the year. The list of the shareholders of F-Secure Corporation is based on the information given by Euroclear Finland Ltd.

During or at the end of the financial year 2025, F-Secure did not hold any treasury shares.

During the financial year 2025, F-Secure has not received any flagging notification of change in holdings in accordance with Chapter 9, Section 10 of the Securities Market Act:

Short-term risks and uncertainties

Intensifying competition in the consumer security market could lead to a general decline in the price level and affect F-Secure’s ability to maintain or increase its market share, and the intensifying competition could thus have an adverse effect on F-Secure's revenue, profitability, and market share.

F-Secure may not be able to keep up with rapid changes in customer demand, distribution channels, technologies such as AI and the evolution of consumer cybersecurity threats such as scams, which could have an adverse effect on F-Secure reputation, competitiveness, operational results and financial position.

Uncertainty about F-Secure’s key markets, financial markets and general economic situation could have an adverse effect on F-Secure’s business and growth opportunities and reduce the demand or increase the cost of the products and services offered by F-Secure. Geopolitical instability has increased uncertainty in the world and the risk of unexpected disruptions of the world economy. For example, the war in Ukraine has caused some exceptional consequences to the cybersecurity landscape, such as highly visible governmental activities, as well as organized civilian response to the war efforts. In addition, there is a risk that F-Secure may be indirectly affected by escalating trade war (“tariffs”) that may increase inflation, reduce consumer purchasing power or otherwise negatively affect consumers and F-Secure's channel partners.

If F-Secure’s agreement with a significant business partner or Channel Partner is terminated or expires, or if F-Secure is unable to continue to work with a business partner or Channel Partner on acceptable terms, or if a channel partner fails to fulfill its obligations, this could significantly reduce F-Secure's revenues, increase its costs, hinder its operations and weaken its ability to provide services or solutions to its customers. In addition, some Channel Partners may be slow to adopt new solutions, which may delay F-Secure's revenue growth or increase maintenance-related costs.

The loss of key personnel and skilled employees, the possible delay in new hires or increase in personnel expenses could weaken F-Secure’s profitability and the standard of its services or solutions, hinder operations and prevent F-Secure from successfully developing and growing its business, including effective and differentiating innovation strategy.

Actual, possible, or perceived defects, disruptions or vulnerabilities in F-Secure products or services, including risks from usage of AI technologies, could lead to security breaches or cybersecurity attacks and errors. Such incidents may also result from errors or misuse by F-Secure employees or business partners. These issues could harm F-Secure or its customers' reputation, reduce sales, disrupt operations, tie up personnel resources, lead to contractual penalties or regulatory fines and increase other costs.

F-Secure channel partners may not always promote the latest version of our product offering, and end customers on various channels may be using older product versions ("legacy products"). Supporting these legacy products may increase F-Secure costs or adversely affect planned future product releases, their scope, availability and/or competitiveness, while migrating end-customers to the latest product versions may take time, require additional investments, and thus affect revenue growth.

F-Secure provides consumer cybersecurity solutions to some of the largest Service Providers in the world (“Tier 1 Channel Partners”) and aims to win new Tier 1 Channel Partner contracts. Tier 1 Channel Partners may require solutions that F-Secure is unable to develop, deliver and maintain at the expected level of profitability. These contracts may also expose F-Secure to Service Level Agreement claims (support penalties) or other similar and material contractual liabilities, such as related to a consumer data breach. F-Secure may be required to make upfront investments to develop and deliver these solutions, which may have a negative impact on F-Secure product roadmaps, company revenues and profitability.

F-Secure is in the process of transforming the company and its operating model with its growth strategy and taking advantage of AI capabilities in our offering and business processes. Changes in the company's strategic priorities, structure and processes may take time to become effective. Additionally, these strategic investments and changes may at least initially have a negative impact on the company's product roadmap and its operations. These combined can have a negative impact on the financial outlook of the company.

Any malfunction in technologies, IT systems or network connections used by F-Secure or any security breaches could result in disruption of F-Secure's service offerings. F-Secure may fail to register, protect, manage, maintain and enforce its intellectual property rights, and F-Secure may be subject to intellectual property infringement claims, which may result in significant costs. Leakage of personal data collected by F-Secure may have a material adverse effect on F-Secure’s business and reputation and result in claims for damages as well as fines and orders imposed by the authorities. As is customary in the cybersecurity industry, F-Secure protection is a combination of its own IPR and third-party solutions. F-Secure continues to have a relationship with Lookout and WithSecure for certain protection capabilities after the Lookout Life acquisition and Withsecure demerger. The inability of third parties such as Lookout or WithSecure to provide these protection capabilities could have a material adverse effect on F-Secure’s business and its customers.

The number of operations and locations outside the eurozone in different currencies exposes F-Secure to a risk related to currency fluctuations. Changes in the exchange rates between currencies could have an adverse effect on F-Secure’s revenue, results and financial position. F-Secure is exposed to transaction risks caused by purchasing and selling products and goods in currencies that are not F-Secure’s home currencies, in particular the US dollar. In addition, F-Secure is exposed to investment risks in its units abroad and translation risks that arise when investments in subsidiaries in different currencies are converted into F-Secure’s operational currency, i.e., the euro. Furthermore, F-Secure financed the acquisition of Lookout’s consumer security business with bank debt subject to leverage covenants. Failure to comply with the covenants would lead to early expiry of the debt. Changes in interest rates have an impact on interest costs.

Significant events after the review period

After the review period, on 13 January 2026, company announced the appointment of a new Chief Strategy Officer (CSO). F-Secure's SVP, Corporate Development and a member of the Leadership Team, Antero Norkio, decided to leave the Company on 30 January 2026. Jyrki Tulokas was appointed CSO and a member of the Leadership Team of F-Secure Corporation, effective 2 February 2026.

On 4 February 2026, F-Secure Board’s Personnel and Nomination Committee gave proposals to the Annual General Meeting scheduled for 25 March 2026 for the composition and remuneration of the Board of Directors. The Board’s Personnel and Nomination Committee proposes to that the Board of Directors consists of a total of seven (7) members and that the following persons be elected as members of the Board of Directors for a term expiring at the end of the Annual General Meeting 2027: Alessandro Adriani, Roxana Diaconescu, Pertti Ervi, Cornelia Schaurecker, Petra Teräsaho, Tommi Uitto are proposed to be re-elected as members. As F-Secure personnel member to-be-elected, the Personnel and Nomination Committee proposes Wilhelm Lamptey.

The Personnel and Nomination Committee proposes to the Annual General Meeting that the following annual remuneration be paid to the members of Board of Directors to be elected at the Annual General Meeting: EUR 80,000 annually for the Chair of the Board of Directors; EUR 38,000 annually for the external members of the Board of Directors; EUR 12,667 for members employed by F-Secure; EUR 10,000 additional remuneration for the Audit Committee Chair; EUR 4,000 additional remuneration for the Personnel and Nomination Committee Chair; EUR 2,000 additional remuneration for the members of Audit Committee as well as Personnel and Nomination Committee. The proposed annual fee and the fees for Committee work correspond to the current remuneration. In addition, The Personnel and Nomination Committee proposes that approximately 40 percent of the remuneration be paid as shares in the company repurchased from the market or as treasury shares held by the company.

Annual General Meeting 2025

The Annual General Meeting of F-Secure Corporation and organizational meeting of the Board of Directors was held on 1 April 2025. The Annual General Meeting adopted the annual accounts and the consolidated annual accounts for the financial year that ended on 31 December 2024, discharged the members of the Company’s Board of Directors and the CEO from liability, and approved all proposals made to the Annual General Meeting by the Board of Directors. The Annual General Meeting also approved the 2024 remuneration report for governing bodies. The resolution is advisory according to the Finnish Companies Act.

The Annual General Meeting resolved that for the financial year that ended on 31 December 2024, a dividend of EUR 0.04 per share to be paid in two instalments of EUR 0.02 per share each.

More detailed information regarding the decisions and board composition can be found in the stock exchange release published 1 April 2025. Similarly, the minutes of the Annual General Meeting are available on the company’s website at https://www.investors.f-secure.com/en/ investors/corporate_governance/governing_model/annual_general_meeting_2026

Outlook for 2026

Growth: F-Secure expects mid to high single-digit currency neutral revenue growth for 2026.

Profitability: The group’s adjusted EBITA is expected to be EUR 44–50 million in 2026 (2025: EUR 50.3 million).

• F-Secure expects the core consumer cybersecurity market to grow mid-single digit CAGR mid- to long-term. F-Secure sees the potential to grow faster than the market, focusing on partner channel and its offering around Embedded security and Scam Protection. The growth may be moderated by uncertainties around consumer sentiment in certain markets and general economic volatility.

• Partner business and especially Embedded Security solutions are expected to drive F-Secure growth during 2026. Growth is expected to accelerate throughout the year as the most significant new Tier 1 services gradually start to generate revenue and support profitability.

• Direct business revenue development is expected to be negative due to continued strategy of refraining from paid customer acquisition. Focus is on improving retention rate and ARPU.

• Gross margin is expected to be slightly lower than in 2025 (84.7%) due to growth of strategic partners with Embedded Security solutions, as these typically have a lower gross margin level than F-Secure Total business.

• F-Secure continues to develop its service, operations and production capabilities further to meet Tier 1 partner requirements. These efforts are reflected in the higher cost base. As business scales up we expect to leverage continued service level investments across a wider partner base, leading to positive Adjusted EBITA % development along with business growth.

• Capex level is expected to remain on a similar or slightly higher level as in 2025 related to both product development as well as technology infrastructure improvements.

1. Industry analyst views such as Gartner and IDC, and F-Secure management estimates.

Financial targets

F-Secure's medium-term financial targets and dividend policy reflect the company’s growth ambitions and strategic direction.

• Growth: High single digit growth (CAGR) with additional significant upside from major Tier 1 deal

• Profitability: Adjusted EBITA margin approaching 40% as revenue reaches EUR 200 million

• Dividend Yield: Around or above 50% of net profit; which can be adjusted as long as leverage is higher than the targeted level

• Leverage: Net debt / adjusted EBITDA ratio below 2.5x, excluding temporary impact from acquisitions

F-Secure Corporation follows the Rule of 40 metric as internal performance measurement and guiding principle, according to which the combined revenue growth rate and profitability margin should be equal to or greater than 40%.

Corporate Sustainability Statement

F-Secure has prepared its Sustainability Statement in accordance with the EU Corporate Sustainability Reporting Directive (CSRD) and the related Finnish legislation. The statement is published with this Board of Directors' Report; (Sustainability statement 2025).

Annual General Meeting 2026

The Annual General Meeting 2026 is scheduled for Wednesday, 25 March 2026. The Board of Directors will convene the meeting with separate stock exchange release.

Board of Directors’ proposal for the distribution of profit

According to the company’s dividend policy, F-Secure aims to pay around or above 50% of net profit as dividend on an annual basis, which can be adjusted as long as leverage is higher than the targeted level (2.5x). On 31 December 2025 distributable funds of F-Secure Corporation were EUR 15.2 million. As the leverage (2.8x) is above the target level, the Board of Directors proposes to the Annual General Meeting 2026 that a dividend of EUR 0.04 per share to be paid. Earnings per share (EPS) for the period January–December 2025 was EUR 0.13, and the proposed dividend is 31.2% of the group January– December 2025 earnings. The dividend is proposed to be paid in two instalments.

No material changes have occurred in the company's financial position since the end of the financial year.

Key figures

1. Excluding acquisition
2. Average number of personnel for 2022 represents the average employees after demerger (July-December 2022).
3. For carve-out period the average number of personnel consists of direct personnel working in the Consumer Security Business.

The key figures are presented combining actuals and carve-out basis for 1-12/2022 and on an actuals basis for financial position at 31 December 2022. For period 2021 financial information is on carve-out basis.

1. Board proposal for 2025
2. For 2022 dividend distribution was based on July-December 2022 net profit and 78% from July-December earnings.

Reconciliation between adjusted EBITDA, EBITDA, adjusted EBITA, EBITA and EBIT

Calculation of key figures

Shares and Shareholders

Reporting principles

BP-1 Basis for preparation

This group sustainability report has been prepared in accordance with the Accounting Act Chapter 7 and European Sustainability Reporting Standards (ESRS). The F-Secure group sustainability report has been prepared on a consolidated basis, and it covers the F-Secure Group with the same scope as our financial statements. The statement includes information on material Impacts, Risks and Opportunities (IROs) connected with our direct and indirect business relationships in our upstream and downstream value chain.

F-Secure has not omitted any information corresponding to intellectual property, know-how or innovation results, nor used the exemption from disclosure of impending developments in negotiations.

BP-2 Disclosures in relation to specific circumstances

Planning horizon

F-Secure defines short-term as 0-1 years, medium-term as 1-3 years, and long-term as 3+ years, aligning with our strategic planning cycles.

Value chain estimation

For GHG emissions, we use value chain estimations where actual data is unavailable, following GHG Protocol methodology. We aim to improve data quality by moving from estimations to actual emission data through stakeholder collaboration.

The quantification of GHG emissions in F-Secure’s emissions is systematical and any uncertainties have been reduced as far as practical. Consistent methodology has been used to allow for meaningful comparisons of emissions over time. Any changes to the data, inventory boundary, methods, or any other relevant factors are documented. It is usual to use estimations and sector averages in GHG calculation in cases where actual data is unavailable.

Section E1-6 Gross Scopes 1, 2, 3 and Total GHG emissions provides more detailed information on methodology and value chain estimation.

Sources of estimation and outcome uncertainty

GHG emission calculations contain uncertainty, particularly for Scope 3. Our limitations include restricted site-specific consumption data for Scope 2 and spend-based calculations for key Scope 3 categories. In Scope 1, leased cars data is limited, and the calculations have been done based on estimating contract kilometres and average consumption of car models. Section E1-6 Gross Scopes 1, 2, 3 and Total GHG emissions provides more detailed information on methodology and estimation uncertainty. Additional uncertainties exist in cybersecurity metrics objectivity. Section S4-5 Progress towards targets provides more detailed information on methodology and estimation uncertainty. Finally, the measurement of the metrics in this group sustainability report has not been validated by an external body apart from the assurance of this Group sustainability report, unless specifically stated otherwise under the disclosure requirement section of such metrics.

The reported Code of Conduct training target excludes individuals for whom employee status information is unavailable.

Forward-looking statement

Forward-looking information should be considered with caution as it's subject to risks and uncertainties that could impact our ability to achieve the described objectives or anticipated results.

Changes in preparation or presentation of sustainability information

F-Secure has chosen to change the E1 scope 3 related target of absolute emission reduction of 42% to emission intensity reduction of 52% between 2024 and 2030. The change has been made due to business growth compatibility, and it allows for better comparisons between different companies. We will continue to report absolute emission reduction of scope 3 in section E1-6 Gross Scopes 1, 2, 3 and Total GHG emissions.

Continue to report qualitative information but drop from Consumers and end-users S-4 targets the “Ratio of externally reported vulnerabilities compared to internally reported vulnerabilities” due to data quality issues affecting annual comparability.

The 2024 cybersecurity training completion rate initially excluded employees on extended leave. This has been corrected in 2025, and the 2024 cybersecurity training completion rate has been updated to include all employees.

Reporting errors in prior periods

The nature of the error was that calculation method for disclosure in table S1-9 Gender distribution was updated based on approved targets. In prior period section S1-5 Own workforce targets gender diversity (directors including leadership team, %) percentage for females was 25,1% and male 74,9%. Those were corrected this reporting period and corrected figures are female 23,5% and male 76,5 %.

The nature of the error was that calculation method for disclosure S1-13 Training was updated. In prior period section S1-5 Own workforce targets and career review target percentage was 82%. That was were corrected this reporting period and corrected figure is 88%.

Disclosures stemming from other legislation or reporting pronouncements

F-Secure has included in the Group sustainability report disclosures in section S4 Consumers and End-users related to the following legislation, standards and international principles:

1. Cybersecurity policy-related metrics and targets including cybersecurity training, cybersecurity incidents and bug bounty program, based on

• EU General Data Protection Regulation

• ISO 27001 information security management standard

2. Code of Conduct policy- and practice-related metrics, anti-corruption incidents and code of conduct training also based on (see section ESRS S4-1 for further details)

• OECD Guidelines for multinational enterprises

• United Nations Global Compact

• United Nations Guiding principles on Business and Human rights

• United Nations Convention against Corruption

• International Bill of Human Rights

• The Declaration of the International Labour Organization on Fundamental Principles and Rights at Work

Incorporation by reference

F-Secure calculates GHG intensity based on net revenue by dividing total GHG emissions (t CO₂eq) by net revenue (€). Net revenue is based on our financial statement (Cross-reference to financial section 3. Revenue).

The measures provided in the group sustainability report own workforce section are aligned with related data provided in other sections of the annual report noting that average annual number of personnel is used in the financial statement (Cross-reference to financial section 7. Personnel expenses).

Phase-In provisions

As a company with fewer than 750 employees in reporting year of 2025, we've omitted certain information required by ESRS E1 and ESRS S1 in accordance with Appendix C of ESRS 1.. F-Secure has chosen to omit the information prescribed by ESRS 2 SBM-3 paragraph 48(e) anticipated financial effects based on European Sustainability Reporting Standards ‘quick-fix’ delegated act of 11 July 2025. In addition, F-Secure has in our 2025 statement decided to omit matters related to “E1-9 Anticipated financial effects from material physical and transition risks and potential climate-related opportunities”. Related to our own workforce (S1), we’ve omitted “S1-7 Characteristics of non-employees in the undertaking´s own workforce” in full and “S1-14 Health and safety metrics” partially.

Governance

GOV-1 The role of the administrative, management and supervisory bodies

In this Group sustainability report, 'supervisory bodies' refer to the F-Secure Board of Directors, its Audit Committee and Personnel and Nomination Committee. 'Management body' refers to the F-Secure Leadership Team, including the CEO and leadership team members. The Board oversees company administration and appoints the CEO, who manages daily operations per Board instructions.

The highest decision-making body is the General Meeting of Shareholders, which elects Board members. The Board is responsible for F-Secure Group administration and the appropriate organization of its operations. The Board's duties are defined according to the Articles of Association, Finnish Companies Act, and other applicable laws and regulations, including overseeing business conduct and compliance, and approving significant governance policies.

Roles and Responsibilities

The Board has established an Audit Committee and a Personnel and Nomination Committee to enhance efficiency. The Audit Committee monitors risk management, internal controls, IT strategy, sustainability, and financial reporting, as well as auditing. Most committee members must be independent from the company, and at least one must be independent from significant shareholders. The Personnel and Nomination Committee prepares matters on Board composition and compensation, actively seeking qualified new Board members.

The Board and Leadership Team are supported by the Legal Team, which maintains business conduct policies and provides related training. Each Leadership Team member supervises policy implementation in their respective functions.

Composition and Diversity Information

As of 31 December 2025, F-Secure had 9 executive members in its management body and 7 non-executive members in its supervisory body (Board of Directors).

Table1. Composition and Diversity Information.

The Diversity Principles established by the Board strive for appropriately balanced gender distribution and diverse backgrounds. The Board comprises members aged 44-68 years with five different nationalities represented.

Access to Expertise on Sustainability Matters

The Board of Directors has received ESG training in 2024 to build appropriate skills and expertise to oversee sustainability matters. The training included information about the relevant EU-related regulations and the related responsibility of the Board of Directors. In addition, the training included information about the Double Materiality Assessment and third-party assurance of the Group sustainability report.

Additionally, a member of the Board who is also the current Chair of the Audit Committee has previous expertise in establishing sustainability-related reporting practices. Our financial assurer has the option to participate in Audit Committee meetings when ESG topics are reviewed, providing further access to ESG knowledge to the F-Secure Audit Committee. F-Secure Sustainability Council drives the ESG agenda across the company, with the Chair having previous experience in ESG-related matters, while our Chief People Officer similarly has previous experience in ESRS reporting.

ESG Governance Structure

ESG oversight is organized in layers:

1. Board of Directors: Reviews/approves strategy with ESG elements; updated at least annually on ESG progress

2. Audit Committee: Monitors ESG reporting, risks, and internal controls; reviews group sustainability report preparation and external assurance

3. Leadership Team: Establishes ESG strategy, ensures integration with company culture, approves policies and principles

4. Sustainability Council: Facilitates ESG strategy implementation, identifies/assesses ESG impacts and risks, drives sustainability reporting

5. Sustainability Function: Leads Sustainability Council and facilitates sustainability strategy implementation and ensures regulatory compliance

6. ESG Committees: Drive specific ESG initiatives (DEI, Wellbeing, and Environment)

The Sustainability Council typically meets monthly with key members, including the CFO, CPO, Legal Counsel, SVP of Corporate Development, and the Sustainability function lead. The Council includes participants from other functions like sales and product management.

The ESG Committees works in close collaboration with the sustainability function lead. ESG committees drive initiatives related to their respective topics through committee meetings to define and progress actions. Each ESG committee reports to the Sustainability Council at least twice annually. These progress updates include reviews of actions and targets. The ESG committees also participate in the annual IRO review process.

ESG activities are fully integrated with the company strategy and based on F-Secure values, Code of Conduct, and related policies. Management of identified IROs is conducted at least once a year by the Sustainability Council, with results shared with the Audit Committee for review and oversight. In the sustainability council, targets related to the IROs are proposed, and they are reviewed by the Audit Committee and Board of Directors and approved by the Leadership team. Targets are monitored in sustainability council meetings at least twice a year and reviewed by the Audit Committee and Board of Directors at least once a year.

GOV-2 Information provided to and sustainability matters addressed by F-Secure administrative, management and supervisory bodies

Information flow and frequency

The F-Secure Board reviews ESG annually, while the Audit Committee discussed ESG in 2 of 5 meetings during 2025. Updates on ESG topics to the Board, the F-Secure Leadership team, and the Audit Committee have been presented by the SVP of Corporate Development based on input from the monthly Sustainability Council meetings, which include key management representatives (CFO, CPO, Legal Counsel), the sustainability function, and other function representatives. Updates include F-Secure ESG plans and actions, policies and targets, and reports on their progress, as well as implementation of due diligence.

Consideration of IROs when overseeing company strategy and risk management

Sustainability-related risks and impacts are managed as part of F-Secure's risk management process. The primary goal is to enable the organization to identify and manage risks effectively by monitoring potential negative impacts and the likelihood of various situations arising from operations, markets, customers, and partners.

F-Secure encourages continuous risk assessment by personnel. Operational risks identified through this process are regularly reviewed by each function, including bi-annual reviews with the CEO, Leadership Team, and Audit Committee. Positive impacts and opportunities are embedded into the strategy process and considered during operating plan reviews.

Trade-offs related to IROs are evaluated during strategy development, weighing costs and benefits of different options to ensure alignment with organizational goals and stakeholder expectations. This approach ensures that sustainability considerations are integrated into company decision-making while balancing potential risks and opportunities.

Material Topics Addressed in 2025

In addition to the F-Secure Sustainability Council and its ESG committees, the respective management members and supervisory bodies have addressed the following material topics:

Table 2. Material topics addressed by management and supervisory bodies.

Specifically, with regard to Audit Committee and Board of Directors engagement and in addition to what is described under “ESG Governance Structure”, any changes in the DMA and/or IROs, and updates to targets have been reviewed by the Audit Committee during 2025. In addition, the decision was taken to commit to SBTi during this reporting year, and the decision to commit was reviewed by the Audit Committee.

GOV-3 Integration of sustainability related performance in incentive schemes

The F-Secure Leadership Team is eligible for the non-sales Short-Term Incentive (STI) Plan designed to reward achievement of financial and operational objectives, foster a performance culture, and focus on business plan execution.

The Leadership Team is also eligible for share-based long-term incentives (LTI), aligning shareholder and Leadership Team interests. Similar LTI plans apply to certain members of our administrative and supervisory bodies.

Role of sustainability-related targets in incentive schemes

The 2025 non-sales STI Plan includes Company Business Results (combined growth % and profitability %) and Company Employee Engagement (eNPS). These elements connect to our material sustainability drivers - growth indicates consumers are protected globally (building trust in digitality), while eNPS reflects employee well-being and satisfaction.

The non-sales STI Plan is included in the remuneration policy, with goals approved annually by the Board. Share-based LTI programs may be based on long-term financial/strategic performance or share value increase, with criteria focused on strategic financial targets.

Proportion of variable remuneration dependent on sustainability-related targets and approvals

The non-sales STI consists of:

• Business Results (combined growth % and profitability %): 60-80% weight

• Function-specific targets (may include sustainability-related targets): 0-20% weight

• Company Employee Engagement (eNPS): 20% weight

The Long-Term Incentive criteria for performance periods are based on strategic financial targets.

The Board of Directors approves annual STI designs and company-level targets based on Leadership Team proposals. For LTI programs, the Board determines terms, conditions, performance criteria, and objectives for each performance/vesting period.

STI or LTI plans do not currently contain climate-related targets.

GOV-4 Statement on Due Diligence

F-Secure's due diligence process identifies, mitigates, and addresses actual and potential negative impacts connected to our business, operations, value chain, offering, and business partners. This ongoing practice informs changes in our ESG governance, strategy, business model, operations, and sourcing activities.

Core elements of due diligence paragraphs in the Group sustainability statement

a) Embedding due diligence in governance, strategy and business model

ESG governance at F-Secure is described in the GOV-1 and GOV-2 sections. Our Leadership Team and Board of Directors oversee due diligence processes, with the Sustainability Council driving implementation. Due diligence considerations are integrated into our strategy and business model decisions.

b) Engaging with affected stakeholders in all key steps of due diligence

Through mapping all relevant stakeholders and conducting regular stakeholder engagement, F-Secure ensures an effective corporate sustainability due diligence process. The mapping includes employees, customers, suppliers, investors, and government bodies. We will review the stakeholder map when significant changes in the business model and strategy occur or if new impacts are identified as part of our IRO reviews, as described further under IRO-1 section.

c) Identifying and assessing adverse impacts

We identify potential impacts through our IRO assessment process outlined in the IRO-1 section. Our risk management is aligned with ISO-31000:2018 guidelines. No adverse impacts as described under "F-Secure impacts on people and the environment" have been identified.

d) Taking actions to address those adverse impacts

We address identified risks according to F-Secure's risk management policy, where risks have designated owners driving mitigation activities. We use risk modeling and quantification methods to identify and manage risks effectively, with proactive monitoring to build strategic resilience.

e) Tracking the effectiveness of these efforts and communicating

Each function tracks mitigation effectiveness and coordinates with relevant stakeholders. The Leadership Team and Audit Committee review risks biannually, while the Audit Committee regularly evaluates risk management process effectiveness. We communicate progress through our annual group sustainability report and regular stakeholder updates.

GOV-5 Risk management and internal controls over sustainability reporting

Control over sustainability matters is organized through policies, procedures, and processes developed by the sustainability function in collaboration with the Sustainability Council and relevant functions. These controls are approved by appropriate supervisory and management levels to support reliable and transparent sustainability reporting. The Audit Committee reviews Board-level policies and the group sustainability report preparation process, with the Code of Conduct and annual group sustainability report being approved by the Board of Directors.

Risk management and control processes in relation to sustainability reporting

F-Secure's internal control framework follows the Finnish Corporate Governance Code, covering policies, procedures, control activities, and monitoring. ESG is identified as a key process with specific internal controls for material topics. For sustainability reporting, we've implemented dedicated controls to ensure data accuracy, completeness, and reliability, including review procedures for ESG metrics before disclosure.

Internal control monitoring includes:

• Annual risk assessment

• Catalogue updates and gap follow-up

• Internal control self-assessments

• Internal control reporting

Risk assessment approach and main risks and mitigation strategies

The main identified risk related to sustainability reporting is the risk of reporting errors occurring, especially related to data points. Key risks related to data management and their controls are identified for each material topic and integrated into our internal controls matrix. Risks include ensuring climate change model updates are aligned with changes in accounting policy, talent acquisition/retention data validation, business approvals outside of workday, validation of reported vulnerabilities data accuracy, assessing the number of security breaches/incidents involving AI tools, etc. Each data point has a defined person of responsibility, control, and testing mechanism. The Sustainability Council reviews these controls annually, ensuring alignment between our materiality assessment, risk management approach, reported data, and related controls.

The scope of reported data points has not changed since 2024. Some controls have been updated to better focus on the part of the process of data management where we have identified the greatest risk.

Main risks, mitigation strategies and controls:

Table 3. Main risks, mitigation strategies and controls.

Integration with company processes

Our internal controls support reliable reporting and regulatory compliance. Sustainability-specific data collection procedures and verification processes have been established for material ESG metrics to ensure accuracy. Risk management is integrated across all levels, from function-specific reviews to Leadership Team and Audit Committee oversight of the preparation of the group sustainability report. The ESG controls are owned and implemented by the sustainability function and developed in collaboration with control owners and the CFO office. The findings of the controls are documented by control owners and reviewed by the sustainability function. Failure of a control triggers control and/or process improvement, and this is evaluated on a case-by-case basis. The updated control catalogue is shared with the CFO office responsible for the group control matrix. The CFO office reports control findings to the Audit Committee.

Furthermore, every employee at F-Secure who is responsible for producing data or narrative for the group sustainability report is invited to several information sessions where process instructions are shared. In addition, a writing instruction document has been created to support the functions responsible for producing the narrative. To support functions responsible for data management, a step-by-step description of how to conduct internal controls has been made available. Each function takes responsibility and ensures instructions and processes are followed. The ESG governance, in conjunction with the risk management policy and internal controls, and detailed process descriptions, ensures that the relevant internal functions remain aware of their responsibilities and that actions are taken to mitigate the risk of reporting errors, with proper oversight from the Audit committee, Leadership Team and Sustainability Council.

Strategy

SBM-1 Strategy, business model and value chain

Product and services offering

F-Secure provides cybersecurity solutions for consumers to protect their digital moments. Our portfolio offering includes Security Suite (F-Secure Total) with endpoint security, scam protection, privacy protection, password management, and identity protection capabilities. Our Embedded Security offering is embedded in partners' existing or new apps to protect consumers. During the reporting period, F-Secure has expanded the protection capabilities in its portfolio, especially in scam protection.

While F-Secure sells Total directly to consumers, the entire portfolio is built to be “fit to channel sales” and allows the customer experience to be seamlessly integrated with our partner’s go-to-market model, including co-branding and billing.

Furthermore, to support our partners, we offer a cloud-based Security Business Platform to drive growth, such as data-led business insights, marketing support and customer care support. In addition, our Partner Success teams support partners’ go-to-market activities such as Marketing & Sales Enablement and Lifecycle Messaging Services.

Markets and customer groups served

Our end-customers are consumers seeking holistic, easy-to-use security solutions. We serve consumers directly and through approximately 200+ Service Provider partners (communication service providers, retailers, banks, and insurance companies). Revenue in 2025 was 82% through partners and 18% direct, with a geographical distribution shown in Table 4.

Revenue per geographic regions

Table 4. Revenue geographical distribution.

F-Secure belongs to the Technology - Software & IT Services ESRS sector. Our operations and profitability are reported as a single operating segment, and F-Secure’s revenue in 2025 is 145.7 M€.

Employees per geographic regions

Table 5. Employees per geographic region.

Sustainability-related goals

Our strategy focuses on understanding human behavior to deliver effective security experiences and becoming the number #1 security experience company. We've shifted from point solutions to delivering all-in-one, holistic, and easy-to-use security applications or embedded protection in partners' offerings. Our portfolio strategy and delivering "brilliantly simple security experiences" approach allows us to ensure that we protect consumers and improve our product satisfaction scores (Net Promoter Score, NPS).

Furthermore, to realize our purpose of making every digital moment more secure for everyone, our go-to-market model is primarily channel-based and through Service Providers allows us to reach hundreds of millions of consumers behind these partners in our focus regions in Europe, North America and APAC/Japan.

Our channel-based go-to-market model through Service Providers creates the potential to reach hundreds of millions of consumers, prioritizing win-win partner relationships measured by revenue and partner satisfaction. Measuring our partner satisfaction is another critical sustainability-related goal to realize our purpose and protect consumers’ digital moments, as described in more detail in the chapter “Consumers and End-users”.

Business model and value chain

Our business model is based on selling subscription-based consumer cybersecurity software products and services directly through our own e-commerce platform and app stores, as well as through our channel partners such as Communication Service Providers. Our high-level value chain, including notable actors, operations and stakeholders are visualized in the Value Chain and Actors figure below.

Upstream Operations

1. Human Resources and Talent: Attracting scarce cybersecurity expertise through strong employer branding

2. Suppliers (Technology): Strategic mix of in-house capabilities and third-party solutions

3. Suppliers (IT): Cloud infrastructure and business system providers

4. Partnerships: Collaborations with industry organizations and academia

5. Financial: Access to funding and addressing investor needs through profitable growth

6. Regulatory Compliance: Monitoring ESG, AI and data privacy regulations

Core Operations

1. Product Development: Research and innovation, setting portfolio vision, roadmap, and product creation and maintenance

2. Partner Sales: Primary sales channel through Service Providers

3. Direct Consumer Sales: Revenue source and consumer insight generator

4. Services: Delivery, production, operations, customer care, and partner success services

5. Trust Foundation: Secure data handling, operations and ethical business conduct

6. Talent Development: Employee well-being and diversity initiatives

7. Business Support: Finance, HR, Legal and other enabling functions

8. Governance: Board-level strategic direction and oversight

Downstream Operations

1. Partner Channel: Partnerships with Service Providers to deliver security as a core service or a value-added service, creating a new revenue stream and positively impacting their core business, customer retention, and brand relevancy

2. Direct Distribution Channels: Consumer security services made available through our own e-Commerce platform and third-party app stores (Apple and Google)

SBM-2 Interest and views of stakeholders

Table 6. F-Secure stakeholder map.

				Stakeholder expectations	How engagement is organized	F-Secure actions and outcome from engagement
Investors and financial institutions				Consistent growth and progression Clear and attainable goals Transparency in sustainability reporting Good Business conducts and data protection Ability to pay, liquidity	ESG surveys, calls and emails ESG ratings Capital market day Regular meetings with banks and analysts	Renewing relevant ESG ratings Renewing relevant ESG ratings, ESG targets and progress available on webpagese
Employees (Fellows)				Caring employer Securing retention and incentivizing compensation Opportunities for professional development Good business ethics and capability to protect our customers Global DEI agenda	Employee surveys Personal development dialogues DEI Committee and Wellbeing and Committee Employee-elected board member Townhalls and trainings	Increase internal Sustainability communication Organize first Sustainability day Improvement of personal development dialogues Update of of Wellbeing committee and launch of wellbeing hour every week Development of F-Secure sustainable AI framework.
Partners				Securing digital moments, together Reducing GHG emissions Good margins and shared values Reporting and targets on relevant ESG topics ESG policies aligned with partners policies	Partner survey and discussions Engagement with Sales ESG ratings	Renewing relevant ESG ratings Improvement on reporting ESG webpages updated ESG training of sales improving dialogue with partners ESG training of sales improving dialogue with partners SBTi Commitment
Consumers				High level of protection for good price Understanding customer needs Knowledge about cybercrime Reliable and simple solution	Customer support and guidance Surveys	ProduESG webpage update Improve EcoVadis rating Increase cybersecurity awareness through campaigns
Policymakers and regulators				Regulatory compliance Transparency in sustainability reporting Addressing ESG Risks and opportunities	Answering public consultations Participating in feedback rounds concerning new regulations and legislations	Flexibility to changing regulatory environment Value creation and risk mitigation
Suppliers				Favorable payment terms Good business ethics and conduct Climate change and human rights Trust and transparency	Cybersecurity examination of suppliers conducted by CISO office Basic supplier onboarding process Basic review of main suppliers ESG priorities	Development of Procurement policy of conduct covering main sustainability topics Launch of supplier environmental data gathering program as part of GHG emission mitigation strategy

Through ongoing dialogue and engagement with our stakeholders, we strive to understand our stakeholders’ positions, requirements, concerns, and expectations in more detail. This continuous interaction provides input to our strategy and ESG-related policies, actions, and processes, allowing us to align with the interests and views expressed by our stakeholders. As part of our Double Materiality Assessment review, we engaged key stakeholders, including financial institutions, our workforce, end-customers, the Board, and sales providing channel partners, while also analyzing regulatory requirements.

While the DMA review didn't result in material changes to our strategy or business model, we expect stronger stakeholder relationships through regular dialogue and complementary ESG agendas, particularly with Service Providers. We'll continue acting transparently, pursuing our goals and fostering future stakeholder collaboration.

Informing internal stakeholders on stakeholder interests

Stakeholder feedback has been reviewed by the Sustainability Council, which includes several Leadership team members. Our Sustainability Council regularly reviews and updates DMA and IROs, and management bodies will be informed of any significant stakeholder feedback changes affecting strategy and business model. We'll continue considering feedback in our risk management process and annual strategy reviews.

Consumer interests

For clarity, within the context of this Group sustainability report, the terms “consumer” and “end-user” should be treated as synonyms unless explicitly stated otherwise. 

F-Secure conducts regular consumer and market surveys to align product roadmaps with needs, gathering additional feedback through customer care and Service Providers. Market studies and consumer insights inform both product and channel strategies, with 81% of consumers expecting security services from internet providers. We simplify security by embedding it in partners' apps, eliminating the need for consumers to download new applications.

F-Secure’s commitment to international principles is not limited to internal operations but extends to its end-users. The company ensures that its products and services are designed and delivered in a manner that respects human rights and ethical standards. This includes data privacy protections, secure processing of personal data, and transparent communication about user rights and responsibilities. Finally, we are continuously monitoring evolving legislation in our key markets that impacts consumers. This includes, for example, EU GDPR and its impacts on the extent to which we collect consumer data and how it is processed at F-Secure.

Own Workforce interests

F-Secure involves its workforce in the Double Materiality Assessment, regularly gauges well-being, and obtains feedback on current events and company strategy. These results are reviewed by the Leadership Team and each function to drive related actions (where needed). Furthermore, we

• Ensure that we work according to our Code of Conduct, which includes respecting human rights

• Actively communicate company direction and priorities. This allows every employee to understand how their roles contribute to the broader company goals, thus making them feel connected to the company’s direction

• Emphasize F-Secure’s cultural values and how things are done at F-Secure to encourage employees to align their actions with shared values. Values are also used as part of our performance management (“how” things got done in addition to “what”).

Value chain workers’ interests

F-Secure respects its value chain workers' human rights through supplier Code of Conduct and partner agreements, focusing on fair labor practices, safe working conditions, and freedom of association and collective bargaining. F-Secure has a supplier Code of Conduct and agreements with certain partners, which seek to ensure that they meet the company's standards for responsible business conduct, including the treatment of their workers. 

SBM-3 Material impacts, risks and opportunities and their interaction with strategy and business model

F-Secure creates positive social impact through its core business of protecting people from cybersecurity threats via its consumer security products and services. The company extends this impact by providing free tools and educational resources to raise society-wide awareness of cyber threats.

For its workforce, F-Secure prioritizes employee well-being through equal treatment and professional development opportunities. The company fosters an open culture where employees are encouraged to speak up, supported by a whistleblower channel that ensures concerns can be raised without fear of retribution.

Environmentally, while F-Secure currently deploys solutions on climate-neutral platforms like AWS, the company recognizes future challenges as AI adoption and customer growth increase energy demands. This drives the company's focus on green coding practices to minimize environmental impact as operations scale.

Table 7. F-Secure impacts.

Table 8. F-Secure risks and opportunities.

Interaction with strategy and business model

The positive impacts related to consumers and end-users are directly linked to F-Secure's purpose, the reason why we exist, and thereby with our business model and strategy. We are in the business of protecting consumers' digital moments against cyber threats, especially scams, directly and through our partners.

F-Secure's ambition for the long term is to increase our positive impact further globally based on our growth strategy of i) continuously expanding how we protect consumers' digital moments and ii) increasing reach and scale through our Service Provider partners. We continue to see end-customers turning to Service Providers for protection, while our partners see consumer security as an integral part of their brand promise and a business opportunity. Therefore, in every aspect of our operations, we emphasize responsible business as trust is foundational in our industry and applies to both our partners and consumers.

Positive social sustainability- and governance-related impacts have already materialized, and we see them having an increasingly positive impact also in the long term. The potential positive impacts related to green coding will grow over time, and we expect an actual impact to materialize in the long term.

Effects of IROs on strategy and decision making

Our strategy is directly informed by our most material positive impact: Protecting consumers' digital moments. Our continuous and comprehensive analysis of the threat landscape and consumer needs guides product investments, go-to-market and marketing strategies, and channel partnerships. We also see the rapidly evolving threat landscape as a growth opportunity, creating further need for effective scam protection and leveraging AI capabilities.

Employees turn our strategy into cohesive execution plans. To support these plans, our culture program, DEI initiatives, and employee well-being strategies mitigate risks related to talent acquisition and retention while making positive impacts on our workforce. We've implemented gender pay gap adjustments and are fostering an inclusive culture with speak-up values.

To maintain trust in the cybersecurity industry, we've improved vulnerability management processes and maintain high standards supported by our ISO27001 certification, which was validated again during 2025. Our Code of Conduct awareness programs address business ethics risks, which is fundamental in building trust.

For climate change, we're developing reduction pathways across Scope 1-3 emissions, focusing on supplier engagement, green energy use and electric vehicle adoption to reach our 2030 reduction targets.

Effects on F-Secure’s financial position

Management has not recognized that  F-Secure's material risks and opportunities have affected the undertaking's most recently reported financial performance, financial position and cash flow, or identified any material risks and opportunities for which there is a significant risk of a material adjustment within the next annual reporting period to the carrying amounts of assets and liabilities reported in the related financial statements. 

Resilience addressing material IROs

F-Secure's strategy and business model are considered resilient to address material impacts and risks, and leverage opportunities identified as part of our strategy process for the next strategy period (2026–2028), which is F-Secure's definition of the mid-term period (1–3 years). This included both qualitative and quantitative analysis, expert assessments, and external consultation. Additionally, F-Secure is a highly profitable company with a strong cash flow, providing the ability to invest in our growth initiatives and mitigate key risks.

For resilience against climate change, refer to the Climate Change section for transition and physical-related risks.

Entity-specific IROs

F-Secure has identified some entity-specific impacts, risks and opportunities related to social topics, which is where F-Secure makes the largest contribution. The descriptions in the entity-specific section include contextual information and any assumptions made when calculating the measure or target, see Section S4-5 Progress towards targets for more detailed information on methodology and estimation uncertainty. When developing entity-specific measures and targets, F-Secure has considered how they can support reducing negative outcomes and increasing positive outcomes for people. The measures and targets have been developed for IROs where we have identified material impacts, risks or possibilities in the short, medium or long term that exceed the threshold for financial impact (see section IRO-1).

In short, and based on our double-materiality analysis, these entity-specific disclosure requirements apply to S4 Consumers and End-Users, see table Consumers and end-users list of IROs for the specification of those impacts, risks and opportunities.

Changes to the material impacts, risks and opportunities compared to the previous reporting period

Table 9. Changes in impacts, risks and opportunities since last reporting year.

Impact, risk and opportunity management

IRO-1 Identify and assess material impacts, risks and opportunities

F-Secure completed its first Double Materiality Assessment (DMA) in 2022 and refined it in 2023-2024, aligning with the final European Sustainability Reporting Standards and EFRAG guidance. The assessment follows these principles:

• ESG matters based on EFRAG standards, with SFRD and NFI regulations reviewed

• Sector and entity-specific topics assessed when relevant, particularly for cybersecurity

• Double materiality approach considering impacts on F-Secure and F-Secure's impacts on sustainability

• Use of quantitative and qualitative thresholds for IROs

• Engagement with affected stakeholders to inform the process

• Cross-cutting matters reported regardless of materiality assessment outcome

Critical input came from dialogue with key stakeholders, including Service Provider partners, investors, bankers, our workforce, consumers, suppliers, and regulators, as described under 1.3.2 SBM-2 Interest and views of stakeholders. We applied EFRAG guidance and expert interpretation to develop scoring matrices identifying material sustainability matters.

F-Secure recognizes that impacts, risks, and opportunities are interdependent and form an interconnected system. This understanding shapes the company's approach to sustainability management and governance, which is integrated into business strategy and risk management. For example, understanding that consumer protection impact depends on partner relationships, which creates both risks towards partnership channel and opportunities through, for example, increasing awareness, which can increase positive impacts.

In 2025, we reviewed the Double materiality assessment with internal relevant functions and conducted stakeholder engagement with our own workforce, financial institutions, and sales to get the partner point of view to ensure all IROs are up to date.

Material ESG Topics

Based on our assessment, we identified the following material topics:

Table 10. F-Secure material topics.

After screening the locations, we did not identify material impacts, risks or opportunities related to pollution, water resources, biodiversity, or resource use. We have no operations near biodiversity-sensitive areas or activities negatively impacting land. Both own operations and value chain have been assessed as part of the double materiality assessment. The assessment methodology was the same for all topics and has been described in section IRO-1, Double Materiality Assessment Methodology.

The scope of topics assessed as material has not changed since 2024.

Business Conduct Assessment

We assessed business conduct on a global level, considering M&A activities and operations in countries with elevated corruption risks. The financial impact of potential unethical behavior is estimated to reach the thresholds of materiality, but the likelihood is assessed as low. F-Secure is operating with large international partners with clear business codes of ethics and practices decreasing the risk of any anti-business conduct behavior. As F-Secure’s operations are global, there are countries in which F-Secure has operations and where risks related to corruption and fraud are elevated.

Financial Effects of Risks and Opportunities

The assessment of risks and opportunities with potential financial effect was based on thresholds for financial materiality (magnitude) and likelihood. The risks are included in the company's risk management process, where the company-level risks are prioritized based on risk impact and likelihood, while opportunities are managed as part of the company's strategy and function-specific execution plans.

Assessment Process

When assessing IROs, we focused on areas where impacts, risks and opportunities are likely to arise based on our activities, relationships, and geographies. Both own operations and value chain have been assessed as part of the double materiality assessment. We indicate whether impacts and risks are in our own operations (OO) or value chain; Downstream (DVC) and Upstream (UVC), and whether impacts are positive or negative. Impacts were assessed using the scale and scope criteria presented in Table 11. Where impacts were potential rather than actual, likelihood was also assessed. For negative impacts, the assessment additionally considered remediability.

Material items exceeded one or more thresholds: strong stakeholder request, financial impact, scope/scale of event impact, or likelihood. A topic was considered material if it scored '3' in any category or met the financial impact threshold. The Double materiality assessment has been reviewed by the Sustainability Council and the Audit Committee and approved by the Board of Directors. The assessment process and methodology have not changed since the last reporting period.

As a result of the analysis, no adverse impacts have been recognized, however we have recognized risks that might lead to adverse impacts if realized. The impacts have not been included in the materiality analysis as the likelihood that these risks would materialize is more unlikely than likely. Assessment and prioritization of risks were made based on the threshold set for determining materiality as described in the Table Description of assessment methodology.   

Table 11. Description of assessment methodology.

Decision-Making Process and Internal Controls

Our Sustainability Council reassesses our DMA and IROs regularly. Updating of controls is presented to the Sustainability Council and Financial Controlling. The Council is informed of any control failures and presents risk mitigation actions. Depending on the nature of the control failure, the Audit Committee may be informed. The internal control procedure is described in more detail in section GOV-5 Risk management and internal controls over sustainability reporting.

F-Secure's risk management is a continuous process, with material sustainability risks included in our company-wide top 9 risk map. Each Leadership Team member is accountable for risk management in their functions.

Integration with Risk Management Process

Our Risk Management Policy explicitly requires evaluating the short-, medium- and long-term time horizons, taking into consideration the severity of the impact (scale, scope, remendability) and probability for any ESG-related risks, including actual and potential negative impacts, and in the case of a potential negative human rights impact, the severity of the impact takes precedence over its likelihood.

The responsibility of keeping our DMA relevant and up to date lies with F-Secure's Sustainability Council, through annual reviews. Any actual or potential negative impacts or risks found during the assessment would be assigned and owned by each respective function to mitigate the risk or negative impact as part of our risk management process, while actual or potential positive impacts, as well as opportunities, are integrated as part of F-Secure's strategy and relevant function execution plans.

Process to identify and assess climate-related impacts, risks and opportunities

F-Secure conducted a systematic assessment of climate-related impacts, risks, and opportunities as part of the double materiality assessment process. The identification process incorporated collaboration with internal functions, stakeholder engagement, and review by the Sustainability Council.

Physical Risk Assessment

F-Secure screened climate-related hazards to determine whether assets or business activities may be exposed to these hazards. The assessment considered F-Secure's operational footprint across different geographic locations, evaluating vulnerability based on regional climate risk profiles. Given the company's limited physical asset base as a cloud-based software provider, physical risks were assessed as having limited materiality. The analysis considered both acute events, such as flooding, and chronic conditions, such as heat stress, particularly for locations with higher vulnerability, such as India and Malaysia.

Transition Risk Assessment

The process to identify transition risks evaluated policy and legal developments, technology shifts, market changes, and reputational factors. F-Secure assessed potential impacts across short-term, medium-term, and long-term horizons, aligned with standard financial planning periods. The assessment considered F-Secure's value chain, with particular focus on Scope 3 emissions representing over 90% of total emissions.

Use of scenarios in the process and consideration of limiting global warming to 1,5 degrees

F-Secure developed three climate scenarios aligned with IPCC AR6 pathways to test strategy resilience: Orderly Transition (SSP1-2.6), Disorderly Transition (SSP2-4.5), and Hot House World (SSP5-8.5). This scenario analysis examined how climate-related risks might materialize under different futures, with specific consideration of pathway limiting global warming to 1.5-2°C consistent with Paris Agreement objectives.

The scenarios evaluated critical uncertainties, including policy implementation speed, stakeholder expectations evolution, and supply chain decarbonization pace. Through this process, F-Secure identified reputational risk from failing to meet emission reduction targets as the primary material climate risk, given stakeholder expectations and the company's dependency on supply chain emission reductions to achieve its target by 2030. The scenarios confirmed that physical risks exist and may increase over time, but they remain below the materiality threshold compared to transition risks.

IRO-2 Disclosure requirements

F-Secure has included the following disclosure requirements in our group sustainability report, as outlined in the following table.

Table 12. Topic Disclosure requirements Index.

Table 13. Disclosure Requirement and related datapoint SFDR reference.

1. Regulation (EU) 2019/2088 of the European Parliament and of the Council of 27 November 2019 on sustainability-related disclosures in the financial services sector (Sustainable Finance Disclosures Regulation) (OJ L 317, 9.12.2019, p. 1).
2. Regulation (EU) No 575/2013 of the European Parliament and of the Council of 26 June 2013 on prudential requirements for credit institutions and investment firms and amending Regulation (EU) No 648/2012 (Capital Requirements Regulation “CRR”) (OJ L 176, 27.6.2013, p. 1).
3. Regulation (EU) 2016/1011 of the European Parliament and of the Council of 8 June 2016 on indices used as benchmarks in financial instruments and financial contracts or to measure the performance of investment funds and amending Directives 2008/48/EC and 2014/17/EU and Regulation (EU) No 596/2014 (OJ L 171, 29.6.2016, p. 1).
4. Regulation (EU) 2021/1119 of the European Parliament and of the Council of 30 June 2021 establishing the framework for achieving climate neutrality and amending Regulations (EC) No 401/2009 and (EU) 2018/1999 (‘European Climate Law’) (OJ L 243, 9.7.2021, p. 1).
5. Commission Delegated Regulation (EU) 2020/1816 of 17 July 2020 supplementing Regulation (EU) 2016/1011 of the European Parliament and of the Council as regards the explanation in the benchmark statement of how environmental, social and governance factors are reflected in each benchmark provided and published (OJ L 406, 3.12.2020, p. 1).
6. Commission Implementing Regulation (EU) 2022/2453 of 30 November 2022 amending the implementing technical standards laid down in Implementing Regulation (EU) 2021/637 as regards the disclosure of environmental, social and governance risks (OJ L 324,19.12.2022, p.1.).
7. Commission Delegated Regulation (EU) 2020/1818 of 17 July 2020 supplementing Regulation (EU) 2016/1011 of the European Parliament and of the Council as regards minimum standards for EU Climate Transition Benchmarks and EU Paris-aligned Benchmarks (OJ L 406, 3.12.2020, p. 17).

EU Taxonomy

Taxonomy reporting

F-Secure has assessed the taxonomy-eligibility and taxonomy-alignment of its economic activities according to the EU Taxonomy Regulation (EU) 2020/852, the Climate Delegated Acts (EU) 2021/2139 and (EU) 2023/2485, the Environmental Delegated Act (EU) 2023/2486, the Disclosures Delegated Act (EU) 2021/2178 and other related guidance from the European Commission.

The analysis has been performed in collaboration between the F-Secure financial controlling and sustainability function and reviewed by an external sustainability consultant.

A taxonomy-non-eligible activity is defined as an activity not listed in Commission Delegated Regulations (EU) 2021/2139 and (EU) 2023/2485 or Commission Delegated Regulation (EU) 2023/2486. F-Secure operates in the field of cybersecurity software, which is a business area currently not covered by the EU Taxonomy and is therefore not taxonomy eligible. While Commission Delegated Regulation (EU) 2021/2139 (Climate Delegated Act) endorses computer programming as a taxonomy eligible activity (8.2 Computer programming, consultancy and related activities), the description of the activity is broad and does not specify whether or not the activity needs to be associated with software and consulting relevant to climate change adaptation or mitigation. It is also evident, based on Section 8.2 in Annex II, that it concerns expert services rather than the type of activities F-Secure offers. As F-Secure’s business activities are clearly not aimed towards climate change adaptation or mitigation, and climate change adaptation has been identified as not material in a recent double materiality assessment for the company, we do not consider our business activities to be taxonomy-eligible, and we provide the tables for turnover, capex and opex with only taxonomy-non-eligible information (part B of the tables). F-Secure has taken into account the 4 other climate and environmental objectives (water and marine, circular economy, pollution, biodiversity, and ecosystem), and they do not lead to potentially eligible economic activities in this section. Furthermore, F-Secure is not involved with any nuclear energy-related activities or fossil gas-related activities as disclosed in the section Involvement with nuclear energy and fossil gas-related activities. We closely follow further developments of the taxonomy reporting requirements and will update the assessments when new legislation is published or when new information regarding its application becomes available. New activities, with new environmental targets in future versions of the taxonomy, might be more relevant for F-Secure and trigger a need of re-assessing both eligibility and alignment. Taxonomy-eligible turnover is defined as the proportion of net turnover derived from products or services, including intangibles, associated with taxonomy-eligible economic activities. As F-secure has not recognized any taxonomy-eligible economic activities, only the turnover on taxonomy-non-eligible activities is disclosed.

EU Taxonomy disclosure, reporting change from 2024; IFRS 16 Leases are included in Capex instead of Opex. At the same time right-of-use assets related depreciations are excluded in Opex.

Turnover

Taxonomy-eligible turnover is defined as the proportion of net turnover derived from products or services, including intangibles, associated with taxonomy-eligible economic activities. As F-secure has not recognized any taxonomy-eligible economic activities, only the turnover on taxonomy-non-eligible activities is disclosed.

Turnover is based on our financial statement (Cross-reference to financial section 3. Revenue).

Turnover

Operating expenditure

The operating expenses (0.720 MEUR) included in the taxonomy assessment are defined as direct non-capitalized costs that relate to research and development, building renovation measures, short-term lease, maintenance and repair, and any other direct expenditure relating to the day-to-day servicing of assets of property, plant and equipment by the undertaking or a third party to whom activities are outsourced that are necessary to ensure the continued and effective functioning of such assets (2021/2178). In F-Secure’s calculation, the operating expenses related to the maintenance of premises are included. F-Secure utilizes the third-party cloud platforms of Amazon Web Services (AWS) and Microsoft Azure for the majority of its operations. Cloud hosting costs are not included in the operating expenses, subject to the taxonomy assessment.

As F-secure has not recognized any taxonomy-eligible economic activities, only the Opex of taxonomy-non-eligible activities is disclosed.

Operating expenditure

Capital expenditure

The capital expenses included in the taxonomy assessment are defined as additions to tangible and intangible assets during the financial year, considered before depreciation, amortization and any re-measurements, including those resulting from revaluations and impairments, for the relevant financial year and excluding fair value changes (2021/2178). F-Secure’s capital expenses are 17.799 MEUR in total. Capital expenditure includes capitalizations of development expenditure on new products or product versions with significant new features, partially or completely internally developed intangible assets that relate, for example, to platforms and software licenses. These are intangible assets according to the IAS 38 accounting standard. Capital expenditure also includes right-of-use assets according to IFRS16 Leases. A minor part of capital expenses relates to capitalization of employee laptops and other hardware, as well as office furniture and renovation expenses.

As F-secure has not recognized any taxonomy-eligible economic activities, only the Capex of taxonomy-non-eligible activities is disclosed.

Capital expenditure is based on our financial statement (Cross-reference to financial section 14. Non-current assets).

Capital expenditure

Involvement with nuclear energy and fossil gas related activities.

Table 14. Involvement with nuclear energy and fossil fuel generating activities.

E1 – Climate change

SBM-3 Material impacts, risks and opportunities

Table 15. Climate change list of IROs.

Interaction with strategy and business model

F-Secure's climate resilience analysis covers its own operations, upstream and downstream value chain activities. The resilience analysis covers transition risks, including policy and regulatory developments, technology changes, market requirements, and reputational risks related to climate mitigation targets. Physical risks assessed are marked with “x” in Table 16, Climate SBM-3 physical risks. Physical risks in locations with fewer than 20 employees have been excluded from the analysis due to limited operational footprint and the absence of owned assets in these areas. These material IROs are evaluated in terms of their impact on F-Secure's strategy and business model, ensuring that the scope of the analysis comprehensively addresses potential vulnerabilities and opportunities for adaptation.

Climate physical risks

F-Secure has assessed and defined its strategic response to climate change through scenario analysis aligned with limiting global warming to 1.5°C in accordance with the Paris Agreement. The assessment confirms that F-Secure's existing business model remains compatible with this pathway when complemented by targeted climate mitigation measures integrated into current operational processes and strategy. The details of this strategic response are disclosed in the section Ability to adapt strategy and business model to climate change.

Table 16. Climate physical risks.

1. x = hazard included in the assessment

Transition assumptions

The transition to a lower-carbon and resilient economy will likely influence macroeconomic trends by driving economic growth through green technologies and sustainable practices. Energy consumption will shift towards renewable sources like solar and wind, reducing reliance on fossil fuels. National and international policies will be crucial in promoting GHG emission reductions and supporting renewable energy adoption.

Key Transition Events

Using the STEEP framework, we identified the following key driving forces that could impact F-Secure's climate strategy:

Table 17. Key driving forces.

The only material transition risk identified is reputational risk from failing to meet mitigation targets aligned with the Paris Agreement, which could affect stakeholder expectations. This risk is significant because 97% of F-Secure's emissions come from Scope 3 categories, making emission reduction heavily dependent on supply chain performance.

Time horizons, climate scenarios and reduction targets

F-Secure has set a GHG reduction target for 2030 and developed a transition plan with defined reduction pathways and annual actions. We use scenarios as a tool to analyze environmental resilience, with time horizons for 2030. Our scenario analysis follows TCFD methodology and incorporates the latest IPCC AR6 findings to evaluate three distinct scenarios:

1. Orderly Transition (SSP1-2.6): Coordinated global climate policy with gradual carbon price increases by 2030. Partner SBTi commitments rise steadily from approximately half by mid-decade to a significant majority by 2030. Supply chain costs increase moderately. F-Secure's 52% intensity reduction target is achievable with systematic supplier engagement requiring moderate annual investments, generating positive returns through market differentiation and potential modest revenue premiums in enterprise segments.

2. Disorderly Transition (SSP2-4.5): Fragmented policy until 2027-2028, then sudden, stringent responses. Carbon prices spike dramatically within 18 months. Partner requirements accelerate abruptly, potentially threatening material revenue if unmet. Supply chain costs surge significantly. Target achievement faces a moderate to high failure probability, requiring substantially increased emergency investments from 2027. Non-compliance penalties could reach material percentages of global turnover.

3. Hot House World (SSP5-8.5): Weak, fragmented policy with low carbon prices. Market segmentation creates divergent standards: a significant minority of partners (primarily EU/US West Coast) require science-based targets, while others maintain business-as-usual. Physical disruptions cause several days of annual supply chain disruption by 2030, moderately increasing costs. F-Secure risks exclusion from a portion of EU/Nordic enterprise RFPs without climate credentials. Target achievement depends on internal commitment, requiring higher annual investments justified primarily through market access rather than regulatory compliance.

Physical risks were not found to be significant as F-Secure has no assets in high-risk regions. The majority of employees are located in Finland and other Nordic countries with relatively mild projected climate impacts, while some limited exposure exists in India and Malaysia. For transition risks, we identified reputational risk if we fail to meet Paris Agreement-aligned targets.

Utilization of scenario analysis and transition plan

The utilization of F-Secure scenario analysis is to answer the focal and secondary questions that F-Secure has on climate change related to its own business and strategy:

Focal Question:

• "If F-Secure fails to meet its climate change mitigation target of reducing emission intensity by 52% by 2030, what would be the strategic and financial implications under different climate futures, and what actions should be taken to address these risks?"

Secondary focal questions:

• "How will climate-related transition risks, particularly stakeholder expectations, evolve over different time horizons and scenarios?"

• "What strategic and operational adjustments are needed to ensure F-Secure can meet its climate targets under different climate futures?"

• "What climate-related opportunities might emerge for F-Secure under different scenarios?"

A climate transition plan is utilized as a strategic roadmap that guides a company's pathway toward aligning its business model and operations with the transition to limit global warming to 1.5°C in line with the Paris Agreement. The transition plan translates climate commitments into actions, resource allocations, and governance mechanisms across business functions through clear decarbonization levers and implementation timelines.

Anticipated financial effects

Regarding material transition risks related to supply chain dependency, F-Secure may face economic impacts if we fail to meet climate targets aligned with stakeholder expectations. While specific financial impacts vary across scenarios, our analysis shows that meeting our 52% intensity reduction target requires different levels of investment and supplier engagement in each scenario, with the disorderly transition presenting the highest potential costs.

Results of the resilience analysis

F-Secure is considered climate resilient due to our business nature as a software company. Our current strategy aligns well with an orderly transition scenario, providing sufficient time to implement emissions reductions methodically. However, our strategy would face some challenges in a disorderly transition due to abrupt policy changes and rapidly evolving partner requirements. In a hot-house world scenario, our strategy would likely not meet its targets due to limited transition pressure in the supply chain.

Key strengths include our current emissions tracking approach and early work on emissions inventory. Vulnerabilities include heavy supply chain dependency in reaching the scope 3 target.

Performance Under Orderly Transition: F-Secure's current strategy aligns well with this scenario, providing sufficient time to implement emissions reductions in a measured way.

Performance Under Disorderly Transition: F-Secure's current strategy would face challenges in this scenario due to the abrupt policy changes and rapidly evolving partner requirements.

Performance Under Hot House World: The current strategy would likely not meet its targets in this scenario due to limited transition pressure in the supply chain, and would face increasing physical impacts, particularly in vulnerable locations.

Strategic response: ability to adapt strategy and business model to climate change

F-Secure's ability to adapt is embedded in our dynamic strategy process. Based on the scenario analysis, F-Secure has identified strategic measures to enhance climate resilience:

1. Enhanced Supplier Emissions Data Collection: Implementing systematic data collection from major suppliers and integrating climate criteria into supplier selection.

2. Climate Governance Strengthening: Establishing clear responsibilities through our Environment Committee and maintaining voluntary climate disclosure regardless of F-Secure is in scope of CSRD.

3. Formal Science-Based Target Commitment: Submitting commitment to the Science-Based Targets initiative near-term target and considering long-term net-zero target for the future.

4. Low-Carbon Service Differentiation: Developing green coding initiatives and a sustainable AI use framework.

5. Climate Transition Contingency Planning: Maintaining rapid response protocols for policy changes and financial reserves for climate initiatives.

6. Partner Requirement Anticipation: Establishing early warning systems for changing partner requirements through sales surveys.

7. Distributed Work Enhancement: Maintaining a strong remote work infrastructure and flexible arrangements for climate disruptions.

Our strategic response includes near-term (0-2 years, 2024-2026) actions like enhanced supplier emissions data collection and climate governance strengthening, alongside medium-term (2-5 years, 2026-2029) initiatives such as establishing a long-term net-zero target and implementing climate transition contingency planning.

We track emerging trends and adapt our strategy accordingly, ensuring ongoing resilience to evolving climate risks and opportunities.

Conclusion of scenario analysis

The scenarios highlight the importance of supplier engagement, given that over 90% of F-Secure's emissions are in Scope 3 categories. They also underscore the need for flexibility in implementation timelines and approaches, as the pace and nature of the climate transition remain uncertain.

Drawing on the IPCC AR6 finding that "there is a rapidly closing window of opportunity to secure a liveable and sustainable future for all," F-Secure's recommended strategy emphasizes early action on governance, sudden changes in requirements, and supply chain management while building capabilities to adapt to different potential futures. By implementing this strategy, F-Secure can enhance its climate resilience while positioning itself to thrive in a range of possible futures.

This scenario analysis will be reviewed annually to account for new developments in climate science, policy, technology, and market expectations, ensuring F-Secure's strategy remains resilient to evolving climate risks and opportunities.

E1-1 Transition plan for climate change mitigation

During 2025, F-Secure has continued to develop the details of the transition plan for climate change mitigation covering Scope 1, 2 and 3. The transition plan implementation is in the initial phase, with the four decarbonization levers disclosed under section E1-3 and E1-4 and key actions planned, which include operationalized implementation roadmaps. Governance oversight is established through the Environment Committee (operational Q3 2024), with bi-annual Sustainability Council reviews and annual Board reporting, ensuring accountability. Each decarbonization lever has assigned functional ownership, time-bound milestones, and defined expected impact by 2030.

Reference to GHG emission reduction targets: Paris Agreement

F-Secure has set key greenhouse gas (GHG) emissions reduction targets in line with the Paris Agreement, limiting global warming to 1.5°C. We've adopted the Greenhouse Gas Protocol and CSRD as our framework for measuring and managing emissions, targeting 42% absolute reduction across Scope 1, 2, and 52% emission intensity reduction of Scope 3, between 2024 and 2030, with 2024 as our base year. These targets align with IPCC 1.5°C Pathways. Sectoral decarbonization standards are not yet available for IT and Software companies.

Reference to GHG emission reduction targets: E1-3 and E1-4 and key actions planned

Table 18. Key actions planned.

F-Secure transition plan does not necessitate material dedicated investments or funding beyond normal business operations. The implementation of the four primary decarbonization levers is executed within existing operational budgets and business processes.

Changes in product portfolio

Our main emission sources from production and technologies are in Scope 3 Category 1, including data centers and other purchased services. We're primarily using AWS for cloud computing and plan to continue this approach, as AWS offers near-zero-emission solutions.

We'll emphasize developing efficient, high-quality code to improve product performance, customer experience, and overall efficiency. The integration of AI and machine learning technologies will enhance product functionality and drive competitiveness. We'll partner with major AI providers who commit to reducing emissions, ensuring our overall emission profile remains unchanged despite increased energy use from AI models.

Reference to climate change mitigation actions

As per disclosure requirement E1-3, F-Secure does not have taxonomy-compliant activities, and therefore, no linked investments and financing that would support its transition plan. See more under the EU Taxonomy section.

Locked-in GHG emissions

Carbon lock-in is generally associated with physical infrastructure and long-term investments in carbon-intensive technologies. This topic is not considered material for F-Secure as the impacts are small due to actions already taken, and our implementation of green coding further reduces locked-in emissions.

Economic activities and benchmark regulation (Pillar 3)

A taxonomy-non-eligible activity is defined as an activity not listed in Commission Delegated Regulation (EU) 2021/2139 or Commission Delegated Regulation (EU) 2023/2486. F-Secure operates in the field of cybersecurity software, which is a business area currently not covered by the EU Taxonomy and is, therefore, not taxonomy eligible. See our EU Taxonomy statement for more details. F-Secure is not excluded from the EU Paris-aligned Benchmarks.

Transition plan alignment with F-Secure’s strategy and financial planning

Table 19. Transition plan alignment with strategy and financial planning.

ESG is integrated into our company strategy rather than being a separate initiative. Our transition plan actions will be implemented by appropriate functions with consideration to their annual budgets, with progress tracked by our Environment Committee and Sustainability Council. The transition plan will be further developed as part of the SBTi process. In 2026, it will be reviewed by the Audit Committee and approved by the Board of Directors.

Impact, risk and opportunity management

E1-2 Policies

F-Secure has the ambition to deliver sustainable security experiences to our partners and consumers. To ensure we deliver on our climate change targets, we have adopted several policies that address climate-related impacts, risks and opportunities.

The Climate Change Policy is based on the values and principles defined in F-Secure's Code of Conduct and informed by stakeholder input from our materiality assessment. Our Supplier Code of Conduct explicitly requires suppliers to commit to working in an environmentally responsible and efficient manner and strive to minimize the environmental footprint of operations.

Table 20. Climate policies.

E1-3 Actions and resources

To achieve Climate change policy targets and mitigate emissions, we have implemented four decarbonization levers linked to our environmental IROs.

To further strengthen our transition plan, F-Secure has committed to set near-term, company-wide greenhouse gas emission reduction targets in line with climate science through the Science Based Targets initiative (SBTi). By joining the SBTi, F-Secure is taking a clear step toward aligning its climate strategy with what science says is necessary to limit global temperature rise to 1.5°C. This commitment reflects F-Secure’s ambition to act responsibly and be a sustainable, long-term partner for customers, partners, and society.

Fuel switching

For the opportunity to set a policy for e-vehicles, several cars have already been replaced with hybrid or electric models, and this transition will continue as leasing contracts are renewed. In the future, we aim to update our car policy to ensure that by 2030, all leased cars are electric.

Renewable energy and energy efficiency

In 2025, F-Secure’s headquarters in Helsinki moved to new office spaces. In the process, renewable energy was considered, and the electricity used in the new Helsinki office is 100% renewable. Our plan is to ensure all large offices, as well as smaller facilities where energy contracts can be controlled, use 100% renewable energy by 2030.

Supply chain decarbonization

Regarding the risk that F-Secure would fail to meet mitigation targets, as emission reduction is heavily reliant on suppliers, we have initiated actions to mitigate emissions in our value chain. In 2025, we set up our supplier climate mitigation program to reduce our emissions. The program focuses on supplier engagement and climate data gathering from suppliers. We've also implemented our Procurement policy, which requires suppliers to work in an environmentally responsible manner, continuously improve energy efficiency, and reduce waste and emissions. No quantitative emission reductions are available for these actions in 2025, but we expect a 52% emission intensity reduction by 2030.

Efficient coding principles

For the potential positive impact of implementing green coding principles, emissions for sold products are calculated based on the number of products sold annually. During 2025, actions towards this lever include developing and launching our company-wide framework for Sustainable AI use and training the organization on these principles. AI is a strategic priority at F-Secure, and we are moving fast. This framework provides the guardrails we need for rapid, responsible innovation. The framework clarifies what F-Secure does to ensure sustainable AI implementation and what we expect from our workforce. In addition, we organized a panel discussion on AI innovation and sustainability in software development with external experts joining. This panel discussion aimed to share knowledge about the scale of environmental impact of software and AI, learn strategies for green coding and sustainable AI in production, and understand how to make the business case for responsible development. While no quantitative emission reductions are expected in 2025 due to the low material impact. By 2030, we do not expect emission reductions as the number of sold products is projected to grow, while we optimize energy consumption.

For more specific information on progress towards climate targets, see Disclosure Requirement E1-4 – Targets related to climate change mitigation and adaptation. No significant monetary amounts of Capex and Opex have been required to implement these actions.

Resource Allocation

The management of impacts, risks and opportunities is conducted by the F-Secure Environment committee, including internal stakeholders for each decarbonization lever.

Metrics and targets

E1-4 Targets

F-Secure describes its sustainability-related baseline measures and targets in the table below. 2024 is established as a baseline year, and progress will be reported annually.

Methodologies and frameworks

Methodologies for tracking emission reduction targets vary. Scope 1 emissions are calculated using fuel consumption data and leasing contracts. Scope 2 emissions use both market-based and location-based methods with data collected from sites. Scope 3 emissions primarily use the spend-based method, with some data obtained directly from suppliers. More details are in E1-6 – Gross Scopes 1, 2, 3 and Total GHG emissions.

Our 2025 energy-related emission factors were updated by an external consultant. Metrics were selected based on legislative requirements, material ESG topics, and stakeholder feedback. In 2025, we have updated our Scope 3 target from actual emission reduction to 52% reduction in emission intensity (GHG emissions (t CO₂eq) by net revenue (€)) of Scope 3. Targets have been approved by the Board of Directors.

In the event of significant structural changes such as acquisitions, divestments, mergers, or changes in calculation methodologies, F-Secure will evaluate whether baseline recalculation is necessary. Recalculation would be conducted if structural changes result in a material impact on the baseline emissions, following GHG Protocol guidance. Any baseline adjustments will be transparently disclosed, documenting the rationale, methodology, and quantitative impact of the recalculation to maintain comparability and integrity of target tracking over time. In 2025, baseline recalculation has not been conducted as there have not been significant changes. F-Secure has not adopted new technologies in 2025, which would significantly affect the emission reduction targets.

We track our actions' effectiveness using total GHG emissions (tons of CO₂eq), emissions intensity per revenue, and their impact. We disclose combined GHG emission reduction targets for Scope 1 and 2 emissions. Scope 2 emissions are calculated using both market-based and location-based methods, with market-based used for the 2030 target. Our targets align with GHG inventory boundaries and don't include GHG removals, carbon credits or avoided emissions.

E1-4 Climate targets & progress

Table 21. Climate targets and progress.

E1-4 Progress towards targets

Current base year and baseline value

2024 is chosen as the base year for emissions to ensure an accurate view and to avoid external influences. After 2030, the base year is set every five years. The 2024 baseline values are described in chapter E1-6.

Framework and methodology for target setting

F-Secure has established GHG emission reduction targets compatible with limiting global warming to 1.5°C by 2030. In 2030, Scope 1&2 emissions aim to be 127 tons of CO₂eq, and the Scope 3 target of 52% reduction in emission intensity (GHG emissions (t CO₂eq) by net revenue (€)). The GHG Protocol and IPCC's cross-sector pathway serve as our framework. Future technological advancements, regulatory changes, and market shifts have been considered in our target setting. F-Secure is dedicated to continuously reviewing and adjusting its strategies to ensure they remain aligned with the latest scientific and industry standards, thereby maintaining the integrity and feasibility of its emission reduction goals. The targets are defined by the Sustainability Council and approved by the Board of Directors.

Decarbonization levers and their contributions to achieve reduction targets.

• Fuel switching: We plan to transition to hybrid and electric vehicles, with a projected 50/50 split by 2030. In 2025, the emissions of Scope 1 were 33 tCO₂eq. Emissions will be within the 42% decrease target by 2027.

• Renewable energy and energy efficiency: The Scope 2 emissions have decreased 14% during 2025, mostly due to removal of Poland office and the decrease of Helsinki office heating.

• Supply chain decarbonization: This lever includes Scope 3 category 1, which represented over 80 % of our Scope 3 emissions in 2025. Our purchased goods and services (excluding data center services) were 6610 tCO₂eq. Our cloud computing and data center services increased from 2024 due to an increase in the AWS services.

• Efficient coding principles: No material reduction expected as customer base growth will likely cancel out energy efficiency improvements. This covers Scope 3 category 11. We are still in the early stages of implementation, and assessing the effectiveness of the actions and policies cannot be quantified at this early stage.

E1-6 Gross scopes 1, 2, 3 and Total GHG Emissions

In our GHG emission calculations, we've considered the GHG Protocol Corporate Standard for principles, requirements and guidance. We use primary data where available (currently only from AWS, representing <1% of total Scope 3 emissions) and standardized emission factors for the remainder. Our emissions consolidation approach follows the operational control method.

Table 22. Gross scopes and total emissions.

1. Scope 1 and Scope 2 target is combined and not measured separately.
2. Value is based on a linear progression. Our impact is not expected to follow a linear pattern. Scope 1 and Scope 2 target is combined and not measured separately.
3. An absolute value cannot be given because an accurate revenue estimate cannot be made.

To create an accurate emission calculation, the most relevant data and methodologies have been used.

Scope 1

F-Secure's Scope 1 emissions originate from fuel combustion in company vehicles. Emissions are calculated using fuel consumption data from leasing car systems and directly from individuals leasing the vehicles. Emission factors from Statistics Finland convert fuel data into GHG emissions in metric tons of CO2e. F-Secure's operations do not generate biogenic Scope 1 GHG emissions from biomass combustion or decomposition.

Scope 2

F-Secure uses both market-based and location-based methodologies. Data on purchased electricity is collected from five sites via country or site representatives. Emissions from heating and cooling are calculated using the office area and heating/cooling factors. Compared to the 2024 calculations, the Poland office no longer exists, and Helsinki offices moved to larger facilities within the same building. Emission factors are sourced from multiple authorities, including Energy Authority, Association of Issuing Bodies, Ember, Energiateollisuus, Statistics Finland, CO2Emissiefactoren, Defra, and Our World in Data.

Scope 3

Scope 3 categories:

Table 23. Scope 3 categories.

Category 1: Purchased goods and services (excluding data center services) Values derived from financial reports representing expenditure on goods and services. Emissions from some vendors are calculated separately by comparing their emissions to revenue. These vendor expenses are excluded from financial report data to avoid double-counting. Emission factors from Lenovo and Exiobase.

Category 1 sub-category: Data center services 3-month delay in retrieving AWS figures. VPN energy usage is primarily from Ficolo (Finnish VPN server provider). Other VPN providers' electricity usage is extrapolated based on known traffic. Emission factors from AWS, EEA, Australian government, Carbon Footprint, Government of Canada, Ficolo, Climate Transparency, Singapore government, EPA and Vietnam government.

Category 3: Fuel and energy-related activities Calculated based on Scope 1 and Scope 2 values. Emission factors from GLEC, Defra and the UK Government.

Category 5: Waste generated in operations Waste amounts are estimated by extrapolating general waste amounts in a conventional office. Laptop and monitor data collected from Finnish offices and extrapolated to other offices. Emission factors from Fujitsu and the Environmental Protection Agency.

Category 6: Business travel Flight data from two travel agencies and from the company HR system. For HR system data emission calculators used for emissions or flight lengths. Emissions regarding business travel decreased around 30% from 2024. Emission factors from travel agencies, including Defra.

Category 7: Employee commuting Work travel distance, and type based on external data sources and estimations. Office workdays are calculated based on Helsinki and Oulu office data. Emission factors from Defra, Statistics Finland, GreenTech Malaysia and Carbon Footprint.

Category 8: Upstream leased assets Emissions from home offices and coworking spaces are assumed from electricity consumption of ICT equipment. Home offices and coworking spaces are not separated as they work similarly. Emission factors from Carbon Footprint.

Category 11: Use of sold products Assumed all sold products are taken into use. Emission factor from Statistics Finland.

F-Secure has no operational control of associates, joint ventures or unconsolidated subsidiaries, nor contractual arrangements in joint arrangements not structured through an entity.

Emission factors used are carbon dioxide equivalents, including greenhouse gases listed in the Kyoto Protocol (CH4, N2O, HFCs, PFCs, SF6, and NF3). Equivalents are calculated using a 100-year time horizon for CO₂eq emissions of non-CO₂ gases.

E1-6 GHG intensity based on net revenue

F-Secure calculates GHG intensity based on net revenue by dividing total GHG emissions (t CO₂eq) by net revenue (€). Values are represented both in market-based and location-based methods. Net revenue is based on our financial statement (Cross-reference to financial section 3. Revenue) and our E1-6 GHG intensity is presented in the table below.

Table 24. GHG intensity per net revenue.

S1 – Own workforce

SBM-3 Material impacts, risks and opportunitites

Table 25. Own workforce IROs.

F-Secure has identified key impacts, risks, and opportunities (IROs) related to working conditions, equal treatment, and career development. The company aims to support an inclusive culture, promote equality, and encourage a healthy work–life balance in order to provide conditions that enable employees to perform effectively.

No material negative impacts have been identified related to our workforce, whether widespread, systemic, or linked to individual incidents.

F-Secure material impacts, risks, and opportunities are related to all people in its workforce.

Interaction with strategy and business model

F-Secure’s actual and potential workforce impacts—covering working conditions, equal treatment, well-being, and career development—originate directly from its strategy and people-driven business model. Through ESG materiality assessments and HR processes, these impacts, risks, and opportunities are systematically identified and evaluated.

Positive impacts, such as inclusive practices, skill development, and work–life balance initiatives, strengthen the company’s ability to attract and retain talent and therefore support strategic execution. Similarly, risks such as burnout or turnover inform workforce planning and guide improvements to employment practices. The insights gained from these assessments contribute to adapting the strategy and business model, ensuring alignment between workforce impacts and long-term business performance.

Disclosure scope

All employees who can be materially impacted by F-Secure are included in this disclosure scope, encompassing impacts connected with their own operations.

Types of employees

F-Secure measures full-time employees by FTEs (full-time equivalent) with no "non-guaranteed hours" employees. Employee categories include:

• Permanent employees: Employed with no predefined contract end date

• Fixed-term employees: Hired for a specific duration with defined end dates

• Contractors: All non-employees, including Employee-like (integral team participants), Consultants (project-based supplementary workforce), and Other (facility access without system access)

The types of non-employees include “Employee-like”, “Consultant” and “Other” as described in more detail next.

Employee-like (also called “Fellowlike”):

• An integral part of the F-Secure teams, participating in daily activities and team meetings. Usually, contracts are fixed and time-based. Regardless of the contractor status, our contract with any non-employee is with a legal entity and not with a natural person.

• Examples of Employee-like who work for a third party engaged in "labor activities" and whose work is managed by the company: People who do the same work as our employees, in case those are temporarily absent (due to illness, vacation, parental leave, etc.) or work in the same workplace as our employees 

Consultant

• Consultants are contractors who supplement F-Secure's workforce on a project basis, related to a specific assignment or project in question. Regardless of the contractor status, our contract with any non-employee is with a legal entity and not with a natural person.

• They may have the necessary access to a F-Secure facility or to F-Secure systems based on, e.g., a project or frame agreement to perform their duties.

Other

• Covers non-employees who have access to a F-Secure facility but not to F-Secure systems, such as Board members or people providing facility services.

Impact, risk and opportunity management

S1-1 Policies

This section specifies the material sustainability topics addressed by each policy and clearly outlines the target audience for each policy, maintaining transparency and alignment with F-Secure's sustainability objectives.

In developing workforce-related policies, F-Secure considers the interests and needs of employees through continuous feedback mechanisms such as employee surveys, development discussions, consultation with employee representatives, and insights gathered through internal materiality assessments. These inputs help ensure that policies address the most relevant impacts, risks, and opportunities identified by the workforce. All workforce-related policies are made available to employees through the company intranet. Policy updates are communicated through internal channels, and managers are responsible for ensuring employees are aware of policy requirements. Mandatory training modules (e.g., Code of Conduct) ensure that key policies are understood and implemented across the organization.

Additional details on F-Secure’s Code of Conduct are provided in ESRS G1-1.

F-Secure supplier code of conduct includes provisions addressing the safety of workers, precarious work, human trafficking, the use of forced labour or child labour, and is fully in line with applicable ILO standards.

Table 26. Own workforce policies.

Human Rights Policy Commitments

F-Secure's workforce policies align with international standards, including OECD Guidelines for Multinational Enterprises, UN Global Compact, UN Guiding Principles on Business and Human Rights, ILO Declaration on Fundamental Principles and Rights at Work, and the International Bill of Human Rights. These principles are embedded throughout our policies as detailed below. Human rights are incorporated in our Code of Conduct, with which all F-Secure employees must comply.

Our commitment focuses on three core areas:

• Respect for Human Rights - Uphold global standards, respect freedom of opinion, expression, conscience, and religion; act swiftly on adverse impacts; protect digital lives by combating scams.

• Labor Rights & Safety - Ensure compliance with laws, safe working conditions, freedom of association, and zero tolerance for child labor, forced labor, or trafficking.

• Application of Standards - If local laws are less restrictive than the Code of Conduct, the Code of Conduct prevails. If local laws are more restrictive, those laws are followed for compliance.     F-Secure suppliers and partners are also expected to act responsibly and comply with principles set in the Code of Conduct and local laws.

Furthermore, F-Secure does not operate in industries/sectors where the risk of forced, compulsory, or child labour is significant. F-Secure has an office in Malaysia and employees in India, which are considered countries with higher risks. However, F-Secure hires educated specialists and leaders and conducts background checks during the hiring process as part of our Recruitment Policy, which reduces the risk.

Engagement with our workforce

F-Secure has established systematic workforce engagement methods, including regular Townhalls, personnel surveys, and workers' representative consultations. Detailed engagement processes are described in section S1-2 Processes for engagement about impacts.

Measures to provide and/or enable remedies for human rights impacts

F-Secure provides multiple channels for employees to raise human rights concerns, including direct contact with managers, HR, Legal, or via the Whistleblowing channel. All concerns are handled confidentially. For detailed information on reporting channels and remediation processes, see section S1-3 Processes to remediate negative impacts and channels to raise concerns.

Policies addressing trafficking in human beings, forced labor and child labor

F-Secure's Human Rights Policy prohibits child labor, forced labor, human trafficking, and other violations, with background checks as part of our Recruitment Policy and compliance with local labor laws, regularly updated to align with legal requirements.

Workplace accident prevention

F-Secure tracks and manages workplace accidents using HR systems, where all incidents are reported and monitored for compliance with local laws and regulations. While physical injuries are rare in the software and cybersecurity industry, any workplace accident or harm is recorded and managed according to country-specific practices. Our intranet provides employees with detailed workplace safety information. We define occupational accidents as unexpected events resulting in injury, including incidents within the workplace, during business trips, or while carrying out employer-ordered errands. We address injuries such as muscle or tendon pain, which may be compensable under certain conditions.

Any occupational accident is addressed according to local legislation and requirements, and occupational healthcare is provided by F-Secure.

S1-2 Processes for engagement about impacts

F-Secure actively incorporates the perspectives of its employees into the management of workforce-related impacts, risks, and opportunities. Senior leadership—comprising the CEO, Chief People Officer, and Leadership Team—leads employee engagement through regular Townhalls and monthly Leadership Forums.

F-Secure has established systematic methods to engage with its workforce:

1. Employee Engagement: Monthly Townhalls with Q&A, function-specific all-hands meetings, Leadership Lab for Team Leaders, and digital suggestion channel promote inclusive participation.

2. Employee Feedback: Biannual anonymous personnel surveys are conducted to gather feedback from all employees. The results are analyzed and presented at company, function, and team levels (where at least five responses are available). Other feedback mechanisms such as the whistleblowing channel, exit interviews and HR consultations.

3. Project-Based Engagement: Employees participate in specific processes or projects, such as people processes or cultural initiatives.

4. Workers' representatives: People and Culture Operations Director organize monthly meetings with Shop Steward to address current topics. HR Board meets monthly with Shop Steward and country-specific elected representatives (People & Culture Advisor)

5. Collective Bargaining Compliance: F-Secure adheres to collective bargaining agreements in Finland, France, and Spain, maintaining alignment of policies and practices through the People & Culture Operations Director.

Accessibility and Inclusivity

In addition to the engagement methods described above, F-Secure places strong emphasis on accessibility and inclusivity as essential components of workforce engagement. The company ensures equal participation by offering accessible Learning Management Systems and survey tools with screen reader compatibility, text-to-speech features, and closed captioning. Virtual Townhalls include real-time captions and recorded transcripts in audio and text formats. Wheelchair-accessible facilities and clear, easy-to-understand language across all communications enable employees with mobility or cognitive disabilities to engage fully. These measures reflect F-Secure’s commitment to ensuring that every employee can contribute and participate without barriers.

Insights from these channels are used to identify and reassess material workforce IROs, including topics such as well-being, workload, equal treatment, skills development, and workplace culture. Employee feedback directly informs decisions related to improvement actions, for example, updates to hybrid work practices, development of well-being initiatives, targeted training programs, and adjustments to career development frameworks.

This process ensures that employee needs and expectations are considered when designing and implementing measures to manage both actual and potential impacts on the workforce.

S1-3 Processes to remediate negative impacts and channels to raise concerns

F-Secure strongly encourages employees to speak up regarding concerns related to their employment or daily work. We aim to avoid adverse human rights impacts and take actions to remediate them when they occur. Every employee at F-Secure has the right and obligation to raise concerns about Code of Conduct violations, including human rights.

Our organization assesses potential negative impacts through structured processes. We assess the effectiveness of the remedy provided through follow-up reviews with the affected individuals, monitoring for recurrence of the issue, and evaluating whether the corrective actions have addressed the root cause. Feedback from employees, case-closure criteria, and ongoing monitoring help us confirm that the remedy has achieved its intended outcome.

Primary Reporting Channels

Concerns should primarily be reported through:

• Team leader, local People & Culture advisor, legal or personnel surveys

• Verbal or electronic communication methods

• Team leader's leader or People & Culture if issues relate to the direct team leader

• Shop Steward or employee representatives

• Direct contact with the CEO or Board of Directors

The Whistleblowing Channel serves as a way for anonymous reporting (see G1-1 for details). All concerns are handled confidentially, reviewed thoroughly, and addressed through appropriate measures for any Code of Conduct violations, including human rights. Retaliation against anyone raising a good-faith concern is strictly prohibited. We actively communicate and train team leaders and employees on the available reporting channels, which are regularly updated on our intranet.

Our whistleblowing channel is operated through a third-party provider to ensure independence, confidentiality, and anonymity. The channel is made available and maintained by F-Secure, but the reporting mechanism itself is administered externally.

We are committed to maintaining a culture where everyone feels comfortable raising good-faith concerns about employment or daily work. We do not tolerate adverse action against anyone who raises good-faith concerns. We actively communicate and train team leaders and employees on ways and channels for raising concerns. Channels are updated regularly on our intranet.

Assessment and Continuous Improvement

We assess awareness and trust in our structures and processes through:

• Regular employee surveys (biannual personnel surveys)

• Feedback mechanisms (1-on-1 meetings with team leaders and Townhalls)

• Trust metrics tracking, such as eNPS (employee Net Promoter Score)

These surveys and feedback channels gauge employees' understanding of internal processes and confidence in the company's commitment to transparency, ethics, and fairness. Results are used to identify areas for improvement and drive continuous enhancement of our practices. All reporting channels are easily accessible to employees across all levels of the organization.

S1-4 Actions and resources

Scope: All employees globally; targeted initiatives for underrepresented groups. Time Horizon: Ongoing; programs launched and maintained in 2025.

Actions to address material impacts

F-Secure actively implements measures to enhance positive impacts on its workforce while managing related risks and opportunities identified in the materiality assessment. The company’s initiatives focus on maintaining a stable, equitable, and inclusive working environment, as outlined below. No actual or potential negative impacts related to F-Secure’s own workforce have been identified that exceed the threshold defined in the impact, risk, and opportunity assessment conducted as part of the DMA.

Family leaves

F-Secure is committed to creating an inclusive and supportive work environment where employees can balance personal and professional responsibilities. We ensure equal access to parental and caregiving leave so that no one is disadvantaged for prioritizing family. Our Wellbeing Strategy focuses on strengthening physical, mental, and emotional health through proactive programs and initiatives. Comprehensive support is provided across Finland, India, the US, and Malaysia, addressing risks such as stress and burnout while promoting long-term health and satisfaction. In addition, the Culture, Health & Well-being Committee ensures compliance with both global and local health and safety standards, embedding well-being into our culture and everyday practices.

Learning and Development

Targeted training for R&D and leadership roles supports upskilling, addresses skill shortages, and promotes career growth. F-Secure enhances workforce competencies through capability and competence analysis, employee surveys, and centralized training via the Learning Management System (LMS).

Gender Equality

A diverse workforce is a strategically important topic for F-Secure, and due to this, we have implemented targeted recruitment for underrepresented groups.

Culture Building

We take action to foster a speak-up culture via training and feedback mechanisms, which we have continued to develop in 2025. We have linked our monthly superheroes to our cultural values, and they are presented at our Townhalls. This creates a clear link between the desired behavior of a Fellow and the culture we want to develop.

Secure Employment and Flexible Workplace

F-Secure offers stability by prioritizing permanent contracts over fixed-term agreements, minimizing uncertainty for employees. Remote/ Hybrid work allows employees to work from home several days a week, promoting work-life balance and improving well-being. In regions like India and Malaysia, where commuting can be time-consuming, remote/hybrid work enhances employee satisfaction and productivity. Progress: Engagement with DEI rate.

Fair Working Environment

We continuously evaluate and update policies and procedures across all locations for full compliance with local, regional, and national regulations. This maintains a fair and transparent work environment, fostering trust and inclusivity. Comprehensive benefits suite includes health insurance and vacation/leaves, offering mental health and personal well-being resources.

Prevention of Negative Impacts on Workforce

F-Secure has assessed its practices and confirms that it does not cause or contribute to material negative impacts on its own workforce. Our employment practices are governed by global HR policies, the Code of Conduct, and data protection standards, which ensure fair, safe, and responsible working conditions.

To ensure we do not cause or contribute to negative impacts, we monitor workforce well-being, engagement, development, and workplace conditions through surveys, absence trend analysis, performance processes, and established grievance and whistleblowing channels. No tensions were identified between preventing negative impacts and other business pressures during the reporting period.

We expect to continue monitoring and assessing key workforce areas—including employee well-being, engagement, development, and the effectiveness of HR processes—throughout the strategy period (2026–2028). These activities did not require any material operating (Opex) or capital expenditures (Capex) in 2025, and we expect this to remain unchanged during the strategy period.

Tracking Effectiveness

Systematic Tracking Methods:

• Employee Surveys: Anonymous engagement surveys, including eNPS, to monitor workforce satisfaction

• Policy Reviews: Regular evaluations for compliance with labor laws and international standards

• Gender Equality Monitoring: Pay gap analyses conducted before and after salary reviews

• Culture Assessment: Biannual surveys measuring eNPS, retention rates, and leadership effectiveness

• Sustainability Council reviews: Updates on Own workforce related topics through DEI and Wellbeing Committee.

Actions related to material opportunities

Actions related to our material opportunities were executed during 2025. We continue to see them as relevant also for the current strategy period (2026-2028):

Table 28. Actions to pursue own workforce opportunities.

Actions to mitigate material risks

We have identified two risks with corresponding mitigation strategies as listed in the table below. These mitigation activities were executed in 2025 in our own workforce, and we see them as relevant during the strategy period (2026-2028):

Table 27. Actions to mitigate own workforce risks.

Resource Allocation:

• People and Culture function:

Manages all material impacts, risks, and opportunities related to our workforce, covering all employees globally. This includes oversight of the full employee experience, from recruitment and onboarding to talent development, performance management, diversity and inclusion, well-being initiatives, payroll and rewards, HR systems, and support for all regional offices. In addition, well-being and DEI activities are coordinated through cross-functional committees that represent employees across the organization.

Metrics and targets

S1-5 Targets

F-Secure has defined the following absolute targets related to its own workforce.

Methodologies and frameworks

Methodologies for collecting and tracking targets are based on F-Secure's HR systems as described under each target. Metrics have been selected based on alignment with material F-Secure ESG topics, ESG regulation, DMA, and stakeholder feedback. Targets have been approved by the Board of Directors.

S1-5 Own workforce targets

Table 29. Own workforce targets.