cyan AG

Annual Report • May 2, 2023

Annual Report 2022

Key Figures 2022

3.8

Revenue Cybersecurity in EUR Million

Total Number

of Staff

123

4.7

Revenue BSS/OSS in EUR Million

Group EBITDA in EUR Million -8.4

Net Debt in EUR Million 1.3

Earnings Figures		2022	2021
Revenue	in EUR million	8.5	8.5
Total earningsa	in EUR million	12.4	10.8
EBITDA	in EUR million	-8.4	-12.3
EBITDA-marginb	in %	-98%	-145%
EBIT	in EUR million	-14.0	-18.1
EBIT-marginb	in %	-164%	-213%
Net income/loss	in EUR million	-16.5	-13.9
Earnings per share (undiluted)	in EUR	-1.11	-1.30

^a Consists of sales revenues EUR 8.5 million plus other operating income EUR 4.2 million, income from reversals

of impairment losses EUR 0.0 million and changes in inventories EUR -0.3 Mio. ^b Calculated as EBITDA or EBIT divided by revenues.

Segment Figures		2022	2021
Revenue BSS/OSS	in EUR million	4.7	5.2
EBITDA BSS/OSS	in EUR million	-3.6	-2.4
Revenue Cybersecurity	in EUR million	3.8	3.3
EBITDA Cybersecurity	in EUR million	-3.6	-7.4

Cash Flow Figures		2022	2021
Operating cash flow	in EUR million	-6.8	-10.6
Investment cash flow	in EUR million	-0.6	-0.1
Financing cash flow	in EUR million	4.3	16.5

Balance Sheet Figures		31/12/2022	31/12/2021
Total assets	in EUR million	84.0	95.7
Equity	in EUR million	65.8	72.8
Net debt incl. IFRS 16c	in EUR million	1.3	4.2

^c Consists of leasing liabilities EUR 3.0 million and financial liabilities EUR 3.7 million less cash and cash equivalents EUR 5.3 million.

Key Operating Figures		31/12/2022	31/12/2021
Number of staff	FTE	123	131

Contents Annual Report 2022

Key Figures	1
Contents	3
Letter to the Shareholders	9
Report of the Supervisory Board	13
cyan-Share	17
Combined Management Report	21
Business model	22
Economic report	31
Economic developments at cyan AG	41
Opportunities and risk report	44
Subsequent events	52
Forecast report	53
Consolidated Financial Statements	54
Statement of comprehensive income	55
Consolidated statement of financial position	56
Consolidated statement of cash flows	58
Consolidated statement of changes in equity	59
Notes to the Consolidated Financial Statements	60
Information about the Company	61
Accounting principles	61
Segment reporting	77
Notes to the statement of comprehensive income	79
Notes to the statement of financial income	85
Notes to the consolidated cash flow statement	99
Financial instruments and risk management	100
Other explanations	106
Assurance by the Legal Representatives	109
Independent Auditor's Report	111
Further Information	116
Disclaimer	117
Imprint	118

cyan goes beyond simply connecting

It's a vast world-wide-web out there. Casting a wide net with our OnNet Security, a network-based solution, ensures the best chance of catching what needs to be caught

cyan unleashes the user's digital potential

In this world of endless opportunities and technological advancements, cyan's OnDevice Protection offers tools to make the digital experience safe. Seamlessly integrated and powered by the heart of our technology.

cyan protects the youngest digital explorers

Exploring all opportunities is the essence of how the next generations will grow up to make a difference. We ensure they make use of all their given means in the digital realm in a secured and protected way.

Exploring the new world of i-new Unified Mobile Solutions

With i-new's BSS/OSS Solutions, evolving from a traditional MVNO to a provider of future ready connectivity is within reach.

Lightweight platform

i-new's BSS/OSS/MVNE platform delivers comprehensive out-ofthe-box functionality and provides strong USPs to enable long term success of mobile virtual providers & brands.

Leveraging the full potential of our state-of-the-art integrated telecom services to support our

Building highgrowth business

customers sales growth strategy.

H2 Headline Zweite Zeile Letter to the Shareholders

Dear Shareholders,

We can look back on an eventful past year. We can report that cyan AG has made considerable progress, which we have accomplished despite new global crises and the associated economic repercussions. By remaining true to our core values and strategies, we have helped to weather these uncertain times and position ourselves for long-term success. We thank you for your continued support and confidence in our leadership team and look forward to updating you on our progress and plans for the future.

Connect. Detect. Protect.

As part of the strategy outlined in 2022 to reposition the cyan digital security and inew unified mobile solutions brands, we successfully implemented the new branding for our two operating units at the beginning of 2023. This also reflects our vision, which can be summarized in the keywords "Connect, detect, and protect ". In the BSS/OSS segment, we wanted to give the "i-new" brand, which is respected and well-known in the relevant markets, its own space in order to benefit from this reputation in the best possible way. With the motto "i-new enables digital connectivity", it represents the first keyword of the strategy. Our technology enables us to offer innovative connectivity solutions around the world. This in turn enables our partners, especially MVNOs and secondary telecom brands, to tap into new customer segments. For this, a lightweight and flexible solution is required, which i-new specializes in.

With "detect", the bridge to our security solution is created. cyan digital security, the cyan Cybersecurity brand, focuses on effortless seamless online protection, hence the keyword "protect", of end users, in the private as well as in the business sector. In doing so, we leverage our experience and empower our partners, mainly telecom operators, in their go-to-market strategy and communication. Over the years of working together with international communication service providers and their end users, we have found that ease of installation, awareness and outreach are key to successful cybersecurity technology distribution. We have made great strides in this area and will continue to steadily improve because this approach is paying off, as measured by the number of new partners we have acquired as well as the resulting significant increase in end users. So not only are we providing comprehensive protection with a market-leading product, but we are also helping partners and end-users to navigate the Internet with peace of mind.

Continuous improvement

We are also continuously working to improve our products, add features and expand our product range. In addition, we are accelerating our roll-outs by further automating processes such as quality assurance and deploying our solutions in the public cloud. As a result, we have been able to reduce the time required to go live by up to two-thirds, despite the sometimes highly complex environments. Quicker access to the end user ultimately leads to profitability. Our ever-improving threat intelligence is another area where our research teams continued to work with leading institutions in the past financial year to keep pace with, and in some aspects even stay ahead of, cybercriminals when it comes to modern threats such those involving cryptocurrencies.

At i-new, we improved eSIM support and added new capabilities to create innovative tariffs and packages that enable our customers to provide even more tailored offers to their subscribers. Furthermore, we successfully established connections of different core network elements, enabling new customers to connect to these components even faster.

Significant subscriber gains

At cyan digital security, we have experienced solid growth in subscribers, nearly doubling their number, and this trend has continued in the first three months of 2023. As a result, we are already seeing an increase in Annual Recurring Revenues (ARR). This is attributable to the fact that we have multiplied the number of cybersecurity partners in the telecom sector. While in 2021 we only had two relevant telecom partners, with Orange France just launching in April, in contrast, in the first quarter of 2023 we already count more than ten customers who have launched our cybersecurity products or selected us as their cybersecurity partner. Several more partners are already in the process of deploying our solutions or negotiating contracts, which bodes well for us as we look ahead to 2024. Most recently, we made progress in cross-selling cybersecurity solutions to i-new's customers. The first MVNO partner, MTEL, launched our new security service in April 2023, just a short time after signing the contract. The tight integration with our BSS/OSS platform and the direct collaboration between inew and cyan digital security make this possible.

The partnership with Orange Group grew to include a second active country in 2022 with the launch in Slovakia in February. Here we are continuously expanding the available products. Moreover, in 2023, we have already been able to expand the relationship to include additional countries. An important milestone in the first quarter of 2022 was the successful implementation of the cyan solution at dtac in Thailand. With the recently approved merger with True, our addressable market will double. In the fall, OTE Group launched as a cybersecurity partner. The solution was implemented within the shortest technical implementation period ever, just six weeks. An upgraded version of the Cybersecurity product was also launched at T-Mobile in Poland in time for the Christmas marketing season. Here, in the first four months since the relaunch, we have seen the largest increase in new users in cyan's history - and the trend remains unbroken.

Likewise, i-new has on-boarded several MVNOs on its platforms. At the beginning of the year, Austria-based telecommunications company educom completed its migration to i-new technology. In March and April, MVNOs Lov and Liwa started service in Colombia. The project with Viasat, which had already been underway since the beginning of the year, was announced to be in an advanced stage in October. The company is using the BSS/OSS platform to provide satellite connectivity in hard-to-reach areas. Viasat's next-generation satellite constellation, ViaSat-3 Americas, is scheduled to launch with SpaceX in spring 2023 to deliver even greater bandwidths. The joint expansion with MTEL into Germany and Switzerland has progressed apace. To date, several stores have already been opened in Switzerland.

Quality and perseverance

Our business and the resulting strategy are based on the ingredients of continuity, steady growth and quality, which we believe are the keys to our success. This will benefit us in the long term because our revenues are becoming more plannable, consistent and recurring - the percentage of recurring revenues has increased and the churn rate among subscribers is low. This makes our business more and more predictable and sustainable. Nevertheless, it is important to note that, especially for i-new, our business and forecasts are still dependent on revenues from projects such as initial setups and change requests. This is also the reason why we had to reduce the forecast for 2022 at the end of the year, as the decision on the license for our partner had not been made by the end of the year, despite other reports. The regulatory process is tremendously important in the telecom sector, however, it also comes with a dependency outside of our sphere of influence.

In that regard, we are pleased to report a fiscal year 2022 in which we completed our restructuring program, resulting in a significant year-on-year reduction in costs (excluding currency effects) of over EUR 3.5 million, this is coupled with improvements in processes, new business and higher margins. We remain very vigilant on fixed costs, but see inflationary pressure from our suppliers and in personnel. Our focus remains undiminished on the turnaround to ensure sustainable operations for the Group with the main objective of self-financing, but with great care not to diminish our opportunities. For this purpose we carried out a capital increase in the second half of 2022 and contributed liabilities in a non-cash capital increase at the beginning of 2023. As a result, we are essentially debt-free in the Group as of the reporting date and have escaped interest rate increases in the meantime. It should be noted that due to capex/licensing agreements made in the past, operating cash flow is higher than EBITDA. We remain consistent and will weigh opportunities for the respective businesses against investment and cost, and may take drastic action if it brings us closer to the overall goal.

The longer-term focus and cost savings will also be reflected in our future reporting. After discussions with shareholders, analysts and investors, we have decided to focus on the two main reports - the annual report, which is traditionally published in April, and the half-year report, which is published in September. However, we will increasingly report on the progress of our business in a timely manner via corporate news, the press and social media.

Gratitude

Finally, we would like to thank our shareholders, partners and employees for their continued support. We are making good progress and look forward to working with you to continuously approach our goals step by step.

Best regards The Executive Board of cyan AG Munich, April 2023

Frank von Seth CEO

Markus Cserna CTO

H2 Headline Zweite Zeile Report of the Supervisory Board

Dear Shareholders,

The 2022 financial year marked a gradual return to the new normal. Owing to the international composition of the Supervisory Board, meetings, however, continued to be held online or in hybrid form. In the following report, the Supervisory Board provides information on the performance of its duties and the key points of its activities in fiscal year 2022.

The Supervisory Board of cyan AG fully performed the duties incumbent upon it under the law and the Articles of Association in the financial year 2022. It addressed the situation and development of the company regularly and in detail. For this purpose the Supervisory Board regularly consulted with the Executive Board of the Company and carefully monitored its activities. The Executive Board informed the Supervisory Board cyclically, promptly and comprehensively in written and verbal form about all aspects of planning, business development, the situation of the company including the risks, governance and compliance that were of importance to the company, and about current matters in each case. Where management decisions or actions required the approval of the Supervisory Board by law, the Articles of Association or the Rules of Procedure, the Supervisory Board was involved in the process.

Composition of the Supervisory Board

At the turn of the year 2021/2022 a change occurred in the composition of the Supervisory Board. Alexander Schütz left the board effective December 31, 2021. As a result of the departure of Alexander Schütz, who served as Chairman of the Supervisory Board until December 31, 2021, Stefan Schütze was elected Chairman and Lucas Prunbauer Deputy Chairman of the Supervisory Board. For the vacant position, the Supervisory Board nominated Adrian Shatku, who was court-appointed to the Supervisory Board effective January 7, 2022. Mr. Shatku as well as Trevor Traina retired from their mandates at the end of the Annual General Meeting on June 22, 2022, at which a resolution was passed to reduce the number of members to three. We thank them and Alexandra Reich for their cooperation.

In March 2023, Alexandra Reich resigned from her mandate. The Supervisory Board proposed Markus Messerer as a replacement. He is Senior Vice President, Chief Strategy & Commercial Officer at Telia Company AB, a leading telecommunications group and mobile network operator in Finland, Sweden and Lithuania. Prior to joining Telia, he was CEO of Alltron AG, Head of Corporate Strategy at Swisscom AG, Head of Strategy at Telekom Austria AG and before that he worked for Accenture. He holds a PhD in International Management, an Executive MBA and is a CFA charterholder. His appointment by the court was effective March 31, 2023.

Meetings and resolutions

A total of six Supervisory Board meetings were held: on January 21, 2022, March 11, 2022, March 23, 2022, April 26, 2022, September 15, 2022, and December 7, 2022. The Supervisory Board consisted of five members until the Annual General Meeting on June 22, 2022. By resolution of the Annual General Meeting, the number of members was reduced to three. No committees were formed in fiscal year 2022.

Each member of the Supervisory Board attended at least half of all Supervisory Board meetings. Trevor Traina and Alexandra Reich were unable to attend one meeting. Where necessary, the Supervisory Board also adopted its resolutions by written circular. Between meetings, the Executive Board informed the Supervisory Board in written reports about projects and plans of particular importance to the Company.

The development of revenue, earnings, and customers, as well as the Company's financial situation, were the subject of regular discussions at the Supervisory Board meetings. No conflicts of interest arose among the members of the Supervisory Board in connection with their activities as members of the Supervisory Board. The Supervisory Board approved the resolutions proposed by the Executive Board after thorough examination in each case.

By written circular on January 10, 2022, the Supervisory Board resolved to elect Stefan Schütze as the new Chairman of the Supervisory Board and Lucas Prunbauer as the new Deputy Chairman of the Supervisory Board.

In the first meeting of the Supervisory Board on January 25, 2022, the progress of the transformation strategy initiated in 2021 and its possible effects on the planning processes were discussed together with the Executive Board. The Supervisory Board also addressed the strategic positioning of the business areas. The Executive Board provided information on the status of the Convertible Notes Funding Program.

At the second meeting of the year, held by telephone on March 11, 2022, the Executive Board reported on business developments to date, particularly with regard to the war in Ukraine. The Executive Board presented the budget and elaborated on the progress of the transformation process. The plan for the Annual General Meeting and the agenda were discussed at the meeting. Resolutions concerning the Executive Board's rules of procedure and the Group structure were also discussed.

At the third Supervisory Board meeting on March 23, 2022, the Supervisory Board reviewed the planning and reporting for the year together with the Executive Board. In addition, the members of the Executive Board answered miscellaneous questions from the members of the Supervisory Board. The plans were adopted by resolution.

In the resolution adopted in writing by circular resolution on March 30, 2022, the Supervisory Board approved changes to the Group structure and the Executive Board's rules of procedure.

At the balance sheet meeting on April 26, 2022, the Executive Board presented the final consolidated financial statements according to IFRS and the annual financial statements of cyan AG according to HGB. The auditor of HLB Dr. Stückmann und Partner mbB attended the comprehensive discussion of the financial statement documents and reported on the audit, the focal points of the audit, and the results of the audit. The adoption of the annual financial statements of cyan AG in accordance with the German Commercial Code (HGB) and the consolidated financial statements in accordance with IFRS followed the discussion by the Supervisory Board.

The Supervisory Board resolved the agenda for the Annual General Meeting and the final terms of the termination of the contract with Mr. Wachter by circular resolution on May 6, 2022.

On August 19, 2022, approval for the corporate action was granted by written circular.

The meeting on September 15, 2022 was held hybrid at the Company's headquarters in Munich. The Executive Board presented the preliminary figures for the first half of the financial year and provided an overview of technological developments as well as completed and ongoing research projects. The progress of the capital increase was discussed.

In the resolution passed in teleconference on September 23, 2022, the Supervisory Board approved the issue of the new shares and resolved to amend the Articles of Association accordingly.

On November 24, 2022, and November 30, 2022, two resolutions were adopted by telephone conference to mandate advising law firms.

In the sixth and last meeting of the year on December 7, 2022, the current developments with existing customers and new planned projects as well as the current key figures were discussed with the Executive Board. Furthermore, the target achievement for the financial year 2022 was discussed.

The subsequent meetings and resolutions took place at the beginning of the following year.

Annual and consolidated financial statements

The auditors elected at the Annual General Meeting on July 22, 2022 and appointed by the Supervisory Board, HLB Dr. Stückmann und Partner mbB, München Wirtschaftsprüfungsgesellschaft, audited the annual financial statements and the consolidated financial statements and combined management report of the Company for the financial year 2022 and issued an unqualified audit opinion. The auditor issued a declaration of independence to the Supervisory Board.

In their audit report, the auditors outlined the auditing principles. No objections were raised by the auditors.

The annual financial statements and management report as well as the auditors' report on the individual and consolidated financial statement were made available to all members of the Supervisory Board in good time. The financial statement documents were discussed in detail at the Supervisory Board's balance sheet meeting on April 24, 2023. The Supervisory Board examined in detail the single-entity and consolidated financial statements and the combined management report.

No objections were raised following completion of this review. The Supervisory Board concurred with the results of the audit and approved the annual and consolidated financial statements prepared by the Executive Board for the financial year 2022. The annual financial statements were thus adopted. The Supervisory Board concurred with the combined management report and the assessment of the further development of the Company.

Thanks

The Supervisory Board expresses its thanks and appreciation to the Executive Board and all employees for their high level of commitment and performance under challenging conditions in the reporting year 2022.

Munich, in April 2023 For the Supervisory Board

Stefan Schütze Chairman of the Supervisory Board

Zweite Zeile

Share price performance

Relative share price performance January 1, 2022 – December 31, 2022 (rebased)a

cyan AG has been listed in the Scale segment (Open Market) of the Frankfurt Stock Exchange since March 2018. 2022 was a mixed year on the European and global stock exchanges. The DAX lost 12.3 %, making it the worst stock market year in four years. In the United States, 2022 was the weakest year for stock markets since the financial and economic crisis of 2008, with the Dow Jones benchmark index closing the year down almost 10 %. The technology-heavy Nasdaq 100 recorded losses of more than a third, as did the Scale All Share Index, which tracks the performance of all companies listed in the Scale segment (including cyan). The cyan share opened on January 3, 2022 (first trading day Xetra) at EUR 2.70 and closed on December 30, 2022 (last trading day Xetra) at EUR 1.40. On December 30, 2022, the lowest intraday price (Xetra) was reached at EUR 1.35 and on April 7, 2022 the highest at 3.45. The market capitalization of cyan AG as of December 30, 2022, based on the closing price of EUR 2.64 and 17,016,800 bearer shares outstanding at that date, was EUR 29.9 million.

	2022	2021
Share capital at the end of the perioda	17,016,800	13,385,884
Market capitalization at the end of the period (EUR million)	29.9	35.3
Period high (Intraday)	3.45	14.20
Period low (Intraday)	1.35	2.55
Opening price at the beginning of the period (first trading day
Xetra)	2.70	13.19
Closing price at the end of the period (last trading day Xetra)	1.40	2.64
Performance (Change in %)	-49.0	-80.0

^a Two capital increases were carried out from conditional.

Shareholder structure

In June 2022, a shareholder informed the Company that his shares in cyan AG exceeded 25% of the nominal capital. The Executive Board of cyan AG held 1.7% of the shares. 1

Key share data

WKN	A2E4SV
ISIN	DE000A2E4SV8
Stock symbol	CYR
Trading segment	Open Market (Scale)
Sector	Software
Exchange	XETRA / Frankfurt
Type of shares	Bearer shares
First trading day	28/03/2018
First issue price in EUR	23.00

Analyst coverage

As of December 31, 2022, cyan stock had research coverage from two analysts. Both issued a buy recommendation. The contract with Kepler Cheuvreux was terminated at the beginning of 2023; instead, Alster Research commenced coverage in April 2023.

	Date	Target price	Recommen dation
SMC Research	06/10/2022	EUR 5.10	Spec. Buy
Kepler Cheuvreux	30/12/2022	EUR 3.50	Buy

Corporate actions

In February 2022, cyan AG concluded an agreement with a creditor of the Company, according to which the receivables in the amount of EUR 3.9 million will be contributed to the Company by way of a capital increase against contributions in kind in exchange for 1,503,816 shares. Accordingly, the nominal capital was increased by EUR 1,503,816.00 from EUR 13,385,884.00 to EUR 14,889,700.00.

In August 2022, the Executive Board, with the approval of the Supervisory Board, resolved a cash capital increase with subscription rights (subscription ratio 7 to 1) for existing shareholders. The offer period was set at September 5 to September 19 and the issue price per new share was set at EUR 2.63. Shares not subscribed by shareholders were then offered to interested investors in a private placement. The nominal capital of the Company was thereby increased by EUR 2,127,100 from EUR 14,889,700 to EUR 17,016,800 by partially utilizing the authorized capital.

¹ Due to the listing in the Scale segment (open market), the reporting obligations of shareholders are limited to the thresholds of the German Stock Corporation Act (AktG). Disclosures below these thresholds are generally made on a voluntary basis, with the exception of executives.

Furthermore, cyan AG concluded an agreement with creditors of the company in February 2023, according to which their joint receivables in the amount of EUR 3.0 million will be contributed as part of a capital increase through contributions in kind in exchange for the issue of shares. The nominal capital thus increased by EUR 1,868,592.00 from EUR 17,016,800.00 to EUR 18,885,392.00 by issuing 1,868,592 shares at an issue price of EUR 1.63. The capital increase against contributions in kind was entered in the commercial register in April 2023.

Investor relations activities

International conferences and roadshows were again held physically as the Covid-19 restrictions subsided. In total, Investor Relations and Executive Board members were represented at eight analyst and capital market conferences to present the strategy and cyan to analysts and investors. Finally, on June 22, 2022, the Annual General Meeting was held in virtual format in Munich.

In addition to quarterly financial reporting, investors and the general public were also informed about current developments in the Group by means of numerous news and ad hoc releases. In total, 22 capital market publications (directors' dealings, ad-hoc releases) and news items were published in the reporting year. In addition, numerous investor calls and e-mail inquiries have been answered.

ir.cyansecurity.com

Financial calendar

In the current year, cyan AG will also regularly inform the capital market about its business performance and will be represented at several analyst and investor conferences internationally.

Event	Date	Location
Annual General Meeting	07/2023	Munich/virtual
Interim Report H1 2023	28/09/2023	-
Investor Access Paris	09-10/10/2023	Paris
Deutsche Börse German Equity Forum	27-29/11/2023	Frankfurt

Current dates, upcoming events and news for 2021 are continuously updated on the website.

ir.cyansecurity.com/news-and-events

H2 Headline Zweite Zeile Combined Management Report

Business model

The cyan Group (XETR: CYR; hereinafter "cyan") is a provider of intelligent IT security solutions and telecommunication services with more than 15 years of experience in the IT industry. The main business of the company involves cybersecurity solutions for the end customers of mobile and fixed-line internet providers (MNO, ISP), financial service providers, mobile virtual network operators (MVNO) as well as the convergent BSS/OSS platform (Business Support System and Operations Support System) as a mobile virtual network enabler (MVNE). The security solutions from cyan are integrated in the infrastructure of the business partner, who then offers these in a B2B2C model to its own end users under its own brand. With the BSS/OSS business, services such as connection to the network operator, billing, provisioning, and similar services relating to the operational aspects of running an MVNO are offered.

Today, the Group has a large number of international customers, mostly from the telecommunications sector, where cyan has deployed products are which sell solutions to millions of end users. cyan is able to offer products and services along the entire value chain, from the platform, data optimization, to cybersecurity. In addition, cyan runs its own research and development with the aim of identifying trends in the industry at an early stage and developing optimal product solutions.

Group structure

cyan AG, headquartered in Munich (Germany) acts as the holding company within the cyan Group. The majority of operational services are provided by the subsidiary I-New Unified Mobile Solutions GmbH ("i new"; formerly I-New Unified Mobile Solutions AG) and its subsidiary cyan Security Group GmbH, both headquartered in Vienna (Austria).

In the financial year 2022, two new companies were established, one in Brazil and one in Thailand. The company in Argentina was in liquidation at the end of the fiscal year. As of the reporting date, cyan was represented in thirteen countries by its own local subsidiaries. In addition, sales and service hubs are operated worldwide. Further information on the scope of consolidation as of the respective reporting dates is provided in the Notes to the Consolidated Financial Statements.

Segments of the group

The business activities of the Group are divided into two segments that are used to manage the Group and form the basis for segment reporting: Cybersecurity under the brand "cyan digital security" and BSS/OSS under the brand "i-new". This structure is modeled on the type of solutions provided. Over the last few years, cyan has developed five product groups, that are offered to its customers individually and also as combined 'seamless' solutions – in Cybersecurity these are OnNet Security, OnDevice Security, Child Protection, Clean Pipe DNS, and BSS/OSS it is the MVNO Platform (BSS/OSS).

The Executive Board decided in favor of this form of segmentation because it best reflects the opportunity and threat structure of the company. The distinctive nature of customer groups and the technical solutions and products used provide clear differentiation between the segments.

Cybersecurity "cyan digital security"

The Cybersecurity Segment comprises all services provided by cyan that are based on the use of technology developed by cyan for protection against threats on the Internet. In this segment, cyan delivers its services and products such as OnNet Security, OnDevice Security, Child Protection, or Clean Pipe DNS. The security solutions from cyan are integrated either directly in the infrastructure of the customers, or deployed in the cloud of the business partners, who then offer the products in their own names ('white labeled') to their end users as a value-added service ("B2B2C"). Contracts in the cybersecurity segment usually feature a revenue share or software license model that generates recurring revenues.

The Cybersecurity Segment consists primarily of the subgroup headed by cyan Security Group GmbH and has a global focus. Direct customers supplied with cybersecurity solutions from cyan are located in Europe, Asia and South America.

OnNet Security

OnNet Security is cyan's fully network-integrated cybersecurity solution, it is, for example, successfully implemented in national networks of Deutsche Telekom Group and Orange Group. The DNS-based filter is integrated directly in the network infrastructure of the corresponding MNO so that the MNO can generate revenues with its end customers through additional packages and at the same time strengthen its own brand with cyan's white-label approach. For each active end user, cyan receives a monthly license fee for the provision of the cybersecurity solution, or derives a direct percentage of the relevant sales revenue.

OnDevice Security

cyan's OnDevice Security (Endpoint Protection) forms an additional security layer that is installed directly on the end customer's device. The end users protect their smartphone via an app either as a standalone app or integrated into an existing app using an SDK. In addition to the cybersecurity filter, this also includes additional features such as identity and website checks or virus scanners. They are connected to the cyan filter system, which is implemented in the partner's infrastructure, locally or via cloud. The app is a standalone solution and is often sold to customers as a premium extension to the OnNet Security solution based on the same model.

Child Protection

By using the Child Protection solution, parents are given the tool they need to provide their children with optimum protection against the dangers on the Internet and to manage activity online. In a central admin panel, individual profiles can be set up for each child. The app provides age-dependent default settings that are easy for parents to adapt to individual needs. This solution is sold primarily to telecommunications companies as a white label solution, which then offer it to their customers as an additional service (B2B2C).

Clean Pipe DNS

With Clean Pipe DNS, undesireable and prohibited data packages are filtered out of the data flow, leading to significant cost savings for the MVNOs and can be required for the fulfillment of compliance stipulations. In particular, cyan technology can block malicious sited and what is known as background trackers and advertising that loads in the background. This improves the surfing experience of the customer, reduces the volume of data consumed and protects the subcribers from online-threats. Through the reduction in data achieved using the Clean Pipe DNS solution, MNOs are confronted with a lower number of network peak loads which means that network operators can save on the need for investment in the network.

BSS/OSS "i-new"

The BSS/OSS segment comprises the services and technology to operate as virtual network operators, sub-brands or agile telecom operators in the market. cyan is providing a modular product, the MVNO platform, as a one-stop shop for MVNOs and digital communication service providers. This involves offering MVNOs the entire range of products needed to operate a virtual mobile operator.

The spectrum of functionality provided by cyan ranges from connection to the MNO network, the core network, service delivery, (online) charging, billing, rating and policy control through to customer and product management with tools for customer experience, customer management, PoS support, loyalty campaigns and more. The platform supports common mobile standards, including 5G. On the convergent MVNO platform, all digital services and features are managed in a cloud-based service hub by the customer or as a managed service.

The software is distributed as a B2B white label solution to MNOs for their B-brand and MVNE platforms and to MVNOs. The software can be installed on-premises at customers' datacenters directly, alternatively customers can purchase all the services via one of i-new's BSS/OSS Service Hubs. In the BSS/OSS segment, licenses are typically sold on a monthly basis or in packages, and separate maintenance, support and implementation services are charged where applicable.

This segment originally resulted from the business of I-New Unified Mobile Solutions GmbH and its subsidiaries (excluding the Subgroup of cyan Security Group GmbH), which cyan AG acquired in 2018. The geographical footprint in this segment was primarily South America, with the customer base in Europe recently being expanded.

Organizational structure

The strategic management of the Group takes place at the headquarters of the Group holding company in Munich (Germany). cyan AG is listed in the Scale segment, the SME growth market (open market), of the Frankfurt Stock Exchange in Frankfurt am Main (Germany). The stock corporation under German law has a dual management structure consisting of an Executive Board and a Supervisory Board. The Supervisory Board appoints, advises and monitors the Executive Board. The size of the Supervisory Board was reduced by two seats to three members by resolutions of the 2022 Annual General Meeting. No committees were formed in the Supervisory Board. More information on the activities of the Supervisory Board can be found in the Report of the Supervisory Board.

The Executive Board consisted of two members at the time of preparing this report and it is responsible for the strategic and operational management of the Group. The Chief Executive Officer (CEO) is responsible for Sales, Marketing, Partner Management, Finance/Controlling and Human Resources. He is also responsible for regional management in Latin America. The Chief Technology Officer (CTO) is responsible for Product and Engineering (Research, Development, Project Management and Support), Operations and Legal.

At the beginning of the financial year 2022, changes occurred in the organization of cyan AG. There was a change in the Supervisory Board at the turn of the year 2021/2022. Alexander Schütz left the board as of December 31, 2021. For the vacant position, the Supervisory Board nominated Adrian Shatku, who was court appointed to the Supervisory Board as of January 7, 2022. As a result of the departure of Alexander Schütz, who served as Chairman of the Supervisory Board until December 31, 2021, Stefan Schütze was elected Chairman and Lucas Prunbauer Deputy Chairman of the Supervisory Board. The members of the Supervisory Board Adrian Shatku and Trevor Traina retired their mandates at the end of the Annual General Meeting on June 22, 2022, at which it was resolved to reduce the number of members to three.

Objectives and strategy

With its two segments, cyan has been synonymous with safe connectivity for over 15 years. i-new serves as a cost-efficient service provider and system developer for digital telecommunication providers and enables as MVNE innovative services on all levels, voice, text and data. cyan Threat Intelligence - cyan's intelligent cybersecurity technology - ensures that devices and people are protected from digital threats and dangers in their daily use of the Internet. The goal for the future is to continue to lead the way in safe connectivity and Internet usage - regardless of how and where people access Internet content.

In the fourth quarter of 2021, as a result of a significant reduction in the expected sales figures, the general business strategy as well as the longer-term targets were put to the test and evaluated extensively. The Executive Board decided on a comprehensive restructuring concept at short notice to enable the Group to return to sustainable growth as quickly as possible. A cost reduction program covering all areas of the company was therefore initiated in 2021 and implemented by the beginning of 2022, resulting in significant savings in services procured, personnel and other expenses. With the launch of the independent brands for the business units, the separation of the segments also became visible externally in the first quarter of 2023. This realignment of the Group provides a significantly stronger basis for implementing the medium- and long-term strategy with a focus on increasing recurring revenues on the way to becoming a sustainably operating company.

The medium-term Group strategy will be implemented under the guiding terms "Connect. Detect. Protect." and reflects the digital value chain in which cyan is involved. With its BSS/OSS platform, i-new enables digital connectivity, and with cyan digital security's cybersecurity solutions, it protects end users. The two aspects are connected through technology that provides customers with the advantage in agility, retention and security for users.

Operationally, the focus will continue to be on monetization, and additionally, greater standardization of the solutions offered with the aim of significantly reducing implementation time and lowering costs. Faster onboarding of end customers will thus make it possible to generate revenues earlier and at the same time fine-tune the technology and marketing. A dedicated go-to-market team (monetization, marketing, etc.) supports customers from day one in the commercial aspects. Based on the partner-based approach, a higher penetration rate in the partner's end customer base is expected. This concept is already well accepted by the telecom partners and represents an additional service that sets the cyan Group apart from competitors in the field, especially in the cybersecurity business.

In the long term, larger investments in new markets and products in both segments are also possible. Potential growth options are being reviewed in an ongoing process. These include geographical expansion as well as more substantial product extensions. Based on the fundamental idea of "One Technology - Many Opportunities", cyan is capable of offering solutions for other target groups, industries and regions in the cybersecurity segment in addition to the telecom industry. Expanding the business base in this way and addressing new markets reduces the dependence on individual sectors in the long term and significantly increases the potential for cyan. Details on market developments and opportunities are explained in the management report on sector-specific developments and in the opportunities report.

Management system

The management system's aim is the targeted execution and monitoring of the corporate strategy. The system is implemented through regular strategic discussions and planning talks within the Executive Board and with the staff responsible for the respective area. Value drivers are at the heart of Group management. These have a direct influence on the medium and long-term growth strategy of the Group. The aim is to detect deviations from strategy and planning based on defined key indicators in good time, to enable appropriate measures to be initiated. The Executive Board reports to the Supervisory Board on a regular basis on matters of strategy, planning and related measures.

The central key indicators for management of the Group were, in the most recent financial year and in the year prior to that, revenue, and EBITDA (significant financial performance indicators), as reported in the consolidated financial statements. As part of the realignment of the strategy, the performance indicators have been adjusted slightly and were supplemented by the recurring revenues as significant performance indicators for the ongoing business. Recurring revenues reflect the sustainability and stability of cyan's business model. As a growth company, attention is additionally paid to (operational) cashflow and further to that to the net liquidity of individual subsidiaries as well as the financial performance indicators, non-financial indicators for management, in particular the number of employees, the addressable market and the development of the sales pipeline are part of the operational management system.

For both segments, Cybersecurity and BSS/OSS, as in the previous financial year, the same key indicators for management as at overall Group level are used. These indicators are also applied to internal reporting.

Research and development

Research and development plays a major role in safeguarding the competitiveness and lasting success of the Group. In particular, the cybersecurity sector is one strongly characterized by innovations. A close exchange is maintained with research institutions working on various Internet security topics, such as threat detection with new approaches, the use of artificial intelligence (AI), and the analysis of Internet traffic using machine learning (ML).

At the beginning of the financial year 2022, a new research project "DynAISec - Adaptive AI/ML for Dynamic Cybersecurity Systems" was started, which is to decisively advance AI4Sec. The project aims to improve adaptive and incremental learning of AI/ML models so that they can keep up with novel cyber-attacks and network traffic. Goals include development of AI4Sec models with adaptive capabilities for improved cybersecurity performance (higher detection rates with reduced false alarms); algorithms for automatic generation of synthetic cybersecurity data for adaptive retraining with guarantees on the correctness of the synthetic data; Software libraries that provide explanations of model behavior prototypes, with specific application areas of in-network security (malware propagation, IoT-targeted attacks, DDoS attacks), web browsing end-user security (phishing, fake site detection, privacy leaks, employee data exposure), and in-device security of mobile devices (malware detection on smartphones).

In the fourth quarter, cyan joined the "Resilience in Online Commerce" (RIO) project, which continues the successful prevention work through targeted innovations along the fake store detection lifecycle. The goal is to combat order fraud, through fake stores as well as through investment platforms, which are increasing concurrently with the popularity of cryptocurrencies, with new technical security measures. This includes a scalable platform for AI-based risk assessment services, a community-led approach to fraud detection, an app-based real-time protection solution, demonstrators to increase human comprehension of AI-based risk assessments, analysis of fraudulent cryptocurrency investment platforms, and studies on socio-demographic factors and fraud patterns in online commerce.

Furthermore, cyan continues to participate in research topics in the areas of IoT/CPS security (cyber-physical systems), security of decentralized systems and distributed ledger technologies, and security in machine learning as part of the COMET program.

The results from in-house research combined with partnerships are used in cyan's Threat Intelligence, cyan's proprietary cybersecurity database. In addition, cyan's goal is to better inform and educate end users and partners about cybersecurity. With this in mind, internal projects were initiated in 2022 to provide better insights to help users sustainably make their behaviors more secure. A feedback loop can then be used to improve algorithms, threat intelligence, and user experience.

On the product end, significant progress has been made along the entire development and delivery process, which will help to further accelerate rollouts and reduce dependency on third-party suppliers. One element represents the automation of quality assurance. The often complex network environments, the high quality of service requirements and the shortening development cycles necessitate efficient and fast end-to-end testing of products and features, which will now be automated and internalized.

In April 2022, the SDK-based solution was launched at dtac in Thailand, which uses a fully cloud-based approach with Amazon Web Services (AWS). In this context, cyan was able to further expand its cloud capabilities and other key advances and developments were also made on app-based solutions. For example, in containerization for the rapid and largely automated deployment of products in the cloud.

Furthermore, the financial year 2022 was characterized by many customer projects in both the Cybersecurity and BSS/OSS segments. The implementation in the Orange network in Slovakia was completed and the solution was launched at the beginning of 2022. The expansion of the available products took place during the year. With OTE, the fastest project to date was completed in the second half of 2022, reflecting the corresponding adjustments to the product but also to the sales strategy. Further milestones were also achieved in the project with Claro. Finally, a refresh of the product was completed at T-Mobile Poland at the end of the year.

A number of enhancements were also implemented in the BSS/OSS segment as part of customer projects. At the beginning of the year, the first 5G MVNO in Austria started operations on the i-new MVNE platform, and the launch of MTEL in Switzerland at the end of the year provided a significant reference for the multi-MNO capability of the MVNE platform. With the implementation in Germany, three different host network operators are used in total. Significant improvements were made in this regard with the increasing spread of eSIM-based end devices.

Together with customers, a number of new features for bundles and contract variations were also implemented, enabling them to respond even more dynamically to the needs of their target groups. In addition, further in-house components were put into operation in the course of the year, thus reducing dependence on externally supplied solutions. In cooperation with Viasat, additional new core network elements were connected to the platform.

The research and development expenses amounted to EUR 4.3 million, a decrease compared to the previous year (2021: EUR 4.6 million) by 6.6% as a result of the performance improvement program. The research and development ratio (research and development expenses as a percentage of Group revenue) amounted to 49.1 % (2021: 54.1 %). If the requirements for capitalization of development costs pursuant to IAS 38 are met, they are recognized in the balance sheet under intangible assets. No development costs were capitalized in the 2022 financial year. Scheduled amortization in the reporting period was unchanged amounting to EUR 54 thousand (2021: EUR 54 thousand). As a result, the development costs in assets declined slightly from EUR 837 thousand on December 31, 2021 to EUR 783 thousand on December 31, 2022. Research and development expenses were mainly incurred for the above-mentioned innovations. cyan received subsidies in the form of research grants and subsidized loans for services rendered within the scope of research projects. Further notes to the recognition of intangible assets and development costs can be found in the Notes to the Consolidated Financial Statements.

in EUR thousand	2022	2021
R&D expenses	4,293	4,593
Capitalized development costs	0	0

Personnel development

For cyan as a company in the knowledge-intensive IT and software sector, highly qualified employees represent one of the most important factors for sustainable corporate success. Great attention is paid to the selection of the right employees and their further development. The aim is to retain these employees in the long term. Attention is placed on promoting the diversity of employees in terms of gender, origin, age and other individual characteristics at all levels.

As part of the restructuring, all areas were re-evaluated and realigned, and appropriate staffing actions were taken by making targeted adjustments to areas and teams in Sales, Customer Support and Engineering/Development. As a result of the changes, certain positions were not filled or new positions were created. The last shifts and adjustments in assignments were finalized during the summer.

As of December 31, 2012, cyan employed 126 people, excluding external employees and employees on leave. This is equivalent to 123 FTEs. In the second half of 2022, employees were selectively hired or returned from leave. A significant portion of the workforce continues to be employed in operations, development, product management, and research and development. A quarter of the workforce was employed outside the European Union. Women make up one sixth of the global workforce and will be further increased.

per 31/12/2022	Total	EU	Rest of world
Personnel	126	94	32
thereof in operations, development, research	95	71	24

Economic report

Economic environment

The nascent global recovery in mid-2021 was already faltering when Russia's attack on Ukraine and the resulting sanctions in February 2022 delivered a major shock to the economy. The high level of supply uncertainty, particularly for natural gas from Russia, led to a sharp rise in inflation, driven by energy and commodity prices. 2 As a result, the forecasts for the growth of the gross domestic product (GDP) had to be revised downwards on several occasions. The World Bank reduced its forecast for 2023 from 3.2% in January 2022 to 1.7% in January 2023. With inflation rising to over 7.6% globally and as high as 11.5% in the European Union, central banks also took action and raised key interest rates. 3

The U.S. Federal Reserve was one of the first to respond, raising the federal funds rate by 25 basis points in March and by up to 75 basis points in six additional steps to a total of 4.25% by the end of the year. A further increase to 4.50% was announced for early 2023. 4 The European Central Bank followed suit in July, thus bringing the period of negative interest rates to an end. The ECB's benchmark rate reached 2.50% at the end of the year and was raised again to 3.00% at the beginning of 2023. 5 As core inflation forecasts remain high in the face of tight labor markets, the central bank is expected to continue tightening monetary policy. In addition, the Governing Council decided in February 2023 to reverse the trend in asset purchases (APP), which will reduce the APP portfolio from the beginning of March to the end of June 2023. Business investment is expected to be affected in the near term by rising financing costs, high uncertainty, and energy prices. 6

The global outlook is clouded by slowing demand. The global composite manufacturing purchasing managers' index (PMI) for December confirmed the slowing momentum in the global economy, remaining below the 50 threshold at 48.7 at the end of the year. 7 After strong employment growth in 2022, the labor market is expected to ease slightly in 2023, reflecting lower demand for labor due to the economic slowdown. In the short term, firms are expected to adjust working hours downwards and to hoard labor in the face of still significant labor shortages. Inflation is forecast to decline in the coming years to 6.3% in 2023, 3.4% in 2024 and 2.3% in 2025. As a result, real household consumption growth is projected to contract in 2023 and real disposable income is expected to shrink in 2023, but to recover in the following years. 8

Overall, real GDP growth is predicted by the European Central Bank to slow from 3.4% in 2022 to 0.5% in 2023, before recovering to 1.9% in 2024 and 1.8% in 2025. 9 The World

² ECB (2022), Economic Bulletin, Issue 2 / 2022; ECB (2023), Economic Bulletin, Issue 8 / 2022.

³ World Bank (2023), Global Economic Prospects – January 2023.

⁴ Federal Reserve Bank of New York (2023), Effective Federal Funds Rate (www.newyorkfed.org/ markets/ reference-rates/effr).

⁵ ECB (2023), Key ECB Interest Rates (www.ecb.europa.eu/stats/policy_and_exchange_rates/key_ecb_ interest_rates/html/index.en.html).

⁶ ECB (2023), Economic Bulletin, Issue 1 / 2023.

⁷ ECB (2023), Economic Bulletin, Issue 1 / 2023.

⁸ ECB (2022), Eurosystem staff macroeconomic projections for the euro area – December 2022.

⁹ ECB (2023), Eurosystem staff macroeconomic projections for the euro area – December 2022,

Bank forecasts global GDP growth of 1.7% in 2024 and 2.7% in 2025, with much higher growth outside the US, Japan and the EU at 3.4% and 4.1% respectively. 10

Sector specific business environment

Telecommunications sector

In telecommunications, new subscriber growth will be driven by large, underserved markets in developing regions, such as India and Africa, which will account for about half of all new mobile subscribers worldwide between 2022 and 2030. As a result, the majority of new subscribers will be young consumers and residents of previously untapped rural regions. 11 Despite the increasing saturation of new subscribers in developed regions, new potential is emerging through the monetization of 5G investments. Overall, the number of mobile subscribers is expected to continue to grow from 5.4 billion to 6.3 billion by 2030. 12

In addition, the gap in mobile internet usage is expected to narrow further. It has already closed significantly over the past five years - from an average of 50% in 2017 to 41% in 2022 - as more people around the world rely on the Internet for many daily activities. The usage gap is widest in Sub-Saharan Africa, highlighting the impact of multiple barriers to mobile internet use. The usage gap is lowest in Europe and North America, at less than 15% of the population. 13 Given the already high penetration and inflation in high-income economies, global shipments of mobile devices (phones and tablets) are projected to decline by 3.9% from the pandemic peak through 2023. 14 However, smartphone penetration is expected to increase from 76% at present to as much as 92% by 2030. 15

Smartphone adoption will be accompanied by increasing network expansion, particularly with 5G, which will enable fast and increasingly unlimited Internet use. The new technologies will also create new opportunities for Internet use, both in terms of technology, through FWA (fixed wireless access) and IoT, and in terms of the content consumed, which will increasingly be streamed from the cloud, multiplying mobile data volumes. 16

Cybersecurity

The increased penetration of smartphones and Internet-enabled devices has opened up additional attack vectors and thus increased the cyber risk. At the same time, cybercriminals have been able to become considerably more professional in recent years and expand their cybercrime-as-a-service offering. The result has been numerous cyberattacks that have been publicized in the media, forcing entire companies to come to a standstill. This is also reflected in the Allianz Risk Barometer, where

¹⁰ World Bank (2023), Global Economic Prospects – January 2023.

¹¹ Ericsson (2022), Ericsson Mobility Report – November 2022.

¹² GSMA (2023), The Mobile Economy 2023.

¹³GSMA (2023), The Mobile Economy 2023.

¹⁴ Gartner (2023), Market Share: PCs, Ultramobiles and Mobile Phones, All Countries, 4Q22 Update.

¹⁵ GSMA (2023), The Mobile Economy 2023.

¹⁶ Ericsson (2022), Ericsson Mobility Report – November 2022.

cyber risk has consistently ranked among the top three risks over the past five years and is again the number one topic among risk experts in 2023. 17

The topics of cyber risk and cyber resilience are playing an increasingly important role among decision-makers, in part due to high-profile incidents in recent years. However, business leaders tend to focus on internal solutions for cyber risk management, while security leaders place a higher priority on partnerships with other organizations. 18 In recent years, an growing number of large enterprises and corporations have increased their investment in cybersecurity tools as awareness has grown and become a management responsibility. An unanticipated consequence of this trend is that the number of small and midsize businesses affected by a cyber incident is increasing, as those with weaker controls make it easier for criminals to reap the financial rewards. 19 Companies with annual revenues of USD 100,000 to USD 500,000 can now expect as many cyber attacks as those with annual revenues of USD 1 million to USD 9 million. 20

MVNO & BSS/OSS

MVNOs are operators who lease bandwidth and wireless frequencies from mobile network operators (MNOs) and sell these on to consumers. This exchange benefits MNOs as well as consumers. The operating costs of MNOs in relation to billing, customer service, and marketing are reduced. Also, the customer base of the MNOs is extended indirectly to include niche customers by offering targeted, segment-oriented differentiation in products and prices to customers who fall outside the core customer base of traditional MNOs.

In the past, MVNOs have differentiated themselves through a targeted segment and pricing strategy, such as offering special services for migrant groups or data-centric plans for younger populations. 21 Today, additional opportunities arise from special service differentiation enabled by IoT systems and 5G technologies. The increasing deployment of 5G is enabling a new breed of MVNOs through network slicing. These will target industries with specific connectivity needs with bundled solutions. Electronic SIM cards (eSIMs) will provide instant connectivity for all users. Consumers will find it easier than ever to purchase connectivity plans, as the traditional logistics of physical cards will be eliminated. The MVNO model is therefore beneficial to consumers, MVNOs and MNOs, and continues to gain momentum in the global telecom market through liberalization, especially in countries with little or no MVNO activity, such as Africa. 22

¹⁷ Allianz Global Corporate & Specialty (2023), Allianz Risk Barometer: Identifying The Major Business Risks For 2023.

¹⁸ World Economic Forum (2023), Global Cybersecurity Outlook.

¹⁹ Allianz Global Corporate & Specialty (2023), Allianz Risk Barometer: Identifying The Major Business Risks For 2023.

²⁰ Hiscox (2022), Hiscox Cyber Readiness Report 2022.

²¹ Connect.de & umlaut (2021), Günstig ins Netz "MVNO Benchmark".

²² World Bank (2023), Digital Africa: Technological Transformation for Jobs.

Positioning of the Group

The past couple of years have been characterized by the volatility of external factors, the pandemic, the recovery phase and, most recently, inflation driven by energy prices. From a macroeconomic perspective, there are still considerable uncertainties in the forecasts, which may also have an indirect impact on cyan. It can be assumed that these fundamental changes will also affect the general conditions in the relevant markets. Irrespective of this, cyan operates in a growth market, particularly in the cybersecurity segment, whose long-term development is largely independent of the general market trend. In the past year, cyan has gained additional direct customers in this segment, who in turn market the solutions to their end customers.

Cybersecurity technology for mobile devices, delivered through a network-integrated approach, is not yet common, so competition in this market is limited to a few vendors in an otherwise broad cybersecurity market. Traditional endpoint solutions are continuously getting replaced by contemporary alternatives that are better suited to meet current challenges such as heterogeneity of terminal devices ranging from high-end smartphone to low power IoT-device, and the performance and agility required for deployment. cyan is in competition mainly with providers of cloud-based solutions, traditional DNS providers security products as well as with deep packet inspection (DPI). The former, cloud providers, have the significant disadvantage that their traffic has to be directed partially or entirely via third-party data centers. This can lead to significant overhead and latencies but also presents problems in relation to data protection. Traditional DNS providers have the advantage of a partially existing customer base, but their products are often 'add-ons' and are not the primary focus of attention. Also, scaling in the fixed and mobile network with regard to 5G is often difficult or even impossible due to the old architectures involved. The latter, solutions based on deep packet inspection, are reaching their limits due to the required computing power combined with low latency as the data throughput surges, triggered among others by the expansion of 5G networks and the increasing proportion of encrypted data packets. Furthermore, the modern Scale-to-the-Customer approach on communications networks, where service delivery should, wherever possible, occur in the geographic vicinity of the customer, is hard to reconcile with DPI approaches and the required roll-out of infrastructure. cyan offers telecom companies a state-of-the-art addition to the product portfolio with highly scalable solutions that meet the needs of end customers, consumers and enterprises, for easy-to-use and trustworthy cybersecurity.

The competitive situation in the less mature cybersecurity industry is different from that in the established and price-sensitive market for MVNO technology and services due to the high margins and disruptive technologies. The BSS/OSS market is dominated by a small number of big players, although their solutions are directed at the comprehensive needs of Tier-1 telecommunications companies and are correspondingly expensive and elaborate, both in terms of project implementation and of everyday operation. In many cases, these systems and services are not suitable for the requirements of a dynamic and cost-sensitive MVNO. In this respect, right from the outset, i-new has established itself in the market with a completely digital and therefore quickly deployable, cost-effective convergent platform. i-new, therefore, is in competition with smaller agile providers here, which as a rule cannot cover a broad product spectrum like i-new's BSS/OSS platform.

Course of business

The first months of the fiscal year were characterized by customer projects and the implementation of the new cost reduction strategy (see course of business of the segments). This also meant that cyan had to lay off some employees and strategically streamline areas and teams or reallocate resources. In addition, overhead costs that were not essential to the core business were significantly reduced. Other measures, such as the standardization of processes and solutions to speed up implementation, are also being implemented, which in addition to reducing costs will also enable the company to generate revenues sooner in the medium term. As another key element of the Performance Improvement Program, the positioning of the BSS/OSS segment was evaluated and it was concluded that it should be repositioned within the Group. The repositioning, including a separate brand identity for the business unit, was subsequently implemented during the year and launched in early 2023.

As part of the new strategy program, the Executive Board decided to terminate the convertible bond program at the beginning of 2022, as the share price had fallen persistently below the defined minimum price and cyan was therefore unable to obtain further convertible bonds. Together with an investor, it was agreed to redeem the convertible bonds by means of a capital increase through contributions in kind and to contribute them to cyan in exchange for new shares without a significant outflow of capital. Subsequently, in February 2022, cyan AG entered into an agreement with a creditor of the Company pursuant to which the creditor's receivables in the amount of approximately EUR 3.9 million will be contributed to the Company by way of a capital increase against contribution in kind in exchange for 1,503,816 shares.

On August 19, 2022, the Executive Board, with the approval of the Supervisory Board, resolved a cash capital increase with subscription rights (subscription ratio 7:1) for existing shareholders. The subscription period was set from September 5 to September 19 and the issue price per new share was set at EUR 2.63. Shares not subscribed by shareholders were then offered to interested investors in a private placement. As a result, the Company's share capital was increased by EUR 2,127,100 from EUR 14,889,700 to EUR 17,016,800, using part of the authorized capital. The new shares are fully entitled to dividends as of January 1, 2022. The capital increase generated gross proceeds of EUR 5.6 million, which were recognized in the fourth quarter.

At the end of the year, cyan had to adjust its forecast due to a delay in an international project in the BSS/OSS segment as a result of a pending approval process between cyan's customer and the responsible regulatory authority. As the majority of customers are now based on a recurring revenue model, Group revenues in 2022 were expected to be in the range of EUR 8 million to EUR 9 million (previously: EUR 11 million to EUR 13 million). The forecast for the operating margin (EBITDA) was maintained with a significant improvement compared to the previous year due to the successful performance improvement program.

Cybersecurity segment

On the side of the cybersecurity segment, the partnership with the Orange Group was extended to a second active country with the launch in Slovakia in February, enabling additional end customers to purchase cyan's solutions. The cybersecurity product "Online ochrana" (Online Protection) is offered as an Orange-branded service as a tariff-integrated part of the "Go Safe" tariffs and as a stand-alone add-on package for business and consumer customers on mobile and fixed lines. The tariff-integrated option resulted in a high take-up rate following the launch. In the meantime, preparations for the second phase with additional features were started and the service went live for Orange customers in the fourth quarter. Further products and enhancements are planned for 2023.

Another important milestone in the first quarter was the successful implementation of cyan's solution at dtac in Thailand. The company is part of the Telenor Group and is one of the largest mobile operators in Thailand with approximately 19 million customers. At dtac, cyan's OnDevice Security is deployed under dtac's own branding as "dtac Safe". "dtac Safe" is part of the popular dtac app and can be activated with a few simple steps. The software development kit (SDK), cyan's solution, is integrated directly into the app and uses the Amazon Web Service cloud. In early 2023, the merger of dtac and True was approved to create the largest telecommunications provider in Thailand.

In the summer, the largest technology company in Greece, OTE Group, was won as a cybersecurity partner. The solution was integrated into Cosmote's network within the shortest technical implementation period to date of just six weeks. The Cosmote On-Net Security product has been available as part of new business customer tariffs since November.

An upgraded version of the cybersecurity product was also launched at T-Mobile in Poland just in time for the Christmas shopping season. Since then, "Bezpieczne surfowanie" (Secure Surfing) has been available to customers as an additional service a trial period of one month is granted upon initial activation.

In Austria, the number of subscribers continues to trend positively and in France the number of subscribers is growing steadily. The successes in France and Slovakia are important references for other countries in the Group.

At the end of the year, cyan had a new record number of active cybersecurity partners, with more future projects in the pipeline, such as Claro Chile. As the year progressed, the numerous successful go-lives provided an important reference for discussions with and the acquisition of additional customers. One of them, MTEL, could already be announced at the beginning of 2023.

BSS/OSS Segment

In the BSS/OSS segment, also known under its brand name "i-new", several MVNOs were able to launch on the i-new platforms. At the beginning of the year, the Austrian telecommunications company educom completed its migration to the i-new platform. educom offers mobile and internet tariffs tailored to students, pupils, trainees and employees of educational institutions. As part of educom's transformation from a reseller to a 5G Mobile Virtual Network Operator, i-new's Seamless BSS/OSS & MVNE platform was chosen to enable educom's evolution into an independent and 5Gready Mobile Virtual Network Operator (MVNO).

In March and April, MVNOs Lov and Liwa followed suit in Colombia. Lov started as a social enterprise, using mobile services as a tool to improve people's lives. Liwa is a multi-service company and part of the T-Valley Group, providing telecommunications, renewable energy and IoT to underserved areas. The launch added mobile telephony to its product portfolio.

The project with Viasat, a world leader in satellite technology, which had been underway since the beginning of the year, was announced in October already as being at an advanced stage. The company is using i-new's BSS/OSS platform to bring satellite connectivity to Viasat's end-users in hard-to-reach areas around the world. Viasat's next generation satellite constellation, ViaSat 3, is expected to deliver even higher bandwidths. The project also represents an important milestone and demonstrates the versatility of the i-new platform.

The project work related to the extension of the long-standing cooperation with MTEL for joint expansion into the larger markets of Germany and Switzerland has progressed rapidly. In November, MTEL opened its first store in Switzerland. This will lead to a significant increase in the number of end customers. The project involves connecting two new MNOs to the i-new platform and upgrading the hardware.

Other projects with existing and new partners could make significant progress during 2022. On the one hand, some letters of intent have already been signed with interested partners, but on the other for some official licensing is still pending at year-end.

Earning, asset and financial position

Earnings position

Revenue

Group revenues totaled EUR 8.5 million in 2022 (2021: EUR 8.5 million). In the last quarter, revenues decreased slightly compared to the same period of the previous year (EUR 2.6 million) and amounted to EUR 2.4 million. In the fourth quarter, revenues included a one-time effect of EUR -0.2 million due to maturity adjustments of contract assets. However, due to a postponed project, revenues remained below the originally expected level. The proportion of recurring revenue, which includes in particular revenue from subscriptions and recurring service and maintenance fees, was 78%. Annual Recurring Revenue (ARR), which is calculated as recurring revenue including proportionate revenue from license agreements, amounted to EUR 10.3 million at constant currency as of December 31, 2022.

cyan generated 17% (2021: 14%) of Group revenues in the Americas region, 20% (2021: 17%) in the APAC region and 63% (2021: 69%) in the EMEA region. The changes are primarily attributable to customer projects and new customer wins in the respective regions.

In addition to revenues from sales, the Group generated other operating income of EUR 4.2 million (2021: EUR 3.0 million), income from the reversal of impairment losses of EUR 0.0 million (2021: EUR 0.1 million), and recognized changes in inventories of EUR -0.3 million (2021: EUR -0.8 million). Other operating income mainly includes exchange differences of EUR 2.7 million (2021: EUR 2.0 million) and income from research grants for research conducted of EUR 0.9 million (2021: EUR 1.0 million). Further details on research are provided in the section "Research and Development". Changes in inventories amount to EUR -0.3 million (2021: EUR -0.8 million) and are negative due to the release of incurred project costs (contract costs) since the launch in the second quarter of 2021.

Accordingly, the total earnings for fiscal year 2022 amount to EUR 12.4 million (2021: EUR 10.8 million).

EBITDA

EBITDA improved to EUR -8.4 million in 2022 (2021: EUR -12.3 million), in line with the guidance. Operating expenses were reduced from EUR 23.1 million in the previous year to EUR 20.7 million; in 2020, operating expenses amounted to EUR 30.4 million.

Expenses for purchased materials and services amounted to EUR 5.0 million in the past fiscal year (2021: EUR 5.3 million). The cost of materials decreased by EUR 0.3 million compared to the previous year.

Personnel expenses were reduced from EUR 11.4 million to EUR 9.3 million as a result of the performance improvement program. The number of employees decreased from an average of 150 in fiscal year 2021 to 136 in fiscal year 2022. The savings affected all areas, but had the greatest impact in Austria, where the average number of employees decreased by approximately 20%.

Valuation adjustments and other operating expenses amounted to EUR 6.5 million (2021: EUR 6.3 million). Currency effects had a stronger impact on other operating expenses of EUR -1.4 million in the year under review than in the previous year (2021: EUR -0.4 million). With the easing of travel restrictions, travel expenses increased slightly again, while advertising costs were significantly reduced.

Segments

At EUR 4.7 million (2021: EUR 5.2 million), 55% of revenues are attributable to the segment BSS/OSS (i-new). In the BSS/OSS segment, multi-year license agreements were concluded with Virgin Mobile and Flash Mobile in the financial years 2019 and 2020, the majority of the revenues of which have already been recognized. Therefore, these customers were mainly contributors to cash flow. In 2021, the terms were adjusted, resulting in a negative revenue effect of EUR -0.2 million. Compared to the previous quarter, revenues also decreased slightly as projects were completed and customers went live. Total revenues amounted to EUR 7.8 million (previous year: EUR 7.3 million) and segment EBITDA to EUR 3.7 million (previous year: EUR 2.4 million). The average number of employees increased from 81 to 87. The change in expenses is also due to the Performance Improvement Program, under which costs were reallocated to the segments.

At EUR 3.8 million (2021: EUR 3.3 million), the Cybersecurity segment generated around 45% of Group revenues. Revenues in this segment increased compared to the previous quarters of the financial year. Revenues in the fourth quarter include approximately EUR 0.5 million of one-time effects from billing changes. The decline resulting from the scheduled discontinuation of support for the products of the former cyan Networks Software GmbH was offset by new business. Total earnings increased from EUR 3.5 million to EUR 4.5 million. The average number of employees fell from 69 to 49. Segment EBITDA improved significantly year-on-year from EUR -7.9 million to EUR -3.6 million.

EBIT und net income

The loss from operating activities (EBIT) for the financial year 2022 amounted to EUR 14.0 million (2021: EUR -18.1 million). Depreciation and amortization expense decreased slightly from EUR 5.7 million to EUR 5.6 million, of which EUR 4.6 million was for amortization of intangible assets and EUR 1.1 million for depreciation of property, plant and equipment. Depreciation is mainly scheduled and includes depreciation expense in accordance with IFRS 16.

The financial result amounted to EUR 0.5 million in 2022 (2021: EUR 0.6 million), which resulted primarily from interest income from contract assets. Accordingly, earnings before taxes (EBT) improved to EUR 13.5 million (2021: EUR 17.5 million). At the end of the year, the tax planning was revised, resulting in an income tax expense of EUR 3.0 million (2021: tax income EUR 3.6 million) due to the revaluation of deferred taxes.

The net loss for the year amounted to EUR 16.5 million (2021: EUR 13.9 million). Accordingly, undiluted earnings per share were EUR -1.11 (2021: EUR -1.30).

Asset position and capital structure

Total assets decreased from EUR 95.7 million as of December 31, 2021 to EUR 84.0 million as of December 31, 2022. Non-current assets decreased from EUR 77.9 million to EUR 68.9 million, in particular due to scheduled depreciation/amortization and the reduction in office space. Current assets decreased due to the cash and cash equivalents used. Inventories were used for projects and consequently decreased. In total, current assets declined from EUR 17.7 million to EUR 15.1 million.

Equity amounted to EUR 65.8 million at the end of the year (2021: EUR 72.8 million). This corresponds to an equity ratio of 78% (2021: 76%). Total liabilities decreased from EUR 23.0 million to EUR 18.2 million. The reduction resulted in particular from the capital increase through contributions in kind, whereby EUR 1.5 million in non-current financial liabilities and EUR 2.5 million in convertible notes were contributed in exchange for shares. Furthermore, leasing liabilities decreased due to the downsizing of office space. As a result of the adjustment of the tax planning at the end of the year, deferred tax liabilities increased. Non-current liabilities amounted to EUR 11.9 million (2021: EUR 12.4 million) and current liabilities to EUR 6.3 million (2021: EUR 10.6 million).

Net debt totaled EUR 1.3 million as of December 31, 2022 (2021: EUR 4.2 million), including IFRS 16 liabilities in the amount of EUR 3.0 million (2021: Eur 5.0 million). Cash and cash equivalents amounted to EUR 5.3 million (2021: EUR 8.5 million). Of the financial liabilities, loans in the amount of EUR 3.0 million were contributed to the Company at the beginning of 2023 as part of a capital increase through contributions in kind (see Subsequent events).

Financial position

Cash flow from operating activities improved to EUR -6.8 million in the financial year 2022 (2021: EUR -10.6 million). The improvement is attributable to the Group's increased earnings position. The license agreements with Virgin Mobile and ACN/Flash Mobile continued to contribute to cash flow but only marginally to revenue in the reporting period.

Generally, the provision of solutions in the cybersecurity segment requires only minor investments. In the BSS/OSS segment in particular, CAPEX investments are made for the proprietary platforms. The cash flow from investing activities therefore totaled EUR -0.5 million (2021: EUR -0.1 million). Hardware and software investments are made for the company's own platforms as required.

The cash inflow from financing activities decreased to EUR 4.3 million in the financial year (2021: EUR 16.5 million). Inflows were generated by the issue of shares through capital increases in kind and cash capital increases. Outflows resulted from the repayment of loans in particular; furthermore, the financing cash flow includes payments in connection with IFRS 16 Leasing.

In total, there was a cash outflow of EUR 3.1 million in the financial year (2021: cash inflow of EUR 5.8 million).

Economic developments at cyan AG

In contrast to the consolidated financial statements, the annual accounts of cyan AG are not prepared in accordance with the International Financial Reporting Standards (IFRS) as applicable in the European Union, but in accordance with the rules defined in the German Commercial Code [Handelsgesetzbuch (HGB)]. In addition, the regulations of the German Stock Corporation Act [Aktiengesetz (AktG)] were observed.

Course of business and economic environment

Within the Group, cyan AG acts as a holding company. cyan AG is a company headquartered in Munich. It is registered in the Commercial Register [Handelsregister] at the Munich District Court [Amtsgericht München] under HRB 232764. Strategic management of the corporation is based at the head office of the company in Munich. The majority of operational services are provided by the subsidiary I-New Unified Mobile Solutions GmbH and its subsidiaries, in particular cyan Security Group GmbH.

The key performance indicator for cyan AG in both the financial year and the previous year was the annual result. In addition, in the form of regular reports, the Executive Board monitors the cost structure of cyan AG as well as the operational performance of its affiliated companies (based on the indicators listed in the consolidated financial statements). Also, the most important balance sheet indicators, such as equity, outside capital and net debt, are observed at reporting dates.

Earnings, Asset and Financial Position of cyan AG

As a holding company, cyan AG does not generate any sales revenues itself. The development of results is determined, on the one hand, by the expenses incurred for legal and consulting services, administrative activities, and Executive Board compensation, and, on the other hand, by interest income from the financing of the operating activities of the subsidiaries and income from holdings. cyan AG handles all cash management and financing within the cyan Group on behalf of all of its subsidiaries. To service its debt properly and to finance integration and growth, cyan AG is dependent upon the inflow of funds from its operational subsidiaries or from other financing resources.

Earnings position

in EUR thousand	2022	2021
Other operating income / Gross result	1,211	15
Personnel expenses	-165	-885
Depreciation	-2	-3
Other operating expenses	-1,294	-1,726
Interest income	1,235	1,397
Interest expense	-10	-17
Taxes on income and earnings	-6	6
Net profit/-loss for the year	969	-1,213
Profit/loss carried forward	-181	0
Declared profit	788	-1,213

The operating gross profit amounted to EUR 1,211 thousand in the past financial year 2022 compared to EUR 15 thousand in the comparative period. The difference results from cyan AG's waiver of part of a recoverable receivable from a subsidiary and the dissolution of provisions for personnel and for audit/closing expenses totaling EUR 38 thousand. cyan AG acquired loans with a nominal value of EUR 21,313 thousand from the former shareholders when acquiring I-New Unified Mobile Solutions GmbH and recognized them in the amount of the acquisition costs of EUR 4,083 thousand. The waiver of receivables resulted in a reversal of impairment losses of EUR 888 thousand.

Salaries and social security expenses amounted to EUR 165 thousand (2021: EUR 886 thousand). The change results in particular from the Executive Board being reduced to two persons. In addition, an extraordinary social expense of EUR 260 thousand was recognized in the previous year. Other expenses decreased to EUR 1,294 thousand compared to EUR 1,726 thousand in 2021, mainly due to lower legal and consulting expenses. As in the previous year, depreciation amounted to EUR 2 thousand.

The financial result in the period under review amounted to EUR 1,226 thousand (2021: EUR 1,380 thousand) and comprises financial income of EUR 1,235 thousand (2021: EUR 1,397 thousand) and financial expenses of EUR 10 thousand (2021: EUR 17 thousand). The pre-tax result amounted to EUR 969 thousand (2021: EUR 1,213 thousand). Taxes on income and earnings totaled EUR 6 thousand (2021: tax income EUR 6 thousand).

In the financial year 2022, the net profit for the year, which is the primary performance indicator at cyan AG level, was EUR 969 thousand (2021: EUR 1,213 thousand). The balance sheet profit after offsetting against the loss from the previous year amounts to EUR 788 thousand (2021: EUR 181 thousand).

Due to the lack of positive operating cash flow in the Group (see consolidated cash flow statement), the Executive Board proposes to carry forward the profit to new account without dividend.

in EUR thousand	31/12/2022	31/12/2021
Immaterial assets	11	13
Tangible assets	0	0
Financial assets	78,256	69,956
Non-current assets	78,267	69,970
Receivables and other assets	19,721	18,311
Cash on hand, bank balances and checks	236	3,038
Current assets	19,957	21,349
Prepaid expenses	39	68
Assets	98,263	91,387

Asset and financial position

in EUR thousand	31/12/2022	31/12/2021
Subscribed capital	17,017	13,386
Capital reserve	79,538	73,634
Declared profit	788	-181.2
Equity	97,342	86,839
Provisions	281	667
Liabilities	640	3,881
Liabilities	921	4,548
Equity and liabilities	98,263	91,387

As of December 31, 2021, cyan AG had a significant investment in the form of I-New Unified Mobile Solutions GmbH, which is carried as an investment in the balance sheet in the amount of EUR 78,256 thousand (2021: EUR 69,956 thousand). The increase results from contributions and a value-retaining waiver of receivables owed by the subsidiary.

Cash and cash equivalents decreased from EUR 3,038 thousand in 2021 to EUR 236 thousand in 2022 due to the Group-wide cash management, as a result of which these funds were allocated to the Group companies.

As of December 31, 2021, cyan AG had total assets of EUR 98,263 thousand, compared to EUR 91,387 thousand at the end of the previous year. The equity amounted to EUR 97,342 thousand (2021: EUR 86,839 thousand).

When acquiring I-New Unified Mobile Solutions GmbH, cyan AG also acquired loans with a nominal value of EUR 21.3 million from the former shareholders and recognized them in the amount of the acquisition costs of EUR 4.1 million. As of December 31, 2021, the nominal value of the loan amounted to EUR 20.1 million and the book value to EUR 3.9 million.

Opportunities and risks

The business performance of cyan AG is closely linked to the performance of its subsidiaries and is therefore indirectly subject to the same opportunities and risks as the Group. The opportunities and risks are described in the report's section on the Group's Opportunities and Risks.

Forecast

cyan AG does not perform any operating activities of its own and is therefore dependent on the results of the Group companies. For cyan AG, the annual result excluding special effects for the financial year 2023 is expected to be at the level of the previous year.

Opportunities and risk report

Opportunity and risk management system

Entrepreneurial activity serves to increase the value of the company by making use of identified opportunities. As a group operating internationally, cyan is exposed to various external and internal developments and events. The opportunity and risk management system used, serves to optimize the relationship between risk and opportunity in the interests of sustained business success. In order to ensure this, suitable instruments are in place by the Executive Board which continually develops them further as needed.

The risk management of cyan concentrates on the early detection of risks with the aim of identifying all risks and opportunities that could or could not endanger the existence of the company, in order to derive appropriate strategic measures in good time. Risk management is conducted for the Group and for cyan AG in the same way, on a parallel basis. The internal control system (ICS) and the Information Security Management System constitute integral components of the risk management system used throughout the Group.

Group risk management

The Group-wide risk management system serves to identify relevant risks, their mitigation (e.g. training, insurance) and the resulting opportunities, so that these can be identified and harnessed within the Company and the Executive Board. The overarching risk principle is to safeguard the company's continued existence - no decision or action may give rise to a risk that could jeopardize the company's existence. Market developments in particular are monitored as part of the risk management process in order to derive appropriate decisions for the strategic management of the company in good time. The Executive Board regularly discusses new risks that have arisen and acts accordingly. cyan's risk management system is continuously developed and optimized.

The Supervisory Board is informed by the Executive Board in regular meetings about the economic development in the form of consolidated presentations, consisting of segment reporting, earnings development with budgetary and previous year figures, forecasts, consolidated financial statements, personnel and order development as well as selected other key financial figures. Likewise, the Supervisory Board is informed about risks.

Taking into account the potential damage and the probability of occurrence, individual risks are assessed in similar risk groups. The risks are assessed with proposed countermeasures and the effects of opportunities and risks are offset against each other. Residual risks are reassessed, and additional measures are taken.

Internal control system (ICS)

cyan has established an internal control system designed to ensure the correctness of processes relating to accounting. Key elements of the ICS are the institutionalized four-eyes principle, the separation of functions, and the monitoring and review of the effectiveness and efficiency of operating activities. Other important topics include the reliability of financial reporting and compliance with the legal requirements relevant to the company.

The scope and design of cyan's accounting-related ICS are at the discretion and responsibility of the Executive Board. The objective of the ICS with regard to the accounting process is to ensure, through the implementation of controls, reasonable assurance that, despite the identified risks, consolidated and separate financial statements can be prepared in compliance with the regulations. The ICS is designed to ensure that the annual financial statements are prepared in accordance with the relevant local regulations of the German Commercial Code and the German Stock Corporation Act, and that the consolidated financial statements are prepared in accordance with International Financial Reporting Standards (IFRS) as adopted by the European Union.

The organization of the accounting-related ICS has a uniform and centrally prescribed reporting structure based on local legal requirements in line with the Group's principles. The subsidiaries report periodically in accordance with IFRS as part of Group reporting. Newly established or acquired companies are integrated into this reporting process as quickly as possible. Internal controls of the subsidiaries' accounting are carried out, which in addition to the four-eyes principle include in particular IT-supported and random checks and plausibility tests.

Information security management system

cyan, as a European company, places high value on information and data security and therefore uses certified risk management systems in accordance with the internationally recognized ISO 27001 standard. The standard provides for a systematic examination of information security risks in the organization, taking into account threats, vulnerabilities and their impact. Based on this, a coherent and comprehensive set of information security controls and other forms of risk management procedures, such as risk avoidance or risk transfer, must be designed and implemented to address those risks. To do this, overarching management processes exist to ensure that information security controls continue to meet the organization's information security requirements. The ISO standard specifies, and an independent audit by auditors from TÜV Rheinland Cert GmbH certifies, the correct establishment, implementation, maintenance and continuous improvement of the documented information security management system. The certification is valid until 2024.

The certification process, which involves a two-stage audit, has been successfully completed in the fourth quarter.

Risks

Risks at cyan are grouped into five categories; an additional sixth category was previously used to summarize COVID-specific risks - this category is no longer included in the annual report, as it can be assumed that the effects are largely under control and will therefore not have any particular impact on business. These categories are based on the internal structure of the risk discussion, as also conducted in the meetings with the Executive Board and the responsible divisional managers.

Operational riks

The past few years have been overshadowed by the pandemic and supply chain risks, which required all processes to be adapted to the new conditions within a very short timeframe. This has now changed for the better, as the situation has stabilized and both partners and potential customers have adapted to the new normal.

Nevertheless, supply bottlenecks or capacity bottlenecks may still occur with certain suppliers. At the same time, macroeconomic uncertainties have increased. The situation was aggravated by Russia's attack on Ukraine, which led to an increase in inflation due to higher energy costs. As described in the section on general economic conditions, a complete shift in the economic environment is expected. cyan, as a technology company, is affected to some extent by the labor shortage as well as by hardware and energy inflation and is attempting to minimize cost increases.

In general, cyan's solutions are designed to operate with zero downtime. In both its Cybersecurity and BSS/OSS segments, cyan relies on its partners, including data center and network operators. For Cybersecurity, they act as integration and distribution partners; for MVNOs, they provide the core network all the way to the antenna. This means that cyan, or the MVNOs from whom cyan receives a fee per active customer (subscriber), is dependent on the functionality of the host network. Poor service, even for a short period of time, can affect end user satisfaction. In the event of a failure of the platform/software itself or of suppliers ( for example, data centers), this could lead to a shutdown of MVNO operations or to unprotected end customers, which in turn could trigger a reduction in the number of end customers and, if cyan is at fault, claims for damages. This risk has increased in the context of general geopolitical uncertainties. To prevent outages, cyan relies on multiple data centers, a highly skilled operations team and continuous monitoring of systems.

Attracting and retaining highly skilled employees is a key success factor for the entire technology and software industry. Key personnel, especially in cybersecurity research, development and operations, but also in the commercial function, with their knowledge, skills and contacts, are essential to the development, distribution and implementation of solutions. Unemployment rates have been declining around the world until recently - this shortage of talent can lead to extended vacancies and increased recruitment and retention costs. Enhanced marketing as a strategic goal of the Executive Board will not only improve the perception of cyan among direct customers, partners and end users, but will also facilitate the recruitment of personnel.

Competition risk

The market for cybersecurity is characterized by above-average growth that is forecast to remain robust. This makes new market entries relatively attractive for startups and established providers despite high entry barriers. cyan was able to position itself early with its technology for cybersecurity and continues to see itself in a "window of opportunity", driven by cyber incidents that have become public knowledge and at the same time the goal of telecom companies to grow through relevant value-added services. No direct competitor currently has solutions on the market that combine OnNet and OnDevice security in the form of an in-house solution. The current technological competitive edge is underlined by the leading international customer references.

Competition in the BSS/OSS business is much more pronounced. There are several competitors on the market for complete systems as well as individual components. Through targeted investments in research and development of products and growth in new markets, the Executive Board expects to be able to maintain the positioning of the various business units in the market.

Technological risk

In the fight against cybercrime and threats on the internet, cyan not only faces a continuous competition with other companies, but also a race against cybercriminals. Among others, cyan is developing highly complex, network-integrated cybersecurity solutions for the detection of potential threats such as phishing, malware or identity theft for the users of smartphones and tablets. By using machine learning and artificial intelligence in its threat analysis processes, cyan can respond to new threats in a timely manner. Nonetheless there is a risk of cyan failing to respond in time to technological progress or to changing requirements in relation to cybersecurity products and services, or to changes in the entire cybersecurity market. Risks are also reduced through active research and development.

On the one hand, significant changes in the MVNO market environment can have negative implications for cyan in the BSS/OSS segmen. Software products can become obsolescent or even obsolete as the result of amendments to existing standards, or to the appearance of new ones. On the other hand, software can develop faults and have vulnerabilities. For its own development and in its own products, cyan also uses third-party and open-source software components (e.g. libraries). Despite thorough checks, these can harbor a residual level of risk in relation to compatibility and security. In order not to fall behind technologically and to maintain the market position, further developments and optimizations of the products are constantly carried out, as well as investments in research and development. In addition, an extensive information security management system has been established that monitors the risks, above all in relation to data processing

Reputation and brand risk

cyan's direct customers are mostly large international corporations who entrust cyan with the security of data traffic and their end customers as well as the platform operation of the MVNO. Professional implementation and ongoing operation are important criteria by which technology companies like cyan are measured. With the launch of solution at several internationally renowed customers such as Orange, T-Mobile, and dtac, an important effort has been achieved to build cyan's strong reputation. The cybersecurity solutions are offered "white-labeled", it is therefore crucial to ensure the best possible protection of the end customers' mobile devices, as reputational damage of the partner to the end customers will ultimately reflect on cyan. Equally significant is the medium and long-term marketing success. Reputational damage due to a (partial) failure is likewise possible in the BSS/OSS segment.

Increased marketing - of the now independent cyan digital security and i-new brands - will further highlight the strengths of the solutions to direct partners and potential customers, thereby supporting sales. Subsequently, increased awareness among end users should also increase penetration rates among existing customers. This results in a risk from the strategic alignment of the measures.

Financial risks

The main financial risks are the cluster and customer default risk, the liquidity risk, the interest rate risk, and the foreign exchange risk. Further information on financial risks can be found in the Notes to the Consolidated Financial Statements.

Counterparty and credit risk

The Executive Board is striving to reduce the concentration of customer revenues, in particular by concluding contracts with new customers from other regions, and to place revenues on a broader basis. In both the Cybersecurity and the BSS/OSS segments, additional customers were acquired. As already addressed in the section on goals and strategy, recurring revenue will be an important metric for managing the Group in the future.

The current economic situation increases the risk of insolvency of one or more customers. Effective credit monitoring systems are in place. The risk of bad debts on the customer side, in particular of a large bad debt, is reduced due to the increasingly diversified portfolio.

Liquidity risk

To determine its liquidity needs, cyan operates a rolling financial and liquidity planning scheme. Attention is paid to ensuring that sufficient liquid assets are always available to settle any liabilities that fall due in the companies. The available liquid funds amounted to EUR 5.3 million as of December 31, 2022 and are maintained with banks that have a very high credit rating.

Liquidity at cyan is largely dependent on payments from customers and funds provided by external investors. By winning new customers, cyan expects to improve its liquidity, although cyan is dependent on marketing by its partners. Nevertheless, there could be project delays, for example, as a result of which individual projects generate revenue only after a delay and, thus, generate a later cash flow, or there could be outright defaults by existing customers. In order to implement strategic projects or in the event of adverse economic conditions, the company may have to borrow money on the capital market or from financial institutions in the medium term.

Interest rate risk

The interest rate risk exposure as of December 31, 2022, does not directly affect the financial result due to the fact that cyan only has fixed-interest financial liabilities outstanding as of the reporting date. However, current changes in the interest rate landscape may be reflected in future financing.

Currency risk

cyan is exposed to certain currency risks due to its underlying international business. In the financial year 2022, cyan recognized positive foreign currency effects in the income statment in the amount of EUR 2.7 million and negative effects in the amount of EUR 1.9 million. The Company's finance department constantly monitors these risks and in particular the foreign currency rates in order to be able to react appropriately. Efforts are made to conclude contracts in stable international currencies and to hold more volatile currencies only to the extent necessary. Where expenses and investments are not denominated in euros, exchange rate fluctuations may nevertheless affect the financial position of Group companies and have a negative impact on the Group's results and earnings. In particular, the valuation of assets in US dollars has an impact on earnings.

Opportunities

In addition to the aforementioned risks, there are a large number of opportunities that represent key drivers for growth and further development at cyan. The opportunities are aggregated into four categories: technological change, expansion into new markets, increasing awareness, and new sales strategies. For details on the underlying market drivers in this context, reference is made to the description of industryspecific developments.

Opportunities due to technological changes

In an ever more connected world, the ability to use the internet safely plays an important role. Mobile devices, especially smartphones, play a particularly important role in this context. They have long since ceased to be used exclusively for sending text messages and voice telephony but have developed into an access key to an endless range of digital services. The improving network coverage, at minimum with 4G, and the widespread availability of internet-capable devices contributes to further growth in potential end users. At the same time, network operators are continuing to invest in expansion of 5G infrastructure, the advantage of which lies in high speeds and low latency levels. Together with the rise in encryption of traffic, this makes Deep Packet Inspection (DPI) more difficult, causing the focus to move onto DNS filter technology. Furthermore, cyan has demonstrated another important technological competence with the cloud-based deployment of the cybersecurity solution and is thus also ready for the massive trend towards cloud solutions that can be observed in the industry.

It is expected that not only the number of smartphones will increase, but also the number of other internet-connected devices, Internet-of-Things (IoT). This leads to further fragmentation of the system landscape because there is usually no uniform hardware and software and numerous devices, especially smaller ones, do not have the computing power to run complex endpoint solutions directly yet. Nevertheless, many smart TVs, smartwatches, home automation devices, and even vehicles (connected mobility) are constantly connected to each other and to the internet. Network-integrated solutions can also protect users in this area. The end user expects a seamless user interface while at the same time being able to customize the solution to suit his or her personal needs.

Opportunities presented by new markets

In the last few years, cyan has already been able to reach new markets by expanding the product, gaining customers in additional countries and addressing additional end customer segments. The repositioning of the brands offers additional significant potential.

cyan is constantly working on new solutions to provide end customers with the best possible protection. Not least by further developing the Seamless Security platform to include an OnNet solution for PCs in the fixed-line Internet, app-based solutions (for example, cyan's SDK) and the convergent solution based on DNS-over-VPN, which will enable a broader range of accessible partners and also further upselling to existing customers.

cyan's cybersecurity is based on DNS a fundamental technology for the Internet and the BSS/OSS platform uses international standard interfaces and environments, making both solutions universally deployable internationally. The increased global presence of cyan and its partners opens up new geographies and additional sales opportunities. In the MVNO/BSS/OSS market, further opportunities arise from special use cases in which lightweight digital solutions are required. Some countries, especially those without active MVNOs, offer significant potential.

Opportunities due to increasing awareness

In recent years, the consequences of increasing digitization, such as data protection and cybersecurity, have increasingly become the focus of public attention. The European Union established a first milestone with its General Data Protection Regulation that entered into force in 2018. Since then, numerous prominent IT security incidents have become known, the security of foreign telecom equipment has been highlighted in the media, and the population has experienced an unprecedented wave of digitalization triggered by global home-office orders. As a consequence, security on the Internet for the general public at large as well as for national governments, including the European Union, has become an important topic. Awareness among the public is also prompting companies to invest more into cybersecurity. In view of the comparatively stringent European regulatory structure, European providers are viewed as trustworthy on the international stage. For cyan, this is an opportunity to benefit from the momentum this provides.

On the MVNO market, there are two drivers related to awareness: regulation due to consolidation and deregulation due to liberalization. Regulation of telecommunications markets is due to consolidation, especially for mobile and internet providers. Competition authorities are becoming active in this regard, especially in developed markets, to increase competition by obliging existing providers to offer wholesale agreements on certain terms for MVNOs. In emerging regions, on the other hand, market liberalization of protected telecom infrastructure and the opening to external investors is creating significant opportunities for innovative business models and for MVNOs.

Opportunities from new distribution strategies

An important element of the strategy is a modified, more sustainable sales strategy, which on the one hand involves sales partners more closely and provides for active support in the go-to-market area as well as in end-customer sales. The aim is to pursue leads in a more focused manner, thereby enabling better partnership support from the outset. On the other hand, projects and features are implemented in stages at the customer site. A staged release in phases makes it possible to generate initial revenues earlier and at the same time provide the end customer with regular feature updates to encourage an upsell. Combined, the aim is to improve end-customer adoption by actively supporting partners in go-to-market and commercialization activities from day one. This strategy has already been implemented in the past year and showed that there are significant opportunities through earlier monetization by accelerating the process and more successful marketing of the solution.

Further potential is also to be realized with the help of the new, separate branding of the business units. The separation of the uses the separate brand values to facilitate cross-selling and enables additional opportunities in targeting. The altered communication of the brands is intended to better address the corresponding target groups.

Opportunities and risks profile

As a growth company, cyan operates in a continuously evolving technology industry that is characterized by disruptive innovations. This gives rise to risks and opportunities that are influenced by various factors. In the opinion of the Executive Board, the risk management system used at cyan is suitable for identifying, analyzing and quantifying the existing risks in order to manage them effectively. The Executive Board is committed to making the best possible use of opportunities, and to reducing risks as far as reasonably possible. Future developments are subject to considerable uncertainty, in particular due to macroeconomic instability. Changes in external and internal factors are therefore analyzed regularly and opportunistic measures are taken as required.

Based on the multi-year overall planning for the Group, which is based on the longterm assumption of an increase in revenues, in particular through additional new and existing customer business, there are no risks that could jeopardize the continued existence of cyan. The Executive Board considers the risks described to be manageable and sees very good opportunities for cyan to grow in the future.

Subsequent events

Operational progress

In the first months of the fiscal year, further progress was made with customers in both business segments. In February, the expansion of the cooperation with MTEL in all three countries, Austria, Switzerland and Germany, to include the cybersecurity segment was announced. The strategic goal of cross-selling between the business units with a European MVNO has thus been achieved. In addition, the cooperation within the Orange Group was extended to other countries.

Capital increase in kind

On February 8, 2023, cyan AG with the approval of the Supervisory Board of the Company entered into an agreement with two creditors of the Company, according to which their joint receivables in the amount of EUR 3,045,804.96 will be contributed to the Company in the context of a capital increase against contributions in kind in return for the granting of 934,296 shares to each of the two creditors. The Company therefore resolved to increase the nominal capital from EUR 17,016,800.00 by EUR 1,868,592.00 to EUR 18,885,392.00 by issuing 1,868,592 shares at an issue price of EUR 1.63 against a contribution in kind. The subscription rights of the shareholders were excluded. The capital increase against contributions in kind was entered in the commercial register on April 4, 2023.

Supervisory Board and Executive Board

cyan AG announced at the beginning of April that Markus Messerer has been appointed to the Supervisory Board of cyan AG. He replaces Alexandra Reich, who is leaving the Supervisory Board of cyan AG for personal reasons. The appointment was made by the Munich Local Court on March 31, 2023. In addition, Frank von Seth, Chairman of the Board of Directors and CEO, announced that he does not intend to extend his contract as a member of the Management Board. His contract will therefore expire at the end of the year.

Forecast report

Macroeconomic forecasts point to a significant slowdown in growth with significant inflationary pressures. The investment situation of cyan's partners, especially in the telecommunications sector, is linked to macroeconomic developments in many areas. However, cybersecurity remains an important social, political and economic issue and is therefore growing at an above-average rate, independent of the general economic trend. With interest rates and prices under pressure, modern solutions to increase revenues and margins are becoming ever more important. As a result, telecom providers need agile and cost-effective platforms with innovative ways to retain customers. In addition, the return of mobility - but also greater cost awareness - is expected to strengthen the market for prepaid telecom services.

The forecast takes into account volatile external factors offset by solid internal developments. The growth base has been further broadened with a new record number of active partners. Developments in the first three months of the fiscal year 2023 showed continued strong growth with existing customers, and the pipeline of potential new customers in both segments developed positively, also thanks to recent launches and customer wins in the Cybersecurity and BSS/OSS segments. Together with the recent launches and upcoming deployments, the number of end customers will increase significantly.

The growth in subscriptions, and thus in annual recurring revenue (ARR), should be more clearly reflected in the business figures already this year. In addition, project revenues from ongoing implementations are expected. For the fiscal year 2023, the Executive Board therefore expects an increase in operating revenues of approximately EUR 10.5 million to EUR 13.5 million. It should be noted that part of the growth will come from non-recurring project revenues, the amount of which will depend on external factors, in particular regulatory approvals and thus the timing of project start.

The Performance Improvement Program was completed last year, significantly reducing the cost base. In view of the economic forecasts, in particular further inflation of all input factors from labor to hardware and software, the Executive Board is committed to minimizing the negative impact on the successes achieved. Together with the increase in sales, the Executive Board expects an improvement in the operating margin (EBITDA) before special items at Group level in 2023.

Munich, in April 2023

The Executive Board

H2 Headline Zweite Zeile Consolidated Financial Statements

Statement of comprehensive income

Statment of profit and loss

in EUR thousand	Notes	2022	2021
Revenues	1	8,537	8,483
Other operating income	2	4,168	3,030
Income from reversals of impairment losses	2	8	111
Change in inventories and capitalized own work	2	-335	-798
Costs of materials and services	3	-4,977	-5,372
Personnel expenses	4	-9,292	-11,435
Value adjustments	5	-314	-437
Other expenses	6	-6,190	-5,901
EBITDA		-8,396	-12,320
Depreciation and amortization	7	-5,626	-5,742
Operating result (EBIT)		-14,022	-18,062
Financial income	8	653	727
Financial expenses	8	-124	-163
Loss from net position of monetary items	8	-8	-
Earnings before taxes		-13,500	-17,497
Taxes on income and earnings	9	-3,000	3,620
Result after taxes		-16,500	-13,877

Other comprehensice income (OCI)

Notes	2022	2021
		191
	-16,525	-13,687
		-26

^a Recycleable. 2021: Reclassification compared with consolidated financial statements Dec. 31, 2021.

^b The entire results are attributable to the shareholders of the company

Earnings per share

in EUR per share	Notes	2022	2021
Undiluted earnings per share		-1.11	-1.30
Diluted earnings per share		-1.11	-1.22

Consolidated statement of financial position

Assets

in EUR thousand	Notes	31/12/2022	31/12/2021
Intangible assets		50,264	54,453
Patents, trademark rights, customer
relationships and similar rights	10	9,823	11,405
Software	10	8,879	11,432
Development costs	10	783	837
Goodwill	10	30,779	30,779
Tangible assets		3,332	4,943
Land and buildings	11	2,664	4,432
Machines and other equipment	11	468	117
Business and office equipment	11	201	394
Other receivables	14, 15	23	33
Financial receivables	14, 15	118	300
Contract costs	12	3,908	4,255
Contract assets	12	10,726	13,274
Deferred tax assets	13	558	733
Non-current assets		68,928	77,992
Trade receivables and other receivablesa	14, 15	2,881	2,496
Contract assetsa	12	4,208	3,803
Inventories		40	353
Tax receivables	15	342	214
Other receivables and assetsa	14, 15	2,067	2,110
Financial receivables	14, 15	186	272
Cash and cash equivalents	16	5,349	8,504
Current assets		15,073	17,753
Total assets		84,001	95,745

^a Reclassification compared with consolidated financial statements Dec. 31, 2021

Equity and liabilites

in EUR thousand	Notes	31/12/2022	31/12/2021
Share capital	17	17,017	13,386
Reserves		48,782	59,393
Capital reserves		84,358	78,455
Other reserves		99	113
Reserves according to IAS 19		-1	-1
Profit / loss carried forward		-35,674	-19,174
Equity		65,799	72,779
Provisions	20	11	7
Leasing liabilities	14, 18	2,091	3,832
Other financial liabilities	14, 18	3,705	5,199
Other non-current liabilities	14, 19	207	206
Deferred tax liabilities	13	5,855	3,139
Non-current liabilities		11,869	12,384
Trade payables and other liabilitiesa	14, 19	4,331	5,224
Provisionsa	20	21	317
Financial liabilities	14, 18	2	15
Leasing liabilities	14, 18	861	1,207
Convertible notes	14, 18	-	2,450
Tax liabilities		1,117	1,370
Current liabilities		6,332	10,582
Total liabilities		18,201	22,966
Total equity and liabilities		84,001	95,745

^a Reclassification compared with consolidated financial statements Dec. 31, 2021

Consolidated statement of cash flows

in EUR thousand	Notes	2022	2021
Result before tax from continuing operations		-13,500	-17,497
Earnings before tax		-13,500	-17,497
Profit/loss from the decrease in assets		217	0
Depreciation of intangible and tangible assets		5,626	5,742
Change in provisions		-291	-85
Financial income		-653	-727
Financial expenses		124	163
Other expenses/income with no influence on liquid funds		-1,333	-2,024
Adjustments to reconcile profit before tax to net cash flows		-9,810	-14,428
Change in inventories		313	-343
Change in contract assets and contract costs		4,404	4,312
Change in receivables trade receivables and other receivables		-332	-302
Change in trade payables and other liabilities		-1,409	165
Working capital adjustments		2,976	3,832
Net cash flow from earnings before taxes		-6,834	-10,596
Income taxes paid		29	33
Cash flow from operating activities	17	-6,805	-10,563
Purchases of intangible and tangible assets		-849	-325
Purchase of financial assets		282	274
Disposal of tangible and intangible assets		9	1
Interest received		6	0
Cash flow from investing activities	18	-552	-51
Proceeds from the issue of share capital		9,534	13,797
Proceeds from loans and borrowings		138	1,558
Proceeds from the issue of convertible notes		-	2,450
Repayments of financial liabilities		-1,645	-1
Repayments of participation rights		-2,450	-
Repayments of leasing liabilities		-1,249	-1,251
Interest paid		-69	-94
Cash flow from financing activities	19	4,260	16,460
Change in cash and cash equivalents		-3,098	5,847
Cash and cash equivalents at the beginning of the fiscal year		8,504	2,490
Cash and cash equivalents at the end of the period		5,349	8,504
thereof effect of exchange rate differences on cash and cash
equivalents received in foreign currency		-57	167

^a Reclassification compared with consolidated financial statements Dec. 31, 2021

Consolidated statement of changes in equity

in EUR thousand	Nominal capital	Capital reserves	Currency reserve	Reserves according to IAS 19	Profit / loss carried forward	Total
01/01/2021	9,775	68,269	-66	-1	-5,297	72,680
Net loss /profit for the year					-13,877	-13,877
Changes in the scope of consolidation						-
Miscellaneous result after taxation			179	-		179
Total result for the financial year	-	-	179	-	-13,877	-13,698
Capital increase	3,611	10,186				13,797
31/12/2021	13,386	78,455	113	-1	-19,174	72,779
Net loss /profit for the year					-16,500	-16,500
Changes in the scope of consolidation						-
Miscellaneous result after taxation			-14	0		-14
Total result for the financial year	-	-	-14	0	-16,500	-16,514
Capital increase	3,631	5,903				9,534
31/12/2022	17,017	84,358	99	-1	-35,674	65,799

H2 Headline Zweite Zeile Notes to the Consolidated Financial Statements

Information about the Company

cyan AG, headquartered in Munich (Theatinerstraße 11, 80333 Munich, Germany), is a stock corporation registered in the Commercial Register B of the Munich Local Court under HRB 232764. cyan AG has been listed on the Frankfurt Stock Exchange in the Scale Segment of the Open Market since March 2018. cyan AG acts as a holding company within the Group. Operational services are provided by the Austrian subsidiary I-New Unified Mobile Solutions GmbH (formerly I-New Unified Mobile Solutions AG) and its subsidiaries, in particular cyan Security Group GmbH. I-New Unified Mobile Solutions GmbH operates as a Mobile Virtual Network Enabler (MVNE). cyan Security Group GmbH offers cybersecurity solutions for end customers of mobile network operators (MNOs), mobile virtual network operators (MVNOs), and financial service providers.

Accounting principles

The following section presents the main accounting and valuation methods used for these consolidated financial statements. These principles – unless otherwise indicated – were used for all of the years presented.

The consolidated financial statements comprise the Consolidated Statement of Comprehensive Income, the Consolidated Statement of Financial Position, the Consolidated Statement of Cash Flows, the Consolidated Statement of Changes in Equity and the Notes to the Consolidated Financial Statements.

The Executive Board of cyan AG has approved the consolidated financial statements and their submission to the Supervisory Board on April 24, 2023.

Basis of preparation

The consolidated financial statements for the fiscal year ended December 31, 2021 were prepared on a voluntary basis exercising the option defined in Section 315e German Commercial Code (HGB) in accordance with the International Financial Reporting Standards (IFRS) applicable on the reporting date, as applied in the EU. The designation IFRS comprises the International Accounting Standards (IAS) which remain valid, the International Financial Reporting Standards (IFRS) as well as interpretations of the Standing Interpretations Committee (SIC) and the International Financial Reporting Interpretations Committee (IFRIC). The valuation was based on the assumption that the corporate group will continue as a going concern.

The layout of the statement of comprehensive income is based on the total cost method. Individual items in the statement of comprehensive income and the balance sheet are grouped together for ease of understanding or due to their lack of material significance. In accordance with IAS 1, capital assets and liabilities are classified on the basis of maturity. These items are classified as current if they fall due within one year. Otherwise, they are classified as non-current.

The Accounting and Valuation Methods were applied consistently to the consolidated financial statements and to figures from the previous year.

Going concern

At the date of approval of the financial statements, management has a reasonable expectation that the Group has adequate resources to continue as a going concern for the foreseeable future. Therefore, the consolidated financial statements continue to be prepared on a going concern basis.

Effects of external factors (COVID-19, geopolitics)

As described in the management report, the Covid-19 crisis was followed by a global wave of inflation. In this context, an assessment was made as to whether there was an indication of an impairment of assets in accordance with IFRS 9. Based on the assumption that the opportunities in the growth market remain as described in the Opportunities and risks report, the expected loss rates were not adjusted.

Any impact has also been taken into account as part of the business planning and in the impairment analysis (IAS 36). The weighted average cost of capital (WACC) was determined using current market values. The analysis showed that the values in use of the assets continue to be higher than the carrying amounts and therefore no impairment was required.

Functional currency

The consolidated financial statements of cyan AG are prepared in thousand Euro. The use of automatic calculation aids may result in rounding differences when adding up rounded amounts.

The management takes the view that the consolidated financial statements include all adjustments required to give a true and fair view of cyan's assets, financial and earnings positions.

The financial statements of subsidiaries whose functional currency is other than the Euro are translated in accordance with the functional currency principle. Balance sheet items are translated at the closing rate. Income and expense items are translated at the average exchange rate for the year. Resulting translation differences are recognized in other comprehensive income (OCI) and presented in the currency translation reserve in equity until the disposal of the subsidiary.

Currency translation differences arising from exchange rate fluctuations between the recognition of the transaction and its cash effect or measurement at the balance sheet date are recognized in profit or loss and reported in the operating result.

The following table shows the foreign exchange rates of those foreign currencies in which cyan AG and its subsidiaries transacts their business:

	Average rate		Closing rate
	2022	2021	31/12/2022	31/12/2021
Argentine Peso (ARS)	139.827	112.744	189.587	116.130
Bangladeshi Taka (BDT)	98.347	100.439	108.940	97.383
Brazilian Real (BRL)	5.559	-	5.559	-
Chilean Peso (CLP)	916.019	903.213	916.910	964.440
Colombian Peso (COP)	4,486.735	4,460.464	5,130.559	4,509.062
Mexican Peso (MXN)	21.205	23.990	20.761	23.616
Peruvian Sol (PEN)	4.107	4.678	4.115	4.595
Thai Baht (THB)	36.952	-	36.817	-
Hungarian Forint (HUF)	390.944	358.463	407.680	367.500
US Dollar (USD)	1.054	1.184	1.059	1.130

As cyan Security Argentina SRL is located in a hyperinflationary economy, IAS 29 is applicable. Due to the immateriality of the amounts, no further disclosure is required.

Estimates and assumptions

The preparation of the consolidated financial statements requires estimates and assumptions that affect the figures reported in the consolidated financial statements. The actual results may diverge from these estimates. The estimates and their underlying assumptions are subject to continuous review. Amendments of balance sheet estimates are recorded in the period in which the estimate was changed, and in all later periods of time. IFRS-based valuations performed by the management that have a substantial impact on the consolidated financial statements and estimates that carry a substantial risk of a major adjustment in the following year are explained in the respective items.

Impairment of assets

The assessment of recoverability of intangible assets, goodwill, and property, plant and equipment, is based on assumptions for the future. The assumptions employed for the impairment tests of goodwill are explained in the notes to the consolidated statement of financial position in section 10, Intangible Assets. The determination of the useful life of assets involves estimates.

Receivables

Impairments of receivables are accounted for on the basis of assumptions about the probability of default in accordance with the model of expected credit losses.

Other povisions

Other provisions are set up in response to current liabilities resulting from events in the past that give rise to an outflow of resources with an economic benefit, employing a figure that most probably reflects that value, based on reliable estimates. Details of provisions can be found in the explanations to the consolidated statement of financial position in section 20, Provisions.

Taxes on income

The application and subsequent valuation of actual as well as deferred taxes are subject to uncertainties arising from complex taxation legislation in the different national jurisdictions, and that are also subject to regular amendments. Furthermore, the valuation of losses carried forward is contingent upon future results. Management assumes that it has come to a reasonable estimate of the uncertainties surrounding taxation and of future results. However, due to the existing uncertainties surrounding taxation and in relation to the estimation of future results, there is a risk of variances arising between actual results and the assumptions made in relation to the impact of these on the tax liabilities and deferred taxes. The following sections on the taxation of income explain tax-related details in greater depth.

Revenue from contracts with customers

The assessment of contracts with customers by the criteria of IFRS 15 is based on the estimates and assumptions in relation to the identification of separate performancerelated obligations within a contract and the distribution of the transaction price to these in accordance with their individual selling prices. More detailed explanations are provided in the Accounting and Valuation Methods under "Revenue from Contracts with Customers".

Leasing

Substantial estimates as lessee and lessor were required for the calculation of rightsof-use and their associated leasing liabilities and receivables respectively. These are explained in greater detail in the part on leasing of the Accounting and Valuation Methods section.

Scope of consolidation and consolidation method

The scope of consolidation is determined in accordance with the provisions of IFRS. In addition to the financial statements of cyan AG, the consolidated financial statements also include the financial statements of the companies controlled by cyan AG (and its subsidiaries).

Subsidiaries are companies that are controlled by cyan AG. Control exists when cyan AG is able to exercise control over these associated entities, is exposed to variable returns from its involvement with those entities and has the ability to affect the amount of those returns through its control over those entities. The financial statements of subsidiaries are included in the consolidated financial statements from the date cyan AG obtains control over the subsidiary until the date cyan AG ceases to have control.

The consolidated financial statements were produced on the premise that cyan AG is the parent company of cyan. The consolidated financial statements include all companies under the controlling influence ("control") of the parent company by way of full consolidation.

The scope of consolidation as of December 31, 2022 is as follows:

Company	Registered office	Share	Fully consolidated since
cyan AG	Germany
CYAN Licencing GmbH	Austria	100%	01/01/2018
cyan Seamless Solution Mèxico, S.A. de C.V.
(fmr. I-New Unified Mobile Solutions, S.A. de C.V.)	Mexico	100%	31/07/2018
cyan digital security (Thailand) Ltd.a	Thailand	100%	30/11/2022
cyan Security Argentina SRLb	Argentina	100%	30/06/2021
cyan security Brasil Ltdab	Brazil	100%	31/12/2022
cyan security Chile S.p.A	Chile	100%	31/07/2018
cyan security Colombia S.A.S.	Colombia	100%	31/07/2018
cyan security Ecuador SAS	Ecuador	100%	31/12/2020
cyan Security Group GmbH	Austria	100%	31/01/2018
cyan security Peru S.A.C.	Peru	100%	31/07/2018
cyan security USA, Inc.	USA	100%	31/07/2018
I-New Bangladesh Ltd.	Bangladesh	100%	31/07/2018
I-New Hungary Kft.	Austria	100%	31/07/2018
I-New Unified Mobile Solutions GmbH	Austria	100%	31/07/2018
smartspace GmbH	Hungary	100%	31/07/2018

^a In 2021 Cyan Security Argentina SRL was founded. This company is in liquidation as of December 31, 2022.

^b In 2022, cyan digital security (Thailand) Ltd. and cyan security Brasil Ltda were founded.

The following table shows the changes in the scope of consolidation:

	Full consolidation		At-equity
	31/12/2022	31/12/2021	31/12/2022	31/12/2021
Balance at the beginning of the
reporting period	14	13	0	0
Included for the first time	2	1	0	0
Deconsolidated	0	0	0	0
Balance at the end of the reporting
period	14	13	0	0

Newly applicable and amended accounting standards

For the first time, application of the following amended standards is mandatory:

Standard	Content	Effective
Various	Improvements to IFRS, 2018-2020 cycle	01/01/2022
IFRS 3	Amendments to references to the framework in IFRSs	01/01/2022
	Property, plant and equipment: Income before reaching the
IAS 16	ready-for-use state	01/01/2022
IAS 37	Provisions, contingent liabilities and contingent receivables:
	Scope of performance costs for onerous contracts	01/01/2022

The amendments had no material effect on cyan's net assets, financial position and results of operations.

The following amendments or new versions of standards and interpretations are not yet mandatory or applicable or have not yet been adopted by the EU:

Standard	Content	Effective
IFRS 17	Insurance Contracts	01/01/2023
IAS 1	Amendments relating to the disclosure of accounting policies	01/01/2023
IAS 8	Accounting estimates - changes	01/01/2023
	Changes relating to deferred taxes on leases and
IAS 12	decommissioning obligations	01/01/2023
	Amendments to clarify the subsequent measurement of sale
IFRS 16	and leaseback transactions by a seller-lessee	01/01/2024
	Amendments relating to the classification of liabilities and
IAS 1	ancillary conditions	01/01/2024
	Amendments relating to the sale or contribution of assets
IAS 28 /	between an investor and an associated company or joint
IFRS 10	venture	postponed

The standards listed – if adopted by the EU – will not be applied early. From today's perspective, the amendments and new versions of the standards and interpretations are not expected to have a material impact on cyan's assets, financial and earnings positions.

Accounting and valuation methods

Revenues from contracts with customers

cyan has applied IFRS 15 Revenues from Contracts with Customers. According to IFRS 15, the time when the transfer of title to goods and services takes place, and the point where the customer can make use of them, is decisive in relation to the time when revenue is generated. To this end, cyan has applied the 5-step model for quantifying the extent and timing of the revenue recognition:

• Identification of the contract
• Identification of performance-related obligations
• Determination of the transaction price
• Distribution of the transaction price across the performance-related obligations
• Recognize revenue either over time or at point of time

In its customer contracts, cyan has identified the following performance-related obligations: Granting of Licenses, Technical Support and Maintenance as well as updates.

Granting of licenses

In the process of selling licenses by cyan, the customer acquires the right to use intellectual property and thus revenue is recognized when the license is sold. Critical to the timing of this is the point from which the customer is able to use the license and therefore to derive benefit from it. One example of this involves the licenses for using the cybersecurity software developed by cyan. Another involves the licenses for using the BSS/OSS software solution developed by i new.

Technical support and maintenance

During the term of the contract, further services are to be delivered, for example in the form of technical support and maintenance. In this case it is assumed that an obligation to provide such services exists in accordance with IFRS 15.26 e) and therefore revenue is recognized over the specified period of time.

In the context of technical support for the BSS/OSS solution, provision of as well as support and maintenance for the technical platform, used for connection to the MNO, is included. The services delivered in the BSS/OSS segment are not hosting services because these do not become the property of customers when they use the solution transferred to them but can instead also be used at the same time by other customers.

Updates

Irregular updates occur with the BSS/OSS software solution. However, unrestricted use can still be made of the software solution originally provided, even without updates.

For customer contracts in the cybersecurity segment, ongoing updates of databases may be provided. These are fully automated and involve the use of self-learning algorithms. The original version of the software provided, installed on customer systems, remains functionally capable and can still be used effectively, even without updates, to provide end customers with a corresponding level of cybersecurity. While updates can improve quality and topicality, neither of these is critical in terms of software functionality because these updates only relate to part of the functional scope and are not essential for the ability of customers to use the software and/or the licenses. Therefore, these updates are also based upon the premise of an obligation to provide said services in accordance with IFRS 15.26 e) and therefore on the recognition of revenue over a specific period of time.

Revenues are recognized at the transaction price. The transaction price is the consideration in exchange for the anticipated level of performance delivered. Anticipated discounts and cash discounts as well as amounts obtained on behalf of third parties (sales tax) are deducted from this. If the service and the payment take place within a one-year period, no adjustment needs to be made in terms of applying any interest charges.

The transaction prices should be regarded as fixed, particularly with regard to the point in time at which revenue is recognized (sales quantity x unit price). In relation to contracts that include longer payment terms, it is assumed that a significant financing component exists for those revenues that are allocated to services that are already provided at the beginning of the contract. The transaction price assigned to this service is therefore discounted and then an interest component is added to it.

The over-time recognition of revenue is based on the elapsed contractual term as a proportion of the full term of the contract in question. The management has reached the considered view that the proportion of time that has elapsed at closing date in relation to the total time anticipated for delivery of a service represents a reasonable measure for the level of completion of these performance obligations as defined in IFRS 15.

The usual target payment term for cyan is 30 days.

Agreements to take back purchases are only included on a 'best effort' basis and therefore have no impact on the allocation of the transaction price or the recognition of revenue.

In cases where a service is delivered before consideration is received, contract assets are capitalized. Trade receivables are disclosed if there is a direct entitlement to receive payment.

Wherever additional costs are incurred when concluding a contract and where its associated sales revenues are generated over a one-year period, these costs must be recognized as assets and then written down progressively as actual sales revenues are generated.

Taxes on income

Income tax expenses (or tax income) for the period is the amount of tax payable on the taxable income of the current period based on the applicable rate of tax on earnings (reconciled to include changes in deferred taxation claims and liabilities arising from temporary variances and, where applicable, any unused tax losses).

Deferred taxes on income (expenses or income) result from temporary variances between the book value of an asset or a debt on the balance sheet and its tax value. In accordance with IAS 12 (taxes on earnings), the deferred tax assets and deferred taxes reflect all temporary valuation and balance sheet variances between the tax balance sheet and the IFRS final accounts. Moreover, deferred taxes are formed on the basis of tax losses carried forward.

At cyan AG, the trade tax loss carried forward amounts to approximately EUR 7.1 million (2021: EUR 8.1 million) and a corporation income tax loss carried forward amounts to roughly EUR 7.1 million (2021: EUR 8.1 million). In future, since it will be improbable to carry forward unused losses, no provision is being set up for deferred taxation.

In relation to the consolidated tax-sharing agreement of December 18, 2014, cyan Security Group GmbH as group leader forms a tax corporation with cyan Networks Software GmbH in accordance with Section 9 of the Austrian Corporate Income Tax Code (öKStG). Subsequently, this fiscal group of companies has been extended to include several group members. The core concept for Austrian taxation of the group involves grouping together the tax results of financially affiliated entities with the group leader. All companies that belong to the group calculate their respective revenues separately. The resultant taxation charge is then charged to the group leader (standalone method) in the form of distributions of the tax burden. The results of all companies are unified with the group leader and taxation is levied accordingly.

With a contribution and contribution in kind contract dated Jul 5, 2019, cyan AG has contributed its entire holding in cyan Security Group GmbH to its subsidiary I New Unified Mobile Solutions GmbH as an investment in kind. As a result of restructuring, the existing group was dissolved and a new group was set up, with I-New Unified Mobile Solutions GmbH as group leader and with cyan Security Group GmbH, CYAN Mobile Security GmbH, cyan Networks Software GmbH, CYAN International Solutions GmbH, CYAN Licencing GmbH, and smartspace GmbH as group members.

Since in 2020 a retroactive merger was agreed, whereby cyan Mobile Security Group GmbH, cyan Networks Software GmbH, and CYAN International GmbH merged with cyan Security Group GmbH, currently only I-New Unified Mobile Solutions GmbH, cyan Security Group GmbH, CYAN Licencing GmbH, and smartspace GmbH are now included in the group.

For following years, group loss carry-forward losses amounting to about EUR 45.8 million are available. Without any time limit, these can be offset to the extent of 75 % against future profits. The management has prepared planning calculations for the next 5 years and on the basis of these calculations, a loss carryforward of EUR 15.5 million can be utilized in the next 5 years. As the further development cannot be estimated at present, this amount has been included in the calculation of deferred tax.

For the fully consolidated companies, the following rates of income tax were applied:

Company	2022	2021
cyan AG	32.975%	32.975%
CYAN Licencing GmbH	25.000%	25.000%
cyan digital security (Thailand) Ltd.	15.000%	-
cyan Seamless Solution México, S.A. de C.V.	30.000%	30.000%
Cyan security Argentina SRL	25.000%	25.000%
cyan security Brasil Ltda	25.000%	-
cyan security Chile S.p.A	27.000%	27.000%
cyan security Colombia S.A.S.	35.000%	31.000%
cyan security Ecuador SAS	22.000%	22.000%
cyan Security Group GmbH	25.000%	25.000%
cyan security Peru S.A.C.	29.500%	29.500%
cyan security USA, Inc.a	-	26.500%
I-New Bangladesh Ltd.b	-	-
I-New Hungary Kft.	9.000%	9.000%
I-New Unified Mobile Solutions GmbH	25.000%	25.000%
smartspace GmbH	25.000%	25.000%

^a 21% + 5,5%.

^b tax exempt

Intangible assets and goodwill

Purchased intangible assets are valued in accordance with IAS 38 at acquisition costs or costs of production and any applicable impairments less scheduled pro-rata temporis depreciation. Extraordinary depreciation is applied if circumstances exist that justify an impairment.

Software licenses acquired are capitalized as assets on the basis of acquisition costs and commissioning of the software. These costs are amortized over the estimated useful life, which is between 3 and 5 years.

Since the period of time during which brand rights are expected to generate cashflows cannot be estimated, these are not amortized of a defined timeframe. Instead, they are written down when impairment occurs.

Research expenses are expensed as incurred. Development expenses are capitalized as assets whenever the corresponding criteria for IAS 38 are satisfied. Capitalized development expenses are carried at cost of production, less depreciation and impairment, assuming a depreciation period of between 3 and 10 years.

Intangible assets acquired in the context of a corporate merger are recognized separately from goodwill and are measured at fair value at the time of acquisition.

During the subsequent periods, intangible assets acquired in the context of a corporate merger as well as individually acquired intangible assets are valued on the basis of their acquisition costs less cumulative impairment and any cumulative depreciation charges.

Goodwill arises in the course of corporate acquisitions from the associated consideration paid and the total of all non-controlling interests in the company acquired less the balance of identifiable assets and debt taken on measured at fair value. If the difference is negative, the calculation for the consideration transferred and the purchase price allocation needs to be reexamined. If a further examination yields a negative difference, this is recorded on the statement of consolidated income. If the variance figure is positive, goodwill is recognized.

During the acquisition of cyan Security Group GmbH and its subsidiaries, goodwill, technologies and customer relationships were capitalized. Goodwill is not subject to scheduled depreciation. IAS 36 requires an impairment test to be carried out once a year. If any indication for an impairment is discovered, such impairment test is to be conducted immediately.

The technologies are depreciated on a straight-line basis over their useful life (7 years). The customer relationships are amortized over the estimated useful life (9 to 12 years).

Tangible assets (property, plant and equipment)

Tangible assets (property, plant and equipment) are carried in the balance sheet as assets at their acquisition costs less cumulative depreciation. Acquisition costs comprise the purchase price, ancillary costs and subsequent acquisition costs less any deductions they may contain on the purchase price.

Subsequent costs are included in the book value of an asset or may if necessary be recorded as a separate asset figure, but only if it is probable that the company will obtain a future economic benefit from the asset and if the costs of that asset can be established reliably. The book value of any part that is replaced is derecognized. All other repair and maintenance costs are recorded to the statement of comprehensive income for the reporting period in which they are incurred.

Tangible assets are depreciated using the straight-line method over their estimated useful life. When defining the estimated useful life, due account is taken of the expected economic and technical service life. The estimated useful life for tangible assets: 3 to 5 years for IT equipment, 4 to 10 years for other business and office equipment and 33.33 years for buildings. The recoverability of book values and periods of use for assets is examined on every balance sheet date and is adjusted as and when necessary. Whenever assets are sold, decommissioned or scrapped, the difference between the net proceeds and the net book value of the asset is recorded as a profit or a loss in other operating income or expenditure.

Investment grants are recorded under equity and liabilities, as part of other liabilities, using the gross method without affecting net income. Investment grants are recognized as other income in the consolidated statement of comprehensive income over the useful life of the assets for which they were obtained for.

Impairment and impairment test

An impairment test, as defined in IAS 36, must be conducted at least once a year for goodwill, intangible assets with an indefinite useful life and intangible assets that are not yet available for use. The recoverability of book values for all other assets, with the exception of the ones that are valued at their fair value in the statement of profit and loss, or that are subject to special regulations from a different standard governing the checking of recoverability, only needs to be checked if there are indications for an impairment.

Since corresponding data for carrying out an impairment test at the level of individual assets frequently do not exist, cash generating units are formed for the purposes of an impairment check. These are defined as the smallest identifiable group of assets that generate cash inflows that are almost entirely independent of the cash inflows from other assets or from other groups of assets. For the purposes of the impairment test, a goodwill figure is established at the time of acquisition and is allocated by cyan to those cash-generating units (or groups of them) that are expected to deliver a benefit resulting from the synergies of the merger. Cash-generating units to which a proportion of that goodwill was assigned need to be examined on an annual basis for impairment. If indications of impairment are found to exist for a unit, it may be necessary to conduct impairment tests more frequently. If the achievable amount of a cash-generating unit is less than the book value of the unit, the cost of impairment must first be allocated to the book value of each goodwill figure and then proportionally to other assets on the basis of the book value of each of those assets, as a proportion of total book value of assets within that unit. Here, the achievable amount is the higher figure from value-in-use and associated fair value less disposal costs.

The impairment test is conducted using the value-in-use concept, the achievable figure is established on the basis of the value-in-use.

Any resulting impairment loss is recognized in the statement of profit and loss, hence with an effect on earnings. If the reason for an impairment ceases to exist in a subsequent period, the impairment loss is reversed affecting earnings. Any impairment loss relating to goodwill cannot be reversed in future periods.

Leasing

A decisive factor for recognition on the balance sheet in accordance with IFRS 16 is whether the leased object constitutes an identifiable asset where the lessee can determine the form of use and is entitled to the economic benefits from the asset. For each lease, the lessee records a liability for future lease payments to be made. At the same time, a right-of-use asset is capitalized at the present value of the future lease payments and is subsequently depreciated on a straight-line basis. This standard affects cyan particularly in conjunction with the leasing of office premises, server rooms, data lines and vehicles.

The valuation of a leasing liability is based on the present value of the future lease payments. Leasing payments are discounted using the incremental borrowing rate. The rights of use corresponding to the leasing liability are adjusted to reflect any advance or deferred lease payments.

The incremental borrowing rate used to discount lease liabilities was derived from the interest rate on German federal bonds taking due account of the markup for the credit rating, the sovereign risk and the inflation differential. The average weighted incremental borrowing rate applied by cyan is 1.82 % (2021: 1.25 %).

The leasing liability features the following maturities:

in EUR thousand	31/12/2022	31/12/2021
Leasing liabilities	2,952	5,039
Thereof non-current	2,091	3,832
Thereof current	861	1,207

IFRS 16 mandates estimates that influence the valuation of the usage rights as well as the leasing liabilities. These include the contract duration and the applied incremental borrowing rate to discount future leasing payment obligations.

The following table shows the impact of lease contracts in the statement of profit and loss.

in EUR thousand	31/12/2022	31/12/2021
Depreciation of buildings	738	757
Depreciation of other equipment, operating and office
equipment	67	80
Interest expense	55	69
Income from subleasing of rights of use in connection with
buildings	282	274
Interest income	2	3

The total lease payments in 2022 amounted to EUR 1,249 thousand (2021: EUR 1,251 thousand).

cyan leases various office premises, server rooms, vehicles and fiber-optic cables. Lease contracts for office premises usually run for 10 years or for an indefinite period, 5 years for colocation services, 5 years for vehicles and 5 years for fiber-optic cables.

In 2019, a shortage of space prompted the leasing of a larger office, and the office used previously was sub-let starting November 2019. The term of that subletting contract is the same as the term of the lease contract. For this, the usage rights were derecognized, and a leasing receivable was set up. As a result of the sub-lease to a customer, a leasing receivable was capitalized in 2020. In addition, there is a sublease agreement relating to the rental of server space, which is the reason why a lease receivable has also been capitalized.

Extension and termination option

A number of cyan's property and plant lease contracts include extension and termination options. Contractual terms of this kind are used to assure cyan of maximum operational flexibility in relation to the assets used by the group. The majority of existing extension and termination options can only be exercised by the group and by its respective lessors.

The application of IFRS 16 at cyan in 2022 has a positive impact of EUR 1,249 thousand on EBITDA because in conjunction with IFRS 16, no rental cost is incurred. Since in relation to sub-leases associated with IFRS 16 no lease revenue is recorded, this has a negative impact on EBITDA amounting to EUR 282 thousand. In addition, with cyan Peru, cyan Chile and cyan Colombia, foreign exchange losses to the value of EUR 61 thousand were recognized, as a result of contracts denominated in foreign currencies. Furthermore, depreciation amounting to EUR 805 thousand reduce the EBIT was incurred. After interest expenses of EUR 55 thousand and interest income of EUR 2 thousand, the effect from IFRS 16 on the period result amounted to EUR 49. Interest incurred is disclosed in the financial results.

in EUR thousand	31/12/2022	31/12/2021
Due in one year	186	274
Due in 1 to 2 years	118	183
Due in 2 to 3 years	-	118
Due in 3 to 4 years	-	-
Due in 4 to 5 years	-	-
Due in more than five years	-	-
Total undiscounted leasing payments	304	575
Non-guaranteed residual values	-	-
Financial income not yet realized	-1	-3
Present value of lease payments to be received	303	572
Impairment for uncollectible lease payments	-	-
Net investment value from leases	303	572

The following table shows the receivables from financial leasing arrangements:

Undiscounted leasing payments:

in EUR thousand	31/12/2022	31/12/2021
Due within one year	186	274
Due in more than one year	118	301

Net investment value from leasing:

in EUR thousand	31/12/2022	31/12/2021
Due within one year	186	272
Due in more than one year	118	300

The elective application according to IFRS 16.5 for short-term leasing arrangements with a term of up to one year and for leasing arrangements where the underlying asset is a low value good (less than EUR 5,000) have been adopted. The associated lease payments are recorded as expense in a straight-line fashion over the term of the lease arrangement. A total of EUR 213 thousand was incurred for short-term lease arrangements, and EUR 1 thousand for low-value lease arrangements.

Financial Instruments

IFRS 9 contains three valuation categories which represent valuation at amortized acquisition costs, valuation at fair value with changes recognized through the statement of profit and loss and valuations at the fair value with changes in value recognized through other comprehensive income.

At this time, and for the following reasons, at cyan only the valuation at amortized acquisition costs is being applied.

Fundamentally, the fair values for financial instruments do not differ from their book values because the interest-related receivables and liabilities either virtually correspond to current market rates, or the instruments are current.

In the case of trade receivables (receivables from goods and services), other receivables, cash and cash equivalents as well as the trade payables (liabilities from goods and services) and other liabilities, due to the predominantly short-term nature of these items, their book values by and large match their associated fair values.

The financial liabilities are subject to fixed interest rates, but there are no significant differences to the fair values or the fair values are almost identical to the book values in the case of fixed interest rates.

Impairments must be recognized in relation to financial assets that are valued on the basis of amortized acquisition cost, and to contract assets.

cyan makes use of the simplified procedure for trade receivables, which under certain conditions for the assessment of impairment for these financial assets allows to always take place at the level of the expected credit loss using a distribution matrix.

As a basis for estimated, expected credit losses, experience-based values are derived from actual historical credit losses from the previous 3 years. In relation to receivables and leasing receivables with an impaired credit rating ('Level 3') and for contract assets, specific provisions for bad debt are set up.

Inventories

Inventories are valued at the lower figure from purchase costs or manufacturing costs and the net disposal value. The net disposal value is the estimated proceeds from a sale, less the estimated costs of completion and the sale transaction. Purchase costs or manufacturing costs are established on the basis of the moving average price procedure.

Provisions for severance payments

Provisions for performance-based liabilities are set up to cover the legal entitlement of employees. Employees are entitled to a severance payment when they reach retirement age and when the employer terminates their employment. The level of these claims is determined by the number of years of service and by the salary level at the severance date. Calculated in accordance with actuarial principles based on the projected unit credit method. Contribution-oriented liabilities exist for salaried staff in Austria whose employment relationship began after December 31, 2002. These severance obligations are settled by the ongoing payment of corresponding contributions to an employee pension fund into accounts held by the employees and amount to EUR 76 thousand (2021: EUR 103 thousand). In addition, voluntary severance payments amounting to EUR 30 thousand (2021: EUR 6 thousand) were incurred.

Liquid assets

Cash and cash equivalents are classified as cash in hand and as credit balances in banks and may include other short-term highly liquid capital assets with an original term of up to three months. They are recorded at nominal value.

Financial liabilities

In accordance with IFRS 9, financial liabilities are recognized initially at the associated fair value less any transaction costs incurred. The following assessment is based on amortized cost. The difference between the cash-inflow (after deduction of transaction costs) and the repayment figure is recorded in the statement of comprehensive income over the term of the financial liabilities, applying the effective interest method.

Trade payables are liabilities from the payment of goods or services that were acquired from suppliers in the course of normal business activity. Trade payables are classified as short-term liabilities if payment falls due within one year or sooner. Initially, trade payables are recorded at their fair value, and are then valued as amortized costs by applying the effective interest method.

The book value of other liabilities corresponds to the associated fair value, as they are mainly current.

Provisions

Provisions are set up if the company as the result of a past event incurs a current (legal or factual) liability for which it is probable that the company will be obliged to fulfill it, and where a reliable estimate of the value of that liability can be performed. The valuation of provisions is based on the present value of the best possible estimate by the management expenses required at the end of the reporting period to fulfill the current liability. The expenses for a provision are recorded in the statement of comprehensive income.

Corporate acquisitions/Acquisitions of other business units

No corporate acquisitions took place in 2022 and 2021.

When I-New Unified Mobile Solutions GmbH was acquired by cyan AG in 2018, an earnout clause was agreed with the former shareholders which provides for a resultsbased supplement to the purchase price when defined EBITDA thresholds are achieved in the following years of 2019 to 2021. Due to a one-off license deal, the EBITDA threshold was exceeded in 2019.

To determine the supplement to the purchase price, a consolidated balance sheet and income statement were set up for the original I-New Group (elimination of inclusion of cyan Security Group GmbH) including explanatory details. In 2019, the original I-New group achieved an EBITDA of EUR 11,525 thousand which led to the recognition of a liability amounting to EUR 817 thousand for the earn-out payment to former shareholders. In 2020 the EBITDA was EUR 8,040 thousand so a liability of EUR 1,021 thousand was recognized. EBITDA in 2021 amounts to EUR -2,373 thousand, which is why no liability has been recognized.

Segment reporting

Segment reporting, in accordance with IFRS 8, is to be based on internal control and reporting (Management Approach). The line of separation between the business segments and their corresponding report contents are therefore based, as mentioned previously, on the reporting structure within cyan, with the Executive Board as the main decision-making body.

Accordingly, operational segments with mandatory reporting requirements are defined as the Cybersecurity segment (consisting of cyan Security Group GmbH and its subsidiary), and the BSS/OSS segment (consisting of I-New Unified Mobile Solutions GmbH and its subsidiaries with the exception of the subsidiaries assigned to the Cybersecurity division). Both segments are constituent parts of the corporation that conduct business activities that give rise to sales revenues and expenditures, the results of which are monitored by the Executive Board of cyan AG for the purposes of measuring success and resource allocation, with separate financial information available for each. While both segments operate in the technology and software sector, each offers distinctive products and services. The Executive Board decided in favor of this form of segmentation because it best reflects the opportunity & risk structure of the company. The distinctive nature of customer groups and the technical solutions and products used provide clear separation between the segments. Details of the segments' strategy and business performance are discussed in the management report.

Both business segments outperform the quantitative threshold values. No further business segments exist beyond these two. The "Transition" column includes the activities of cyan AG that have not been allocated to either of these two segments and to consolidations performed at group level.

	BSS/OSS		Cybersecurity		Transition		Total
in EUR thousand	2022	2021	2022	2021	2022	2021	2022	2021
Segment total
revenues	7,800	7,335	4,515	3,479	62	11	12,378	10,825
Segment revenues	4,735	5,195	3,802	3,288	-	-	8,537	8,483
EBITDA	-3,646	-2,368	-3,623	-7,365	-1,127	-2,587	-8,396	-12,320

^a Sum of revenue, other operating income, income from reversals of impairment losses and changes in inventories

Employees are attributed to the segments as follows (average for the period):

	BSS/OSS			Cybersecurity		Transition		Total
	2022	2021	2022	2021	2022	2021	2022	2021
Employees (FTE)	87	81	49	69	0	0	136	150

The following table shows cyan's non-current tangible assets, intangible assets and deferred tax assets by region of origin.

	BSS/OSS		Cybersecurity		Transition		Total
in EUR thousand	31/12/2022	31/12/2021	31/12/2022	31/12/2021	31/12/2022	31/12/2021	31/12/2022	31/12/2021
Americas	1,348	1,777	-	-	-	-	1,348	1,777
APAC	9	18	102	-	-	-	111	18
EMEA	13,800	13,527	38,870	44,773	24	35	52,694	58,334
Non-current tangible assets, intangible assets and deferred tax
assets	15,158	15,322	38,972	44,773	24	35	54,154	60,130

The countries of the respective customers / companies are allocated to the Americas, APAC and EMEA regions as follows:

• Americas: Argentina, Brazil, Chile, Colombia, Ecuador, Mexico, Peru, USA

• APAC (Asia and Pacific): Bangladesh, New Zealand, Thailand
• EMEA (Europe, Middle East and Africa): Austria, Cyprus, France, Germany, Greece, Hungary, Italy, Ireland, Poland, Slovakia, Slovenia, Spain, Switzerland

The following table shows how the additions of long-term tangible assets and intangible assets of cyan by their region of origin.

	BSS/OSS		Cybersecurity		Transition		Total
in EUR thousand	31/12/2022	31/12/2021	31/12/2022	31/12/2021	31/12/2022	31/12/2021	31/12/2022	31/12/2021
Americas	140	41	-	-	-	-	140	41
APAC	-	-5	103	-	-	-	103	-5
EMEA	672	327	427	132	2	-	1,101	460
Additions to non current tangible assets, intangible
assets	812	362	530	132	2	-	1,344	495

In 2020, an intra-Group addition in the APAC region was declared in the BSS/OSS segment. Due to immateriality, the correction was made in 2021.

The accounting and valuation methods of the reporting segments match the group's accounting and valuation methods described above.

Notes to the statement of comprehensive income

[1] Revenues

All revenues result from contracts with customers as defined by IFRS 15 and include all revenues resulting from cyan's ordinary business activities. In the financial year, a number of new customer contracts were concluded.

The following chart shows cyan's revenues broken down by the region of origin of the business partner.

	BSS/OSS		Cybersecurity		Total
in EUR thousand	2022	2021	2022	2021	2022	2021
Americas	1,422	1,219	-	-	1,422	1,219
thereof Colombia	601	413	-	-	601	413
thereof Mexico	493	331	-	-	493	331
thereof other countries	327	475	-	-	327	475
APAC	1,613	1,414	98	13	1,711	1,427
thereof Bangladesh	655	232	-	-	655	232
thereof New Zealand	958	1,182	-	-	958	1,182
thereof other countries	-	-	98	13	98	13
EMEA	1,700	2,580	3,704	3,257	5,404	5,837
thereof Austria	667	538	2,667	2,592	3,334	3,130
there of Slovenia	987	1,856	-	-	987	1,856
thereof other countries	47	186	910	660	956	845
Revenues	4,735	5,213	3,802	3,270	8,537	8,483

In the Cybersecurity segment, the revenues of two (2021: 1) customer exceed the 10% threshold (EUR 3,267 thousand; 2021: EUR 2,564 thousand), while in the BSS/OSS segment this applies to three (2021: 2) customers (EUR 2,600 thousand; 2021: EUR 3,038 thousand).

At the end of the reporting period, an amount of EUR 16.389 thousand is attributable to the allocated transaction prices of the unfulfilled performance obligations. The following table shows the allocated transaction prices of the performance obligations not yet settled by due date.

in EUR thousand	Up to 1 year	2 -5 years	5 years
Transaction prices	4,485	10,967	937

[2] Other operating income, income from reversals of impairment losses and changes in inventories

Other income, income from reversals of impairment losses and changes in inventories comprise the following items:

in EUR thousand	2022	2021
Change in inventories and capitalized own work	-335	-798
Income from subsidies/research grants	911	970
Income from reversal of impairment losses	8	111
Exchange rate gains	2,660	1,979
Other	597	80
Other income, income from reversals of impairment losses
and changes in inventories	3,841	2,342

The changes in inventories shown relate to contract costs to fulfill customer contracts in accordance with IFRS 15. In 2020, contract costs were capitalized. From April 2021, the contract costs will be dissolved over the term of the contract due to the commencement of service provision. In addition, further contract costs were capitalized in 2022, which will also be dissolved over the term of the contract once the service has been rendered.

The research grant is a subsidy for research and development expenses paid by the Austrian Federal Ministry of Finance.

The exchange rate gains largely result from the valuation of contract assets. The increase results from the change in the US dollar exchange rate.

The item "Other" includes income from the derecognition of the leasing liability due to the premature termination of a lease agreement in the amount of EUR 163 thousand. Furthermore, income from the dissolution of a value adjustment in the amount of EUR 286 thousand is presented, as the customer receivable was written off in full.

[3] Costs of materials and services procured

The Statement of Profit and Loss and the Statement of Comprehensive Income include expenses for materials and services procured as follows:

in EUR thousand	2022	2021
Cost of materials	-41	-308
Cost of services procured	-4,936	-5,065
Cost of materials and services procured	-4,977	-5,372

The purchased services mainly relate to external services such as various services (e.g. maintenance services and technical consulting) in Germany, in the EU and in third countries.

[4] Personnel expenses

Personnel expenses include the following items:

in EUR thousand	2022	2021
Salaries	-7,322	-9,438
Expenses for social security contributions and payroll taxes	-1,646	-2,099
Other personnel expenses	-324	102
Personnel expenses	-9,292	-11,435

The average number of employees is 136 (2021: 150). These are divided as follows on the based on their geographical locations:

in EUR thousand	2022	2021
European Union (excl. Austria)	29	29
Austria	69	86
South America	30	29
Asia	8	6
Rest of the world	-	-
Average number of employees	136	150

[5] Impairment of trade receivables and contract assets

In 2022, the impairment loss on trade accounts receivable and contract assets relates to write-downs of receivables in the amount of EUR 287, most of which relates to the receivable from the customer Nokia. In addition, specific valuation allowances of EUR 28 thousand had to be recognized.

In 2021, the impairment loss on trade receivables and assets relates to write-downs of receivables in the amount of EUR 51 thousand. In addition, specific valuation allowances of EUR 386 thousand were required for the customer Truu (Mexico).

[6] Other expenses

Other expenses include the following items (type of expenses):

in EUR thousand	2022	2021
Consulting fees	-1,893	-2,549
Advertising expenses	-301	-659
Rental expenses	-316	-313
Fees	-156	-307
Insurance	-224	-187
Research and development	-150	-189
Travel expenses	-261	-103
Exchange rate differences	-1,394	-433
Other	-1,495	-1,161
Other expenses	-6,190	-5,901

Consulting expenses include expenses for technical advice, legal and tax advice and other consulting services. Other expenses include administrative expenses, monetary transaction charges and contributions.

Advertising expenses have decreased compared to the previous year, as one-time advertising measures were taken in 2021. Furthermore, travel expenses have increased due to increased travel activities post COVID-19. The exchange rate differences are largely due to the fluctuation of the Mexican peso.

[7] Depreciation

The statement of comprehensive income includes expenses for depreciation and amortization as follows:

in EUR thousand	2022	2021
Amortisation of intangible assets	-4,555	-4,635
Depreciation on property, plant and equipment	-1,071	-1,108
Depreciation and amortization	-5,626	-5,742

Further information on depreciation and amortization can also be found in Notes 10 and 11, and in the accounting policies under intangible assets, property, plant and equipment, and leases.

[8] Financial income and financial expenses

Other interest income comprise EUR 644 thousand from the recognition of financing components included in customer contracts in accordance with IFRS 15. The interest expenses are attributable to external financing (e.g. bank and other loans).

in EUR thousand	2022	2021
Interest income
Loans	6	0
Other	646	727
Financial income	653	727
Interest and similar expenses
Leasing liabilites	-55	-69
Interest on loans	-43	-57
Other	-26	-37
Financial expenses	-124	-163
Loss from the net position of monetary items	-8	-
Financial result	521	564

[9] Taxes on income

Actual tax refund claims and tax liabilities are netted if the company has an enforceable right to offsetting and if it intends to achieve a net basis settlement or to offset claims against liabilities simultaneously.

in EUR thousand	2022	2021
Expenses for current income taxes	-91	881
Tax credits/back payments for previous years	28	11
Change in deferred income taxes	-2,937	2,728
Income taxes	-3,000	3,620

Tax transition account

The group tax rate is defined as the ratio of recorded income tax expenses to the earnings before taxes.

The tax expenses are calculated at the applicable tax rates in the various jurisdictions. In accordance with IAS 12, the tax rate to be applied is the most suitable one for the information interests of the final account addressees. In most cases, this is the tax rate in the country in which the company is headquartered. Since cyan AG, a company based in Germany, operates solely as a holding company while the majority of its operational subsidiaries have their head offices in Austria, Austrian corporation tax is applied at the rate of 25 % (2021: 25 %) when the tax transition account is created.

Transition of the computed tax on income at the recorded cost of tax on revenues is presented as follows:

in EUR thousand	2022	2021
Income before income taxes	-13,500	-17,497
Income tax expense based on the Austrian corporate income
tax rate (25%)	3,375	4,374
Differences due to different tax rates	67	31
Tax-free income	519	2,305
Non-deductible expenses	-1,459	-2,464
Taxes from previous periods	28	11
Losses of the current year - for which no deferred tax asset
was recognised	-3,201	-4,313
Recognition of tax effects of previously unrecognised loss
carryforwards	622	9
Foreign taxes	-6	625
Changes in estimates from previous years	-	309
Other differences	-7	5
Effective Group tax expense	-63	892

Notes to the statement of financial income

[10] Intangible assets

The following table shows the development of intangible assets:

in EUR thousand	Patents, customer relations & similar rights	Software	Development costs	Goodwill	Total
As of 01/01/2021
Acquisition costs	17,688	20,572	966	30,779	70,006
Accumulated depreciation	-4,794	-6,273	-75	-	-11,142
Book value	12,894	14,300	891	30,779	58,864
Financial year 31/12/2021
Initial book value	12,894	14,300	891	30,779	58,864
Additions - purchases	156	68	-	-	223
Depreciation	-1,645	-2,935	-54	-	-4,634
Currency difference depreciation	-	0	-	-	0
Book value	11,405	11,432	837	30,779	54,453
Currency translation acquisition costs	-	-0	-	-	-0
Currency translation accumulated
depreciation	-	0	-	-	0
As of 01/01/2022
Acquisition costs	17,844	20,640	966	30,779	70,229
Accumulated depreciation	-6,439	-9,208	-129	-	-15,776
Book value	11,405	11,432	837	30,779	54,453
Financial year 31/12/2022
Initial book value	11,405	11,432	837	30,779	54,453
Additions - purchases	72	282	-	-	354
Rebooking of acquisition costs	0	-	-	-	0
Rebooking of accumulated depreciation	-0	-	-	-	-0
Depreciation	-1,655	-2,835	-54	-	-4,543
Currency difference depreciation	-	1	-	-	1
Book value	9,823	8,879	783	30,779	50,264
As of 31/12/2022
Currency translation acquisition costs	-	1	-	-	1
Currency translation accumulated
depreciation	-	-1	-	-	-1
Acquisition costs	17,916	20,923	966	30,779	70,584
Accumulated depreciation	-8,093	-12,044	-183	-	-20,320
Book value	9,823	8,879	783	30,779	50,264

The depreciation in the Group's statement of profit and loss also includes the depreciation of contract costs amounting to EUR -11 thousand (2020: EUR 11 thousand).

The development costs capitalized amount to EUR 783 thousand (2021: EUR 837 thousand) and primarily comprise personnel costs.

Brand rights which have an unlimited useful life and that are disclosed under Patents, customer relationships & other rights, are recognized with a book value of EUR 32 thousand (2021: EUR 32 thousand).

In the consolidated financial statements, goodwill to the amount of EUR 30,779 thousand is disclosed. This results from the acquisition of cyan Security Group GmbH by cyan AG as part of the stock market flotation in 2018. Goodwill was therefore assigned entirely to the cash-generating unit (CGU) of Cybersecurity which already existed from cyan companies even prior to acquisition of the holding in I-New Unified Mobile Solutions GmbH in July 2018 and that at the same time constitutes a business segment in accordance with IFRS 8. For CGU Cybersecurity, an impairment test was therefore a mandatory requirement.

In addition, the achievable amount of the CGU must be set alongside its book value. The achievable amount is the higher of the two figures from the fair value less sale costs and value-in-use. In accordance with the evaluation hierarchy in IFRS 13, the fair values need to be established primarily on the basis of market prices, and can for example be linked to existing binding purchase offers, secondary pricing on active markets or comparable transactions within the sector at similar times. If it is not possible to apply the market price-based method, capital value-based methods such as the discounted cashflow method used in this case can be applied.

As an achievable amount for CGU, its value-in-use is determined by means of a discounted cashflow calculation. This involves deriving cashflows from the business plan including the cashflow plan that is approved by the Executive Board and that is updated on a regular basis. Future expansion investments and restructuring costs are only included in the determination of value-in-use to the extent that an official obligation to do so exists because the value-in-use must always correspond to the asset value or to the group of asset values in their current condition. The discounting rate takes the form of a post-tax rate of interest that reflects current market estimates, the fair value of the money and the specific risks to the asset value and/or the CGU. The corresponding pre-tax rate of interest is based on an iterative process. To determine quantifiable amounts using capital value-based methods, the weighted average capital cost (WACC) is used. The WACC, the planned sales revenues and the growth rate for the perpetual annuities constitute the most important planning assumptions and it is to these that the achievable figure reacts most sensitively.

The interest applied to equity is defined using the Capital Asset Pricing Model (CAPM) which comprises the basic rate of interest, a market risk premium and a beta factor. The rate of interest debt corresponds to the risk premium on corporate loans for comparable companies. To disclose sovereign risk appropriately, due account is taken of corresponding cash inflows. On this basis, the WACC is defined as approximately 11 %. Due to the volatile financial market environment, the development of capital costs (and in particular the sovereign risk premiums) are monitored continually. Financial surpluses anticipated after the detailed planning period of five years are incorporated using a terminal value calculation, based on the assumption of an infinite growth rate of 3 %.

The impairment test did not give rise to any need for value adjustment.

cyan has conducted an analysis into the sensitivity of the impairment tests against amendments to the key assumptions upon which a determination of the achievable figure for the Cybersecurity CGU is based. The view of the management is that every possible amendment to those key assumptions that can be viewed as reasonable and upon which the achievable figure for the CGU is based, would not give rise to a situation where the total book value exceeds the recoverable total value.

[11] Tangible assets

The development of tangible assets can be depicted as follows:

in EUR thousand	Building equipment	Machinery and similar equipment	Other equipment/ office equipment	Total
As of 01/01/2021
Acquisition costs	6,562	127	1,132	7,821
Accumulated depreciation	-1,242	-38	-542	-1,822
Book value	5,321	89	589	5,999
Financial year 31/12/2021
Initial book value	5,321	89	589	5,999
Additions - purchases	46	57	169	272
Reclassification of acquisition costs	-	1	-1	-
Reclassification of accumulated depreciation	-	-1	1	-
Disposals acquisition costs	-39	-	-281	-321
Disposals accumulated depreciation	-	5	140	145
Depreciation	-838	-34	-224	-1,096
Currency difference	6	-0	-1	5
Book value	4,495	117	392	5,004
Currency translation acquisition costs	-82	-0	6	-76
Currency translation accumulated
depreciation	19	0	-3	16
As of 01/01/2022 Acquisition costs	6,487	184	1,024	7,696
Accumulated depreciation	-2,055	-68	-630	-2,752
Book value	4,432	117	394	4,943
Financial year 31/12/2022
Initial book value	4,432	117	394	4,943
Additions - purchases	529	435	26	990
Reclassification of acquisition costs	24	-24	-0	-0
Reclassification of accumulated depreciation	-9	9	0	0
Disposals acquisition costs	-2,479	8	-253	-2,725
Disposals accumulated depreciation	993	-0	203	1,196
Depreciation	-822	-80	-169	-1,071
Currency difference	31	0	-0	31
Book value	2,699	465	200	3,364
As of 31/12/2022
Currency translation acquisition costs	-80	2	2	-76
Currency translation accumulated
depreciation	45	1	-2	44
Acquisition costs	4,481	606	798	5,885
Accumulated depreciation	-1,817	-138	-598	-2,553
Book value	2,664	468	201	3,332

This table also includes the rights-of-use that arise as a consequence of IFRS 16.

The following table shows the development of rights-of-use in the Tangible assets section of the balance sheet.

in EUR thousand	Buildings	Vehicles	Fibre Optic	Total
As of 01/01/2021
Acquisition costs	5,781	190	282	6,253
Accumulated depreciation	-1,165	-82	-134	-1,381
Book value	4,616	108	148	4,872
Financial year 31/12/2021
Initial book value	4,616	108	148	4,872
Additions	45	-	125	169
Disposals acquisition costs	-39	-74	-186	-299
Disposals accumulated depreciation	-	35	85	120
Depreciation	-757	-31	-49	-836
Currency difference	6	-	-1	5
Book value	3,871	38	122	4,031
Currency difference acquisition
costs	-81	7	-	-74
Currency difference accumulated
depreciation	18	-4	-	14
As of 01/01/2022
Acquisition costs	5,706	116	228	6,050
Accumulated depreciation	-1,898	-78	-103	-2,079
Book value	3,807	38	125	3,971
Financial year 31/12/2022
Initial book value	3,807	38	125	3,971
Additions	488	-	4	493
Disposals acquisition costs	-2,206	-35	-111	-2,352
Disposals accumulated
depreciation	914	20	111	1,045
Depreciation	-738	-16	-50	-805
Currency difference	31	-	-1	30
Book value	2,296	7	79	2,382
Currency translation acquisition
costs	-81	7	-	-74
Currency translation acquisition
costs	44	-5	-	39
As of 31/12/2022
Acquisition costs	3,907	82	129	4,117
Accumulated depreciation	-1,647	-75	-49	-1,770
Book value	2,260	7	80	2,347

[12] Contract assets, contract costs and contract liabilities from contracts with customers

The following table shows the amount of contract costs (costs of initiating a contract and contract performance costs), receivables, contract assets and contract liabilities arising from contracts with customers in accordance with IFRS 15:

in EUR thousand	31/12/2022	31/12/2021
Costs of initiating a contract	34	46
thereof non-current	34	46
thereof current	-	-
Contract performance costs	3,874	4,209
thereof non-current	3,874	4,209
thereof current	-	-
Trade accounts receivable	2,881	2,496
thereof non-current	-	-
thereof currenta	2,881	2,496
Contract assets	14,933	17,077
thereof non-current	10,726	13,274
thereof currenta	4,208	3,803

^a Compared to the consolidated financial statements as of December 31, 2021, there have been reclassifications of trade receivables and assets.

The costs of initiating a contract include special bonuses for the conclusion of customer contracts. These have been capitalized and are amortized over the term of the contract. They are shown in the balance sheet as non-current assets, as the contract term is longer than 1 year. Contract performance costs largely comprise personnel costs, services procured and travel expenses. As the performance obligations agreed in the contracts have been partially fulfilled as of April 2021, the capitalized contract performance costs are amortized over the term of the contract and are presented as non-current.

The contract assets were divided into non-current and current contract assets in accordance with the requirements of IAS 1.

The contract liabilities are based on services already invoiced, which were released in full at the time the services were rendered.

[13] Deferred taxes

The tax effects of temporary differences, tax losses carried forward and tax credits that give rise to deferred tax assets and to deferred tax liabilities are as follows.

in EUR thousand	31/12/2022	31/12/2021
Deferred tax assets
Non-current assets	352	318
Current assets	373	327
Non-current provisions and liabilities	-	10
Current provisions and liabilities	89	91
Losses carried forward	164	317
Other (asset items, cash procurement costs)	-	-
Deferred tax liabilities
Non-current assets	3	3
Current assets	29	40
Non-current provisions and liabilities	0	0
Current provisions and liabilities	7	287
Other (asset items, cash procurement costs)	381	-
Net deferred tax assets	558	733

Due to tax planning, future profits are anticipated against which deferred tax assets can be offset.

in EUR thousand	31/12/2022	31/12/2021
Deferred tax assets
Non-current assets	8	2
Current assets	10,393	6,018
Non-current provisions and liabilities	345	785
Current provisions and liabilities	4,940	497
Losses carried forward	3,809	7,876
Other (asset items, cash procurement costs)	-	19
Deferred tax liabilities
Non-current assets	7,674	10,434
Current assets	1,692	6,514
Non-current provisions and liabilities	-	-
Current provisions and liabilities	15,977	1,387
Other (asset items, cash procurement costs)	7	-
Net deferred tax liabilites	5,855	3,139

Deferred tax assets and deferred tax liabilities are netted for each country if certain conditions are met. These conditions are met if there is a legally enforceable right to set off current tax assets against current tax liabilities, if they relate to income taxes levied by the same taxation authority and cyan intends to settle its current tax assets and liabilities on a net basis. The deferred tax liabilities originate from the companies in Austria, Germany, Thailand and Hungary. The deferred tax assets originate from the remaining countries.

According to the eco-social tax reform in Austria, which was passed in January 2022, the corporate income tax rate will be reduced to 24 % in 2023 and to 23 % as of 2024.

The development of deferred taxes and the breakdown of changes into components that do and do not have an effect on earnings are shown in the table below:

in EUR thousand	Deferred tax assets	Deferred tax liabilities	Currency difference
Balance as at 01/01/2021	192	5,311	-
Changes affecting net income	542	-2,172	-14
Changes not affecting net income	-	-	-
Balance at 31/12/2021	733	3,139	-
Balance as at 01/01/2022	733	3,139	-
Changes affecting net income	-175	2,716	46
Changes not affecting net income	-	-	-
Balance at 31/12/2022	558	5,855

[14] Finanzinstrumente

			Book values	Book values
in EUR thousand	IFRS 9a	Level	31/12/2022	31/12/2021
Assets
Leasing receivables (non-current)	AC	n/a	118	300
Leasing receivables (current)	AC	n/a	186	272
Cash and cash equivalents	AC	n/a	5,349	8,504
Trade receivables and other
receivables	AC	n/a	2,881	2,496
Liabilities
Leasing liabilities (non-current)	AC	n/a	2,091	3,832
Leasing liabilities (current)	AC	n/a	861	1,207
Financial liabilities	AC	n/a	2	15
Convertible notes	AC	n/a	-	2,450
Trade payables and other liabilities	AC	n/a	4,331	5,224
Other non-current financial
liabilities	AC	n/a	3,705	5,199
Other non-current liabilities	AC	n/a	207	206

^a Classification according to IFRS 9 (AC = accumulated cost).

^b Compared to the consolidated financial statements as of December 31, 2021, there were reclassifications in trade receivables and trade payables and other liabilities.

A fair value measurement according to Level 2 (based on net present value) resulted in a fair value of EUR 292 thousand for the lease receivables and EUR 2,666 thousand for the leasing liabilities as of December 31, 2021.

Non-current financial liabilities include fixed-interest loans from the Austrian Research Promotion Agency (FFG) and a fixed-interest loan from Erste Bank. The FFG loans are measured at amortized acquisition costs and amount to EUR 654 thousand as of December 31, 2022. A fair value measurement according to Level 2 (based on net present value) resulted in a fair value of EUR 603 thousand. The fixed-interest loan from Erste Bank is also measured at amortized acquisition costs and amounts to EUR 3,051 thousand as of December 31, 2022. A fair value measurement according to Level 2 (capital value-oriented) resulted in a fair value of EUR 3,004 thousand.

In the case of trade accounts receivable, other receivables, cash and cash equivalents, trade accounts payable and other liabilities, it is assumed that the carrying amounts essentially correspond to the fair values due to the predominantly shortterm nature of the items.

In 2021, an agreement regarding the issuance of convertible bonds was reached between cyan AG (issuer) and NICE & GREEN S.A. (investor). The nominal value of the convertible note amounts to EUR 8.4 million and will be drawn in eight tranches of EUR 1.05 million each. The investor can dissolve the agreement if the share price falls below 115 % of the fixed minimum price (EUR 10.472). In the event of a termination, the investor will receive the outstanding nominal value of the drawn tranches either in the form of converted shares based on the conversion price or the tranches will be repaid, in which case the outstanding nominal value will be divided by 0.97. The investor has the right to choose the conversion price. The issuer has the right to choose which option is executed. If the tranches are drawn, the investor is generally obliged to convert. cyan has the option to prevent a conversion by repaying the investor the amount stated in the conversion notice divided by 0.97. If conversion is not prevented, conversion takes place at the conversion price. The conversion price is defined as the maximum value between the fixed minimum price (EUR 10.472) and 95 % of the value of the lowest share price of the last 6 trading days. If the share price is greater than or equal to EUR 12.043, the investor has the obligation to draw the tranches, below that it is optional. There is no regular interest. Currently, 4 tranches (totaling EUR 4.2 million) have already been drawn. As can be seen in the statement of changes in equity, 152,207 shares amounting to EUR 1.75 million have already been converted. The convertible bond program with the investor was terminated in 2022.

In 2022, following the entry of a new investor, the convertible bond in the amount of EUR 2,450,000.00 was converted into a liability to the new investor in the amount of EUR 2,390,000.00. The remaining difference of EUR 60,000.00 was derecognized in the income statement. Subsequently, the receivable from the new investor in the amount of EUR 2,390,000.00 and a further receivable in the amount of EUR 1,550,000.00 were contributed to cyan AG on the basis of a contribution agreement. In return, the new investor will receive 1,503,816 shares issued as part of a capital increase through contributions in kind.

[15] Receivables

The receivables are broken down by maturity date, as follows:

in EUR thousand	31/12/2022	31/12/2021
Other receivables	23	33
Financial receivables	118	300
Non-current receivables	141	333
Trade receivablesa	2,881	2,496
Receivables from taxes on income	342	214
Accruals and deferred income	589	448
Other receivables and assetsa	1,663	1,934
Current receivables	5,475	5,093
Receivables	5,616	5,425

^a Compared with the consolidated financial statements as of December 31, 2021, there were reclassifications in trade receivables and other receivables and assets.

The majority of the non-current other receivables consist of security deposits. Non of which were overdue nor impaired.

From the trade receivables, contract assets and leasing receivables, provisions were deducted for bad debt amounting to EUR 7.366 thousand (2021: EUR 7,832 thousand) and for impairments in accordance with IFRS 9 amounting to EUR 68 thousand (2021: EUR 70 thousand).

The other current receivables primarily comprise leasing receivables and research grants.

The following table shows the performance of impairments from goods and services, contract assets and leasing receivables:

in EUR thousand	2022
Impairment losses 01/01	70
Allocation	26
Reversal of impairment losses	-33
Currency difference	-
Foreign currency valuation	5
Impairment losses 31/12	68

The following table shows the performance of impairments from financial assets, the creditworthiness of which is impaired on the reporting date:

in EUR thousand	2022
Impairment losses 01/01	7,832
Allocation	28
Reversal of impairment losses	-843
Currency difference	325
Foreign currency valuation	24
Impairment losses 31/12	7,366

The allocations are attributable to impairment losses from Mexico. The dissolutions/uses are from Peru, Colombia and Austria.

Assignment for security

cyan has assigned trade receivables to the Erste Bank der oesterreichischen Sparkassen AG (short form "Erste Bank") as security for all receivables and other claims by Erste Bank in relation to the lines of credit and loans it has already extended to cyan Security Group GmbH. Erste Bank has provided cyan with no advance against a receivable. These receivables were derecognized because a right of recourse means that all threats and opportunities, first among this being the risk of business failure, lie with cyan. The third-party debtors (garnishees) have been advised of this assignment. In accordance with an agreement with the Bank, customers settle their liabilities by making payment to an account specially set up at the Bank for this purpose, to which cyan has the power of disposition over the paid-in funds. The receivables are held in a business model for the collection of payment flows, consistent with the carry-forward approach to receivables. The book value for trade receivables at yearend, transferred but not posted to expenses, amounts to EUR 3,043 thousand. The book value of the secured credit at year-end also amounts to EUR 3,051 thousand.

[16] Cash and cash equivalents

The following table includes details of cash and cash equivalents:

in EUR thousand	31/12/2022	31/12/2021
Cash on hand	2	2
Deposits with credit institutions	5,347	8,501
Cash and cash equivalents	5,349	8,504

[17] Equity

As of December 31, 2022, the nominal capital amounted to EUR 17,016,800.00 (December 31, 2021: EUR 13,385,884.00) and was fully paid up. The development of nominal capital and capital reserves is shown in the statement of changes in equity.

As of the balance sheet date, there are 17,016,800 shares in circulation (December 31, 2021: 13,385,884 shares), the nominal value is EUR 1.00 per share (December 31, 2021: EUR 1.00). Details on the share are explained in the chapter "cyan share".

The following tables explain the weighted average of shares outstanding for the calculation of earnings per share.

Transaction date Shares outstanding Treasury shares Total shares Weighting (days) Weight. avg. of shares outstanding 31/12/2021 13,385,884 - 13,385,884 365 13,385,884 04/04/2022 1,503,816 - 1,503,816 271 1,116,532 03/11/2022 2,127,100 - 2,127,100 58 338,005 31/12/2022 17,016,800 - 17,016,800 14,840,421

Calculation of weighted average of shares outstanding 2022:

Calculation of weighted average of shares outstanding 2021:

Transaction date	Shares outstanding	Treasury shares	Total shares	Weighting (days)	Weight. avg. of shares outstanding
31/12/2020	9,774,538	-	9,774,538	365	9,774,538
28/02/2021	59,704	-	59,704	306	59,704
31/03/2021	61,011	-	61,011	275	45,967
30/04/2021	31,492	-	31,492	245	21,138
21/09/2021	2,481,686	-	2,481,686	101	686,713
23/11/2021	977,453	-	977,453	38	101,762
31/12/2021	13,385,884	-	13,385,884		10,689,822

The capital reserves result from payments made by the shareholders and conversion of convertible notes respectively. The other reserves include IAS 19 accruals and foreign currency reserves. The reserve made in accordance with IAS 19 originates from amendments to actuarial assumptions relating to a provision for severance pay the effects of which are disclosed in Other comprehensive income. The other reserves relate to currency differences arising from exchange rate differences from translation of the annual accounts of foreign subsidiaries.

[18] Financial liabilities

The non-current financial liabilities primarily comprise leasing liabilities, and also consist of utilized lines of credit. Interest has been applied to leasing liabilities at the incremental borrowing rate over the appropriate contractual term. Fixed rates of interest of 1.00 % and 0.75 % were applied to these lines of credit.

[19] Trade payables and pther liabilities

Other liabilities are broken down by maturity date, as follows:

in EUR thousand	31/12/2022	31/12/2021
Advance payments received	28	32
Trade payables	1,201	996
Trade accounts payable	1,229	1,028
Liabilities to employees	124	89
Social security contributions	900	1,839
Accruals and deferred income	265	277
Othera	1,813	1,991
Other current liabilities	3,101	4,196
Trade accounts payable and other current liabilities	4,331	5,224
Non-current liabilities	206	206
Trade accounts payable and other liabilities	4,537	5,430

^a Compared with the consolidated financial statements as of December 31, 2021, there were reclassifications in other liabilities.

Trade payables were all due within one year. Trade payables are not secured and are usually settled within 30 days of being recorded.

The social security contributions relate to social security expenses for the employees. The majority deferred income relates to the accrual of licenses. Other liabilities consist mainly of accruals for personnel costs (vacation, bonuses, etc.).

[20] Provisions

The provisions include the following items:

in EUR thousand	Personnel expenses	Consulting expenses	Other	Total
Book value at 01/01/2021	-	0	41	41
Use/resolution	-	-	65	65
Allocations to provisions	305	3	34	341
Book value at 31/12/2021	305	3	9	317
Use/resolution	305	0	39	344
Allocations to provisions	-	1	48	48
Book value at 31/12/2022	-	4	18	21

Compared to the consolidated financial statements as of December 31, 2002, there have been reclassifications of provisions, as accruals are now reported as liabilities and no longer as provisions.

The non-current provisions relate to the following provision for severance pay:

in EUR thousand	31/12/2022	31/12/2021
Present value of the severance payment obligation as of
01/01	7	7
Service cost for the period	-0	-
Interest expense	0	-
Severance payments	-	-
Revaluations from experience adjustments	6	-
Revaluations from changes in demographic assumptions	-	-
Revaluation from changes in financial assumptions	-2	-
Actuarial assumptions	-1	-
Currency difference	1	0
Present value of severance payment obligations as of 31/12	11	7

The provision for severance pay was established from actuarial calculations and involved assumptions about the discount rates applied, future increases in salary and mortality. No further information on actuarial assumptions is provided due to the immateriality of the provision. Future deviations from the assumptions taken can give rise to changes to the value of the provision. Due to the amount of the provision, since this would only have a very slight impact, a sensitivity analysis was waived.

Notes to the consolidated cash flow statement

The cash flow statement has been prepared using the indirect method. It shows the changes in cash and cash equivalents resulting from the inflow and outflow of funds during the reporting period and distinguishes between cash flows from operating, investing and financing activities. The funds reported in the cash flow statement are cash and cash equivalents.

[21] Cash flow from operating activities

The cash flow from operating activities shows the cash flows from the provision and acceptance of services during the reporting period and includes changes in current assets.

[22] Cash flow from investing activities

The cash flow from investing activities mainly comprises cash outflows for the purchase of tangible assets and intangible assets.

[23] Cash flow from financing activities

The cash flow from financing activities comprises capital increases and repayment of convertible notes as well as borrowings. Cash outflows for leases are also included.

The following table shows the changes in liabilities from financing activity:

		Other	31/12/2022
			2
			3,705
			2,952
			-
61	520	-1,473	6,659
-13 -1,494 -1,194 -2,450 -5,151	- - 61 -	Cash flows difference contracts - - 520 -	exchange New leasing - - -1,473 -

01/01/2021	Cash flows	Foreign exchange difference	New leasing contracts	Other	31/12/2021
					15
					5,199
					5,039
					2,450
9,806	2,757	69	182	-112	12,702
	6 3,650 6,150 -	9 1,549 -1,251 2,450	- - 69 -	- - 182 -	- - -112 -

Financial instruments and risk management

General information

The main financial instruments used by cyan are deposits, trade receivables, leasing liabilities, financing liabilities and trade payables. cyan does not use any derivative financial instruments.

cyan has to take account of the following risks:

• Liquidity Risk
• Credit / Solvency Risk
• Foreign Exchange Risk
• Change of Interest Rate Risk

Liquidity risk

The liquidity risk designates the risk of being unable to meet payment commitments through a lack of funds. Diligent liquidity risk management means having sufficient funds and an appropriate level of approved lines of credit in order to settle liabilities that fall due and to close market positions.

At the end of the reporting period, cyan held immediately available deposits at banks and at hand of EUR 5,349 thousand (31.12.2021: EUR 8,504 thousand) that manage liquidity risk at any time.

Liquidity at cyan depends primarily on payments from customers and until a positive cash flow is reached also from external funding. Since the majority of cyan's customers have settled their payment obligations in the past, and since there are no indications that this is going to change in future, cyan does not view its liquidity as being under threat. Through the acquisition of new customers, cyan assumes that its liquidity position will improve, hence the risk of cyan becoming unable to honor its payment obligations can be viewed as very low.

An analysis of the maturity of all liabilities existing on balance sheet date is shown below, which also illustrates the liquidity risk of cyan:

in EUR thousand	Up to 1 year	2-5 years	5 years
31/12/2022
Bank liabilities	2	3,705	-
Trade payables	4,331	-	-
Leasing liabilities	861	1,368	724
Other financial liabilities	-	-	-
31/12/2021
Bank liabilities	15	5,199	-
Trade payables	1,028	-	-
Leasing liabilities	1,207	2,399	1,433
Other financial liabilities	-	2,450	-

Convertible bonds were issued and partially converted in 2021. In 2022, the convertible bond program was terminated.

Credit and solvency risk

The solvency risk designates asset losses resulting from the non-fulfillment of contractual obligations by the business partners.

The cash and cash equivalents are primarily held at banks with a good credit rating. Balances are kept in current bank accounts. The credit risk is therefore low.

The contract assets and contract costs for the total amount of EUR 18.8 million relate to four customers (ACN/Flash Mobile, Virgin Mobile, Orange and iSolution/MTEL) which represent a cluster risk that is not collateralized. The Executive Board estimates the risk of failure for ACN/Flash Mobile, Virgin Mobile, Orange and iSolution/MTEL as small.

Receivables are classified as financial assets with impaired creditworthiness in cases where specific indications for an impairment exist (in particular serious financial difficulties on the part of the debtor, failure to pay or delayed payment, increased risk of insolvency). In cases where payments become overdue by more than 180 days, a provision is considered. Depreciation (a write-down) takes place when an inability to pay (insolvency) is established, or when a receivable is judged to be irredeemable for other reasons. In cases where the reasons for impairment cease to apply, a reversal takes place, up to the level of acquisition costs carried forward.

The maximum theoretical risk of failure equates to the receivables itemized in the balance sheet.

Since defaults varied greatly from one country to another, it has been decided not to view this situation in a group-based format. The following tables contain information about the risk of default and the recorded and expected credit losses for financial instruments, classified by geographical region:

Colombia

in EUR thousand	Loss rate	Gross book value	Value adjustment
2022
Not overdue	0.00%	92	-
1 -30 days overdue	0.00%	7	-
31 -60 days overdue	0.00%	44	-
61 -90 days overdue	0.00%	21	-
More than 90 days overdue	0.00%	18	-

2021
Not overdue	0.55%	128	1
1 -30 days overdue	0.59%	-	-
31 -60 days overdue	3.24%	-	-
61 -90 days overdue	6.91%	-	-
More than 90 days overdue	8.52%	184	16

Mexico

in EUR thousand	Loss rate	Gross book value	Value adjustment
2022
Not overdue	52.45%	24	12
1 -30 days overdue	58.08%	7	4
31 -60 days overdue	78.45%	-	-
61 -90 days overdue	97.75%	-	-
More than 90 days overdue	104.29%	43	44

2021
------

Not overdue	44.09%	42	18
1 -30 days overdue	49.00%	11	5
31 -60 days overdue	65.80%	10	7
61 -90 days overdue	71.54%	-	-
More than 90 days overdue	79.09%	2	1

Austria

in EUR thousand	Loss rate	Gross book value	Value adjustment
2022
Not overdue	0.11%	293	0
1 -30 days overdue	0.26%	64	0
31 -60 days overdue	0.47%	93	0
61 -90 days overdue	0.51%	4	0
More than 90 days overdue	0.60%	887	5

2021
Not overdue	0.99%	927	9
1 -30 days overdue	1.41%	821	12
31 -60 days overdue	2.91%	5	0
61 -90 days overdue	4.64%	-	-
More than 90 days overdue	5.98%	12	1

The loss rates take into account forward-looking aspects (such as macroeconomic changes) with a percentage markup.

Segments

The following table shows the value adjustments from trade receivables, contract assets and leasing receivables arranged by segment:

	BSS/OSS		Cybersecurity
in EUR thousand	2022	2021	2022	2021
Value adjustment IFRS 9	-8	-111	-	-
Currency difference	-	-	-	-
Other specific allowances	28	386	-	-
Write-offs of accounts receivable	287	18	-	33
Value adjustments	307	293	-	33

Value adjustments as defined in IFRS 9 have performed as follows in the 2022 balance sheet:

in EUR thousand	BSS/OSS	Cybersecurity
Value adjustments 01/01/2021	176	-
Allocation	25	-
Dissolution	-136	-
Currency difference	-5	-
Foreign currency valuation	10	-
Value adjustments 31/12/2021	70	-
Value adjustments 01/01/2022	70	-
Allocation	26	-
Dissolution	-33	-
Currency difference	-	-
Foreign currency valuation	5	-
Value adjustments 31/12/2022	68	-

In 2021, contract assets have changed as follows:

in EUR thousand	BSS/OSS	Cybersecurity
Contract asset value 01/01/2021	17,522	-
Allocation	2,663	286
Dissolution	-3,394	-
Contract asset value 31/12/2021	16,791	286
Contract asset value 01/01/2022	16,791	286
Allocation	2,408	598
Dissolution	-5,150	-
Contract asset value 31/12/2022	14,049	884

^a Compared with the consolidated financial statements as of December 31, 2021, there were reclassifications in contract assets.

Foreign exchange risk

Foreign exchange risk is defined as the potential loss resulting from fluctuating exchange rates. Because of the international nature of its business, cyan is exposed to certain foreign exchange risks. The finance department of the company constantly monitors these risks, and in particular the foreign exchange risks, to enable it to respond appropriately. In the event of a substantial foreign exchange risk arising at short notice, this could have adverse implications for the asset, financial and earnings position of cyan.

On the reporting date, cyan holds contract assets to the value of USD 14.5 million (2021: USD 18.3 million) that are subject to a foreign exchange risk. Changes to the exchange rate can have an impact, positive or negative, on earnings. A change in the value of the USD of 5 % that the management views as a reasonable possible change in the exchange rate has an impact on earnings to the value of EUR 0.7 million (2021: EUR 0.8 million).

Wherever expense items and investment items are not denominated in Euro, fluctuations in exchange rates can impair cyan's ability to meet its financial obligations and/or can adversely affect the earnings position of cyan. In summary, due to the low level of expenditure in non-euro currencies, this risk can be classified as limited, and it is therefore not quantified.

Interest rate risk

The interest rate risk is defined as the risk of interest charges and/or earnings changing in an adverse manner. All loans have fixed interest rates so the change of interest rate risk can be classified as minimal, and no sensitivity analysis was conducted.

Capital management

Information relating to the earnings, financial and asset position (capital management) of cyan is provided in the management report.

Other explanations

Related parties and people

There are no transactions with related companies, as all subsidiaries are fully consolidated and the transactions are therefore eliminated. On February 28, 2022, Markus Cserna, Executive Board member of cyan AG, announced a directors' dealing in accordance with Art. 19 MAR for the sale of 86,097 shares.

Information on the compensation of the Executive Board and the Supervisory Board

Remuneration of the members of the Executive Board

As of December 31, 2021 the Executive Board of cyan AG comprises the following members:

• Frank von Seth (since 01/01/2021)
• Markus Cserna
• Martin Wachter (since 01/12/2021 until 15/12/2021)

The compensation of the members of the Executive Board of cyan AG comprises the following components:

in EUR thousand	Current remuneration 2022			Current remuneration 2021
	fixed	variable	Total	fixed	variable	Total
Frank von Seth	91	-	91	101	-	101
Markus Cserna	68	-	68	63	-	63
Michael Sieghart	-	-	-	92	67	159
Martin Wachter	-	-	-	3	-	3
Total remuneration	159	-	159	258	67	325

The compensation of the Executive Board consists of fixed salaries and one-time bonuses. In previous years, it was agreed that the Executive Board members would receive a target bonus. In 2021, the current Executive Board members revoked the existing bonus arrangements. No new bonus arrangements were made in 2022. Mr. Wachter received a severance payment of EUR 78 thousand in 2022.

The Executive Board members also receive remuneration from subsidiaries that is not included in the above disclosures. The remuneration of the members of the Executive Board of cyan AG, which originates from subsidiaries, breaks down as follows.

in EUR thousand	Current remuneration 2022			Current remuneration 2021
	fixed	variable	Total	fixed	variable	Total
Frank von Seth	255	-	255	235	-	235
Markus Cserna	216	-	216	293	-	293
Michael Sieghart	-	-	-	228	-	228
Martin Wachter	-	-	-	7	-	7
Total remuneration	471	-	471	761	-	761

Besides the regular fixed remuneration, benefits in kind total EUR 21 thousand (2021: EUR 39 thousand) and cash expenses total EUR 3 thousand (2021: EUR 7 thousand). Mr. Wachter received a severance payment of EUR 182 thousand in 2022.

Compensation of the members of the Supervisory Board

The members of the Supervisory Board of cyan AG are:

• Stefan Schütze
• Lucas Prunbauer
• Alexandra Reich (since 23/06/2021 until 15/03/2023)
• Trevor D. Traina (since 23/06/2021 until 22/06/2022)
• Adrian Shatku (since 07/01/2022 until 22/06/2022)

The members of the Supervisory Board of cyan AG received the following remuneration:

in EUR thousand	Period of appointment	2022	2021
Gerd Alexander Schütz	05/01/2021 -31/12/2021	-	40
Stefan Schütze	01/01/2018 - 31/12/2022	60	30
Lucas Prunbauer	30/11/2018 - 31/12/2022	40	30
Alexandra Reich	23/06/2021 -15/03/2023	30	30
Trevor D. Traina	23/06/2021 -22/06/2022	15	30
Adrian Shatku	07/01/2022 -22/06/2022	14	-

Details on employees

The average number of employees during the financial year 2022 was 136 (2020: 150). The composition of personnel expenses can be found in Note 4, Personnel expenses.

Contingent liabilities

Contingent liabilities comprise guarantees for rental deposits and credit cards and amount to EUR 1,008 thousand as of the reporting date (Dec. 31, 2021: EUR 1,499 thousand).

Prüfungshonorar

The expenses for the auditor of the consolidated financial statements attributable to the financial year are itemized as follows:

in EUR thousand	2022	2021
Expenses for audit services	215	174
thereof from previous years	55	12
Expenses for other certification services	-	-

Significant events after the balance sheet date

The date of approval of the consolidated financial statements by the Executive Board in accordance with IAS 10.17 is April 24, 2023. These consolidated financial statements are subject to the approval of the Supervisory Board (Section 171 (2) AktG). Between the balance sheet date of December 31, 2022 and the date of the approval for release, new customers were acquired and a capital increase against contribution in kind was resolved. Details are provided in the "Subsequent Events" section of the Group Management Report.

Frank von Seth CEO

Markus Cserna CTO

H2 Headline Zweite Zeile Assurance by the Legal Representatives

We assure that, to the best of our knowledge, the consolidated financial statements convey a true and fair picture of the actual assets, financial and earnings positions of the Group, in accordance with the applicable accounting principles and that the representations in the management report on the business performance, including on the results and the position of the Group are such that an image is provided that is a true and fair reflection of the actual conditions and that the essential risks and opportunities in terms of expected development of the group are described in it.

Munich, in April 2023

Executive Board of cyan AG

Frank von Seth CEO

Markus Cserna CTO

Independent Auditor's Report

This is a convenience translation of the German original. Solely the original text in the German language is authoritative.

To cyan AG, Munich,

[Audit] Opinions

We have audited the consolidated financial statements of cyan AG and its subsidiaries (the Group), which comprise the consolidated statement of financial position as at 31 December 2022, and the consolidated statement of comprehensive income, consolidated statement of changes in equity and consolidated statement of cash flows for the financial year from 1 January to 31 December 2022, and notes to the consolidated financial statements, including a summary of significant accounting policies. In addition, we have audited the group management report of cyan AG, which is combined with the management report of cyan AG ("combined management report"), for the financial year from 1 January to 31 December 2022.

In our opinion, on the basis of the knowledge obtained in the audit,

• the accompanying consolidated financial statements comply, in all material respects, with the IFRS as adopted by the EU, and the additional requirements of German commercial law pursuant to § [Article] 315e Abs. [paragraph] 1 HGB [Handelsgesetzbuch: German Commercial Code] and, in compliance with these requirements, give a true and fair view of the assets, liabilities, and financial position of the Group as at 31 December 2022, and of its financial performance for the financial year from 1 January to 31 December 2022, and
• the accompanying combined management report as a whole provides an appropriate view of the Group's position. In all material respects, this combined management report is consistent with the consolidated financial statements, complies with German legal requirements and appropriately presents the opportunities and risks of future development.

Pursuant to § 322 Abs. 3 Satz [sentence] 1 HGB, we declare that our audit has not led to any reservations relating to the legal compliance of the consolidated financial statements and of the combined management report.

Basis for the [Audit] Opinions

We conducted our audit of the consolidated financial statements and of the combined management report in accordance with § 317 HGB and in compliance with German Generally Accepted Standards for Financial Statement Audits promulgated by the Institut der Wirtschaftsprüfer [Institute of Public Auditors in Germany] (IDW). Our responsibilities under those requirements and principles are further described in the "Auditor's Responsibilities for the Audit of the Consolidated Financial Statements and of the Combined Management Report" section of our auditor's report. We are independent of the group entities in accordance with the requirements of European law and German commercial and professional law, and we have fulfilled our other German professional responsibilities in accordance with these requirements. We believe that the audit evidence we have obtained is sufficient and appropriate to provide a basis for our [audit] opinions on the consolidated financial statements and on the combined management report.

Other Information

The management board is responsible for the other information. The other information comprises the parts of the annual report obtained by us after the date of the auditor's report, with the exception of the audited consolidated financial statements and combined management report and our audit opinion.

Our [audit] opinions on the consolidated financial statements and on the combined management report do not cover the other information, and consequently we do not express an [audit] opinion or any other form of assurance conclusion thereon.

In connection with our audit, our responsibility is to read the other information and, in so doing, to consider whether the other information

• is materially inconsistent with the consolidated financial statements, with the combined management report or our knowledge obtained in the audit, or
• otherwise appears to be materially misstated.

If, based on the work we have performed, we conclude that there is a material misstatement of this other information, we are required to report that fact. We have nothing to report in this regard.

Responsibilities of the Management Board and the Supervisory Board for the Consolidated Financial Statements and the Combined Management Report

The management board is responsible for the preparation of the consolidated financial statements that comply, in all material respects, with IFRS as adopted by the EU and the additional requirements of German commercial law pursuant to § 315e Abs. 1 HGB and that the consolidated financial statements, in compliance with these requirements, give a true and fair view of the assets, liabilities, financial position, and financial performance of the Group. In addition, the management board is responsible for such internal control as they have determined necessary to enable the preparation of consolidated financial statements that are free from material misstatement, whether due to fraud or error.

In preparing the consolidated financial statements, the management board is responsible for assessing the Group's ability to continue as a going concern. They also have the responsibility for disclosing, as applicable, matters related to going concern. In addition, they are responsible for financial reporting based on the going concern basis of accounting unless there is an intention to liquidate the Group or to cease operations, or there is no realistic alternative but to do so.

Furthermore, the management board is responsible for the preparation of the combined management report that, as a whole, provides an appropriate view of the Group's position and is, in all material respects, consistent with the consolidated financial statements, complies with German legal requirements, and appropriately presents the opportunities and risks of future development. In addition, the management board is responsible for such arrangements and measures (systems) as they have considered necessary to enable the preparation of a combined management report that is in accordance with the applicable German legal requirements, and to be able to provide sufficient appropriate evidence for the assertions in the combined management report.

The supervisory board is responsible for overseeing the Group's financial reporting process for the preparation of the consolidated financial statements and of the combined management report.

Auditor's Responsibilities for the Audit of the Consolidated Financial Statements and of the Combined Management Report

Our objectives are to obtain reasonable assurance about whether the consolidated financial statements as a whole are free from material misstatement, whether due to fraud or error, and whether the combined management report as a whole provides an appropriate view of the Group's position and, in all material respects, is consistent with the consolidated financial statements and the knowledge obtained in the audit, complies with the German legal requirements and appropriately presents the opportunities and risks of future development, as well as to issue an auditor's report that includes our [audit] opinions on the consolidated financial statements and on the combined management report.

Reasonable assurance is a high level of assurance, but is not a guarantee that an audit conducted in accordance with § 317 HGB and in compliance with German Generally Accepted Standards for Financial Statement Audits promulgated by the Institut der Wirtschaftsprüfer (IDW) will always detect a material misstatement. Misstatements can arise from fraud or error and are considered material if, individually or in the aggregate, they could reasonably be expected to influence the economic decisions of users taken on the basis of these consolidated financial statements and this combined management report.

We exercise professional judgment and maintain professional skepticism throughout the audit.

We also:

• Identify and assess the risks of material misstatement of the consolidated financial statements and of the combined management report, whether due to fraud or error, design and perform audit procedures responsive to those risks, and obtain audit evidence that is sufficient and appropriate to provide a basis for our [audit] opinions. The risk of not detecting a material misstatement resulting from fraud is higher than for one resulting from error, as fraud may involve collusion, forgery, intentional omissions, misrepresentations, or the override of internal control.
• Obtain an understanding of internal control relevant to the audit of the consolidated financial statements and of arrangements and measures (systems) relevant to the audit of the combined management report in order to design audit procedures that are appropriate in the circumstances, but not for the purpose of expressing an [audit] opinion on the effectiveness of these systems.
• Evaluate the appropriateness of accounting policies used by the management board and the reasonableness of estimates made by the management board and related disclosures.
• Conclude on the appropriateness of the management board's use of the going concern basis of accounting and, based on the audit evidence obtained, whether a material uncertainty exists related to events or conditions that may cast significant doubt on the Group's ability to continue as a going concern. If we conclude that a material uncertainty exists, we are required to draw attention in the auditor's report to the related disclosures in the consolidated financial statements and in the combined management report or, if such disclosures are inadequate, to modify our

respective [audit] opinions. Our conclusions are based on the audit evidence obtained up to the date of our auditor's report. However, future events or conditions may cause the Group to cease to be able to continue as a going concern.

• Evaluate the overall presentation, structure and content of the consolidated financial statements, including the disclosures, and whether the consolidated financial statements present the underlying transactions and events in a manner that the consolidated financial statements give a true and fair view of the assets, liabilities, financial position and financial performance of the Group in compliance with IFRSs as adopted by the EU and the additional requirements of German commercial law pursuant to § 315e Abs. 1 HGB.
• Obtain sufficient appropriate audit evidence regarding the financial information of the entities or business activities within the Group to express [audit] opinions on the consolidated financial statements and on the combined management report. We are responsible for the direction, supervision and performance of the group audit. We remain solely responsible for our [audit] opinions.
• Evaluate the consistency of the combined management report with the consolidated financial statements, its conformity with [German] law, and the view of the Group's position it provides.
• Perform audit procedures on the prospective information presented by the management board members in the combined management report. On the basis of sufficient appropriate audit evidence we evaluate, in particular, the significant assumptions used by the management board as a basis for the prospective information, and evaluate the proper derivation of the prospective information from these assumptions. We do not express a separate [audit] opinion on the prospective information and on the assumptions used as a basis. There is a substantial unavoidable risk that future events will differ materially from the prospective information.

We communicate with those charged with governance regarding, among other matters, the planned scope and timing of the audit and significant audit findings, including any significant deficiencies in internal control that we identify during our audit.

Bielefeld, den 24. April 2023

Dr. Stückmann und Partner mbB Wirtschaftsprüfungsgesellschaft Steuerberatungsgesellschaft

(Gäbel) (Teipel) Wirtschaftsprüfer Wirtschaftsprüfer [German Public Auditor] [German Public Auditor]

H2 Headline Further Information

Zweite Zeile

Disclaimer

Statements on future events and developments

This report contains statements on future events and developments, based on current assessments of the management. Such statements are based on current expectations and certain assumptions and estimates made by the management. They are subject to risks, uncertainties and other factors that may cause the actual circumstances, including cyan's assets, financial and earnings positions, to differ materially or to be more negative than those expressly or implicitly assumed or described in these statements.

The business activities of cyan are subject to a number of risks and uncertainties that may cause statement, estimate or prediction in relation to future events and developments to be inaccurate. Statements on future events and developments must not be perceived as guaranties or assurances that such future events or developments will actually materialize.

Note on rounding

The figures in this report have been rounded in accordance with prevailing commercial principles. Consequently, rounding differences may occur. Therefore, the sum of the individual values shown may differ from the precisely shown total.

Gender-neutral formulation

In the interest of legibility, gender-differentiating formulations have been dispensed with throughout. The relevant terms apply to all sexes within the framework of equal rights. The shortened manner of speech has only editorial reasons and does not represent any evaluations on the part of cyan.

English translation

This English version has been translated based on the German report. In case of deviations, the German version prevails. The report is available for download in both languages in the Investor Relations section of the website.

ir.cyansecurity.com

Imprint

Publisher

cyan AG Theatinerstraße 11 80333 Munich Germany

VAT ID: DE315591576 HR Munich: HRB 232764

cyansecurity.com

ir.cyansecurity.com

i-new.com

Investor relations

cyan AG Investor Relations ir@cyansecurity.com

ir.cyansecurity.com

Graphic design/layout

cyan AG inhouse mit firesys

Focus on what matters most to you. We focus on keeping you safe.

cyan AG Fünf Höfe Theatinerstr. 11 80333 Munich www.cyansecurity.com