2024

Annual Report

Network Security Going beyond connection

Our network security solutions integrate seamlessly into existing infrastructures and offer telecom providers an efficient way to reliably protect their customers.

Endpoint Security

Reaching full digital potential Our endpoint security solutions can be flexibly integrated into existing service apps or deployed as a standalone solution - fully branded in our partners' style. For convenient digital security everywhere.

Child Protection Digital safety from day one

Today children grow up in a digital world - we make sure they can do so in a safe environment. This allows the younger generation to take their first steps into the digital world securely.

Our comprehensive cybersecurity solution for small and medium-sized businesses. Smart protection – easy to integrate, simple to use, and reliably running in the background. Enterprise-level security without the complexity.

This annual report is a convenience translation of the German original. The auditor's report is solely issued on the German original.

Please find the German original under the following link: ir.cyansecurity.com

Table of contents	4
Letter to the Shareholders	6
Report of the Supervisory Board	9
cyan share	14
Management report	18
Group fundamentals	19
Economic report	23
Opportunity and risk report	28
Forecast	33
Financial statements	34
Statement of comprehensive income	35
Balance sheet	37
Cash flow statement	39
Consolidated statement of changes in equity	41
Notes to the Financial Statements	42
Information about the company	43
Accounting principles	43
Segment reporting	57
Notes to the statement of comprehensive income	58
Notes to the consolidated balance sheet	67
Notes to the consolidated cash flow statement	79
Financial instruments and risk management	81
Other explanations	86
Independent Auditor's Report	89
Further Information	94
Disclaimer	95
Imprint	96

Letter to the Shareholders

Dear Shareholders,

In 2024, we made significant progress with the strategic realignment and transformation of cyan AG. Following the successful sale of our BSS/OSS segment at the beginning of the year, we focused entirely on our core business cybersecurity - a market with strong and sustained growth. The increased use of artificial intelligence and advancing digitalization are leading to a growing threat situation. This creates significant opportunities for cyan. We use artificial intelligence and machine learning for threat detection in targeted research projects. This enables us to strengthen our threat intelligence platform and effectively defend digital attacks such as phishing and ransomware attacks.

Encouraging business figures and operational progress

Our strategic realignment also had a positive impact on the key financial figures for the 2024 financial year. Group sales grew by 50 % year-on-year to EUR 7.1 million and were therefore at the upper end of our guidance range. The majority of this growth resulted from recurring revenue from existing and new customers, which underlines the high stability and predictability of our business model. We increased our end customer base by 86 % in the 2024 reporting year, once again exceeding the previous year's figure (2023: +71 %). This pleasing increase in sales - in combination with targeted cost savings, particularly in other expenses - led to a significant improvement in EBITDA to EUR -1.5 million. As announced, no further capital measures have been necessary to finance ongoing operations since the sale of the BSS/OSS business. In addition, we have already recorded a positive operating result for individual months. Most recently, the spin-off of the old division and all restructuring measures, such as the reduction of subsidiaries from 16 to five, were successfully completed.

Acquiring new customers, opening up new markets

In our operating business, we expanded existing partnerships and tapped into new market segments. With Orange Spain and Orange Belgium, we were able to realize successful product launches and thus acquire two important new customers from the Orange Group. In both markets, Orange offers our cybersecurity solutions in the business and private customer segments - integrated into tariffs and as a stand-alone value-added solution. We are also in ongoing talks with telcos in various countries to further expand our customer and end customer base. We are also in talks with banks and insurance companies to roll out our cyber security solutions in new markets.

Capital market rewards potential with strong share price performance

In 2024, the capital market also rewarded the new dynamic in the company's development. The cyan share price rose by around 150 %. We also attended several capital market conferences in Germany and abroad. The transformation that has been initiated and the company's growth trajectory were received very positively by market participants across the board, which confirms that we are on the right track. In addition to many conversations with investors, there were also exciting discussions with representatives of the press, who also recognize the high relevance of the topic of cybersecurity. In addition, we are currently covered by three renowned analysts, with Warburg Research recently initiating coverage. All research houses see further upside potential for the cyan share.

Further growth planned in 2025

With our strategic focus and operational development, we have created the basis for further growth in 2025. In the current financial year we launched "cyan Guard 360", a cybersecurity solution geared towards the needs of small and medium-sized companies (SMEs), which is used as a "first line of defense" and is integrated alongside existing antivirus solutions. SMEs in particular have limited resources for cybersecurity and are increasingly targeted by cyberattacks such as phishing. It is therefore particularly important for these companies to be able to rely on an efficient and costeffective solution.

Our goal remains to sustainably increase profitability and consistently tap into new market potential. This also includes making further investments, particularly in the go-to-market area with a larger and stronger sales team. The aim is to support customers more actively and enable better partnership-based support throughout the entire collaboration. We are focusing primarily on growth in our core telco business, where we continue to see great international potential, and on the sale of our new SME product.

Successful together - our thanks to all partners

Finally, we would like to thank our shareholders, employees, customers and suppliers for their excellent cooperation and support. Our progress is reflected in the business figures and gives us a very positive outlook for a successful future together.

With kind regards, Munich, May 2025

Thomas Kicker CEO

Markus Cserna CTO

Dear shareholders

In the 2024 financial year, the Supervisory Board of cyan AG duly and fully performed the duties incumbent upon it in accordance with the law and the Articles of Association. It dealt regularly and in detail with the situation and development of the company. To this end, the Supervisory Board regularly consulted with the company's Management Board and carefully monitored its activities. The Supervisory Board not only monitored but also supported the Management Board; in particular, the individual members of the Supervisory Board were available to the members of the Management Board for a regular exchange of ideas. It was noticeable that the two members of the Management Board not only worked together extremely professionally in the 2024 financial year for the benefit of the company, but also particularly harmoniously.

The Management Board informed the Supervisory Board cyclically, promptly and comprehensively in written and verbal form about the key aspects for the company and about current topics (see list of key topics below). Where the approval of the Supervisory Board was required by law, the articles of association or the rules of procedure for management decisions or measures, the Supervisory Board was involved in the process in good time, sometimes in the form of written circular resolutions. The cooperation between the Management Board and the Supervisory Board demonstrates a very trusting relationship, which does not impair the control function of the Supervisory Board, but benefits the company.

The composition of the Supervisory Board did not change in 2024. The Supervisory Board did not form any committees in the 2024 financial year either. There were no conflicts of interest on the part of Supervisory Board members in connection with their work for the company. It should be emphasized that the members of the Supervisory Board work extremely well together.

Meetings and resolutions

A total of twelve Supervisory Board meetings were held (two meetings twice on the same day) on the following dates:

February 22, 2024 (2 meetings)
April 19, 2024
April 22, 2024 (2 meetings)
May 21, 2024
May 27, 2024
July 11, 2024
August 12, 2024
September 17, 2024
November 14, 2024
December 2, 2024

These Supervisory Board meetings were generally held in person with the Supervisory Board members attending in person or in the form of video conferences, each with an acoustic and optical two-way connection in real time. Only one meeting of the Supervisory Board, namely that of November 14, 2024, was held in the form of a mere conference call.

In 2024, the Supervisory Board and the Management Board agreed on a - generally monthly - jour fixe, which is held in the form of a video or telephone conference and in which all Supervisory Board and Management Board members participate depending on their availability . It was held six times in 2024, on the following dates:

March 14, 2024
May 16, 2024
June 13, 2024
October 17, 2024
November 14, 2024
December 19, 2024

Outside of the twelve Supervisory Board meetings, the Supervisory Board passed four circular resolutions on the following days:

April 5, 2024
May 27, 2024
July 4/7, 2024
December 17, 2024

Between the Supervisory Board meetings and the dates of the jour fixe, the Supervisory Board was informed by the Management Board in written reports or by its Chairman or Deputy Chairman in telephone reports about particularly important projects and plans of the company.

The Deputy Chairman of the Supervisory Board, Mr. Lucas Prunbauer, had regular telephone contact with the auditors from Rödl & Partner GmbH Wirtschaftsprüfungsgesellschaft during the preliminary audit (December 2024) and during the main audit (February to April 2025 inclusive).

At its meetings in 2024 and when adopting its circular resolutions, the Supervisory Board focused on (essentially in chronological order)

the rules of procedure for the Supervisory Board,
the allocation of responsibilities among the members of the Board of Directors,
the reappointment of Management Board member Markus Cserna and the extension or revision of his Management Board contract,
the review of Management Board remuneration,
the audit of the accounting processes,
the 2024 budget,
handling the sale of the operations of I-New Unified Mobile Solutions GmbH,
the operating business of cyan Security Group GmbH (in each case with its ABC customers and on its ABC markets (sales, earnings and customer development) and the associated opportunities and risks,
Research & development, including the review by the tax office in connection with research grants,
Marketing and sales as well as public relations,
the shareholding structure,
regular target/actual comparisons (forecasts),
exchange rates,
of liquidity, liquidity planning, in particular with the assumptions and background to the individual items of liquidity planning and the probabilities that the assumptions will occur,
of the 2024 convertible bond,
the audit of the 2023 annual financial statements,
the preparation and follow-up of the 2024 Annual General Meeting,
the amendment to the Articles of Association in the course of the 2025 Annual General Meeting on the cancellation of the existing Authorized Capital 2023 and the creation of a new Authorized Capital 2024 with possible exclusion of subscription rights,
the question of whether ad hoc reports would be required due to specific circumstances,
Personnel matters, in particular the retention of key employees in the company,
Legal matters (legal advice and representation including legal disputes),
Insurance including D&O insurance,
the half-year report 2024,
the corporate strategy, the business model and the question of whether and, if so, which new business areas should be developed,
the 2025 budget

and

• the change of office at the Vienna location.

Annual and consolidated financial statements

The auditor elected at the Annual General Meeting on July 12, 2024 and appointed by the Supervisory Board,

Rödl & Partner GmbH Wirtschaftsprüfungsgesellschaft, Munich

issued a declaration of independence to the Executive Committee of the Supervisory Board on October 21, 2024 and to the Supervisory Board on April 25, 2025, audited the company's annual financial statements, consolidated financial statements and Group management report for the 2024 financial year and issued an unqualified audit opinion. In its audit report, the auditor explained the auditing principles. The auditor did not raise any objections to the annual financial statements, the consolidated financial statements or the Group management report.

Both the annual financial statements and the auditor's report for the separate and consolidated financial statements and the Group management report were made available to all members of the Supervisory Board in good time. The financial statement documents were discussed in detail at the Supervisory Board meeting on April 25, 2025 in the presence of Mr. Felix Haendel and Mr. Andreas Appelt from Rödl & Partner Germany. The Supervisory Board examined the annual and consolidated financial statements and the Group management report in detail. No objections were raised following this review. The Supervisory Board agreed with the results of the audit and approved the annual and consolidated financial statements prepared by the Management Board for the 2024 financial year on April 29, 2025. The annual financial statements were thus adopted unanimously. The consolidated financial statements were unanimously acknowledged by the Supervisory Board. The Supervisory Board agreed with the Group management report and the assessment of the company's further development.

Thanks to

The Supervisory Board was able to recognize that cyan has a number of highly motivated employees who are tirelessly and strongly committed to the company in addition to two particularly competent members of the Management Board. The Supervisory Board would like to thank the members of the Management Board and all employees worldwide for their energetic and successful commitment in the past year 2024 and the current financial year 2025 and looks forward with confidence to further fruitful cooperation.

The Supervisory Board also appreciates the loyalty of customers and the reliability of suppliers and would like to thank "Rödl & Partner GmbH Wirtschaftsprüfungsgesellschaft" in particular for the pleasant and professional cooperation.

Finally, the Supervisory Board is delighted with the trust and commitment of cyan's shareholders.

Vienna, April 29, 2025 For the Supervisory Board

Alexander Singer Chairman of the Supervisory Board

cyan-Share

Share price performance

Relative share price performancea January 1, 2024 - December 31, 2024 (rebased)b

a compared to the Scale All-Share Index b Xetra closing prices rebased to 100

cyan AG has been listed in the Scale segment (Open Market) of the Frankfurt Stock Exchange since March 2018. The Scale All Share Index, which covers the performance of all companies listed in the Scale segment, fell slightly by 7.8% in the reporting period. The cyan share opened at EUR 1.05 on January 2, 2024 (first trading day on Xetra) and closed at EUR 2.62 on December 30, 2024 (last trading day on Xetra). cyan shares therefore recorded a positive performance of 149.5% for the 2024 financial year. On October 30, 2024, the highest intraday price (Xetra) of the year was reached at EUR 2.90. The lowest daily low was recorded on January 11, 2024 at EUR 0.985. Based on the closing price of EUR 2.62 and the 20,189,486 bearer shares outstanding at that time, cyan AG's market capitalization as at December 31, 2024 was EUR 52.90 million.

	2024	2023
Share capital at the end of the period	20,189,486	20,189,486
Market capitalization at the end of the period (EUR million)	52.90	21.2
Period high (intraday)	2.90	2.16
Period low (intraday)	0.985	0.98
Opening price at the beginning of the period	1.06	1.395
(first trading day Xetra)
Closing price at the end of the period (last trading day Xetra)	2.62	1.05
Change (%)	+149.5	-24.7

Characteristics

WKN	A2E4SV
ISIN	DE000A2E4SV8
Ticker symbol	CYR
Trading segment	Open Market (Scale)
Stock exchange segment	Software
Marketplace	XETRA / Frankfurt
Class of shares	Bearer shares
Initial listing	28.3.2018
Initial issue price in EUR	23.0

Analyst coverage

As of December 31, 2024, there was research coverage of the cyan share by two analysts. Both issued a buy recommendation. Since March 2024, Alster Research has operated under the name mwb Research. At the beginning of April 2025, Warburg Research initiated coverage of cyan and gave the share a buy recommendation.

	Date	Target price	Recommen dation
mwb Research	14/03/2025	EUR 3.65	Buy
Warburg Research	03/04/2025	EUR 4.00	Buy
SMC Research	02/10/2024	EUR 4.40	Spec. Buy

Investor relations activities

In the 2024 financial year, cyan stepped up its capital market communication by attending more capital market conferences in Germany and abroad and organizing a round table. In addition to half-yearly financial reporting, investors and the public were also informed in a timely manner about current developments within the Group by means of corporate news and ad hoc announcements. A total of eleven capital market publications (directors' dealings, ad hoc) and corporate news were published in the reporting year. In addition, numerous investor calls and e-mail inquiries were answered. The Annual General Meeting of cyan AG was held as a virtual Annual General Meeting in Munich on July 12, 2024. All items on the agenda for resolution were adopted by a clear majority. Further details on the Annual General Meeting and the voting results are available on the website in the Investor Relations section.

ir.cyansecurity.com

Financial calendar

In the current year, cyan AG will continue to provide the capital market with more information on the course of business and will be represented at several analyst and investor conferences. In addition, several round tables and earnings calls are planned, about which the capital market will be informed in good time.

Date	Place
04/02/2025	Virtual
05/02/2025	Hamburg
15/05/2025	-
11/07/2025	Munich/Virtual
25/09/2025	-
24/-26/11/2025	Frankfurt

Current dates, upcoming events and news for 2025 are continuously updated on the Group website.

ir.cyansecurity.com/news-and-events

Management Report

of cyan AG, Munich for the fiscal year from January 1 to December 31, 2024

Group fundamentals

The cyan Group (XETR: CYR; hereinafter "cyan") is a provider of intelligent cybersecurity solutions with almost 20 years of experience in the IT industry. With its solutions, cyan protects millions of end customers from the dangers of the Internet such as phishing, malware and identity theft. The IT security products for end customers of mobile and fixed network internet providers, mobile phone providers and financial service providers are bundled under the "cyan digital security" brand. Four product types are marketed under the names OnNet Core, OnNet Plus, Endpoint/SDK and Child Protection. cyan's security solutions are integrated into the customer's infrastructure or via a cloud solution at the business partner, which then offers them in its own name ("white labeled") to its end customers as a value-added service ("B2B2C"). Contracts in the cybersecurity segment usually provide for a revenue share or software license model, which generates recurring revenue. The business is essentially made up of the cyan Security Group GmbH subgroup and has a global focus. cyan's customers include the Orange Group, Magenta Austria and T-Mobile Poland (Deutsche Telekom/T-Mobile), Claro Chile (América Móvil Group) and dtac (Telenor Group).

OnNet Security

OnNet Security is cyan's fully network-integrated cybersecurity solution, which is used, for example, in the regional networks of Orange or Deutsche Telekom. The DNS-based filter is directly integrated into the network infrastructure of the respective mobile network operator (MNO), allowing them to generate revenue with their end customers through additional packages and at the same time strengthen their own brand with a white-label approach from cyan. cyan either receives a monthly license fee per active end customer for providing the cybersecurity solution or receives a direct percentage of the revenue.

Using cyan technology, unwanted data packets are filtered out of the data stream, which can lead to significant cost savings and is sometimes necessary to meet compliance requirements. In addition to blocking dangerous websites, cyan technology can also block background trackers and advertisements that load in the background, thereby improving the customer's surfing experience, reducing the amount of data consumed and increasing security on the Internet. Thanks to the data reduction of the Clean Pipe DNS solution, network operators are also confronted with a lower number of network load peaks, which can save their investments in the network.

Since the beginning of 2024, two product variants have been offered, OnNet Core, which ensures much faster implementation, and OnNet Plus with greater customization and additional analytics and reporting functions.

Endpoint/SDK Security

cyan's Endpoint Security provides an additional layer of security that is installed directly on the end user's device. End users protect their smartphone via an app - this can either be offered as a stand-alone app or integrated into an existing app using an SDK. In addition to the cybersecurity filter, it has additional features such as identity and website checks or virus scanners. They are connected to the cyan filter system, which is implemented in the partner's infrastructure, stationary or via the cloud. The app is a stand-alone solution and is often sold to customers as a premium extension to the OnNet Security solution based on the same model.

Child Protection

The Child Protection solution gives parents the tools they need to optimally protect their children from online dangers. Personal profiles can be created for each child in a central menu. The app offers age-dependent default settings that can be easily and individually adjusted by parents. The solution is sold as a white label solution primarily to telecommunications companies, which offer it to their customers as an additional package (B2B2C).

Group structure

cyan AG, based in Munich (Germany), acts as a holding company within the cyan Group. The majority of operational services are provided by the subsidiary cyan digital security GmbH (formerly i-new Unified Mobile Solutions GmbH) and its subsidiary cyan Security Group GmbH, both based in Vienna (Austria). As at the reporting date, cyan was represented in three countries by its own local subsidiaries. In addition, sales and service hubs are operated worldwide. In the 2024 financial year, three companies were closed in Argentina, Brazil and Ecuador as part of the streamlining of the Group. cyan Licensing GmbH in Austria is currently in liquidation. Further information on the scope of consolidation as at the respective reporting date is explained in the notes.

i-new Unified Mobile Solutions GmbH was renamed cyan digital Security GmbH in the reporting year. The entry was made in the company register on January 10, 2024.

Financial performance indicators

The key Group performance indicators and significant financial performance indicators in the past financial year were revenue and EBITDA, as reported in the consolidated financial statements. As a growth company, the (operating) cash flow and, subsequently, the net liquidity of the individual subsidiaries are also considered. In addition to the financial performance indicators, other financial indicators such as recurring revenue (monthly and annual) are also taken into account. These reflect the sustainability and stability of cyan's business model. Non-financial indicators, in particular the number of employees and the development of the number of end customers, are also used in the operational management system. These management indicators and performance indicators are also used in internal reporting.

Research and development

Research and development play a key role in securing the Group's competitiveness and sustainable success. There is a lively exchange with research institutions that are researching various areas of internet security, such as threat detection with new approaches, the use of artificial intelligence (AI) and the analysis of internet traffic using machine learning (ML). In 2024, cyan launched two new research projects in collaboration with its long-standing research partner Secure Business Austria: "AI4SEC: AI-based phishing detection and protection of mobile users" and "LLM4CTI: Large Language Models for Cyber Threat Intelligence". These projects form the core of the threat intelligence research program, which aims to improve cyan's threat detection and classification capabilities. In addition, the projects aim to explore the potential of large language models (LLMs) to automate data analysis and contextualize information from different sources, minimizing the need for manual analysis. By integrating LLMs into the threat intelligence framework in the medium term, cyan's security products will provide more proactive, intelligent and efficient protection against evolving cyber threats.

Research and development expenses amounted to EUR 3.0 million in total. This comprises direct costs for research and development (EUR 0.8 million), direct personnel costs for research and development (EUR 1.3 million), overhead costs for research and development (EUR 0.9 million) and financing expenses (EUR 0.004 million) less grants already received from research projects in 2024 (EUR 0.07 million). These total expenses decreased by 35.5% compared to the previous year (2023: EUR 4.6 million). The research and development ratio (development expenses in relation to Group sales) amounted to 41.8% (2023: 39.3%) and remained at a similar level. cyan received funding in the form of research grants for research projects. Further information on the recognition of intangible assets and development costs can be found in the notes to the consolidated financial statements.

In TEUR	2024	2023
R&D expenditure	2,966	4,598

Personnel development

As a company in the knowledge-intensive IT and software sector, highly qualified employees are one of the most important factors for cyan's long-term success. Great importance is attached to selecting the right employees and their further development. As of December 31, 2024, cyan employed 49 people. This corresponded to approximately 41.3 FTEs. A significant proportion of employees work in the areas of operations, development, product management and research and development. Globally, women accounted for just under 30% of the workforce.

as of 31.12.2024	Total	EU	rest of the world
Personnel	49	47	2
of which in Operations, Development, Research 27		27	0

Economic report

Economic framework conditions

In 2024, the global economy experienced moderate growth, which was mainly driven by the emerging markets and the United States. In many industrialized countries, however, more restrictive financing conditions and considerable geopolitical uncertainties had a dampening effect on economic activity. Despite these challenges, the global labour market remained robust, which helped to stabilize consumer demand. Economic growth weakened in the Eurozone in 2024, particularly in the industrial sector, which suffered from high input costs and lower global demand. The service sector, on the other hand, experienced a slight upturn. The labor market proved resilient, with the seasonally adjusted unemployment rate standing at 6.3 % at the end of the reporting year, a slight decline compared to December last year.1 Inflation in the Eurozone continued to decrease in 2024. In December 2024, the overall inflation rate was 2.7 %, down from 3.4 % in December 2023.2 This decline was mainly due to falling energy prices, while domestic price pressure remained elevated due to rising nominal wages. The European Central Bank (ECB) eased its monetary tightening policy from June 2024 onwards and continuously lowered the key interest rate over the course of the year to 3.15 % in the end.3 In summary, 2024 was characterized by moderate global growth, a significant reduction in inflation in the Eurozone and an easing of monetary policy by the ECB, while international institutions such as the International Monetary Fund (IMF) intensified their support to overcome economic challenges.4

Industry-related framework conditions

Telecommunications sector

The European telecommunications sector made further progress in 2024, particularly in 5G expansion and digitalization. According to the Ericsson Mobility Report 2024, Europe remains a key driver for the further development of network infrastructure. By 2030, 92 % of mobile users in Western Europe are expected to be using 5G, creating the basis for innovative digital services and new business models. Mobile data traffic continues to grow strongly - increasing by 21 % between the third quarter of 2023 and the third quarter of 2024 alone. This increase demonstrates the growing demand for high-performance networks that open up new opportunities for both consumers and businesses in areas such as IoT, Smart Cities and Industry 4.0. Telecommunications companies in Europe are continuously investing in a powerful and secure digital infrastructure. These investments not only strengthen the competitiveness and innovative power of the industry, but also support companies in other sectors in their digital transformation.5

Cybersecurity

According to the Allianz Risk Barometer 2024, cyber incidents such as phishing and ransomware attacks, data leaks and IT outages are considered the biggest business risk worldwide. 36 % of companies surveyed cited cyber incidents as their main concern, followed by business interruption at 31 %. The growing dependence on digital

¹ Eurostat

² Eurostat

³ European Central Bank

⁴ International Monetary Fund (IMF)

⁵ Ericsson Mobility Report 2024

systems and geopolitical instability increased the risk of disruption to critical infrastructure, prompting companies to strengthen their cyber defense strategies.6 In Europe, initiatives such as the ENISA Telecom & Digital Infrastructure Security Forum 2024 were launched to promote the exchange of security threats and best practices. In addition, policy measures such as the NIS2 Directive and the Cyber Resilience Act have been discussed to increase security in the telecommunications sector. These developments underline the need for European companies to continuously evaluate and adapt their cyber defense measures to meet the increasing threats.7

Business performance of the Group

At the beginning of 2024, Thomas Kicker, who has many years of experience in the telecommunications industry, took over as CEO. As CCO of T-Mobile Austria, he was the driving force behind cyan's first major customer contract. In his last two professional positions at Palantir and blackshark.ai, he drove market and product development in very dynamic and challenging markets and thus contributed significantly to the companies' customer and sales growth. The new Management Board launched a strategy program in the company in the first months of 2024. As a result, a completely revamped product portfolio was presented, which guarantees faster implementation times. Furthermore, the Group's cost structure and complexity were simplified, a new market access strategy was developed and new research and development projects were initiated.

In the operating business, another major customer from the Orange Group, Orange Spain, was launched in the first quarter. The partnership comprises a range of network-integrated and terminal-based products for mobile devices. The products are available for both the business and private customer segments. In the further course of business, the partnership with wefox in Austria in cooperation with Allianz Partners opened up a new business segment for cyan. For the first time, cyber security solutions have not only been offered to end customers of telecommunications companies, but also integrated into an insurance solution. The aim is to protect customers from a cyberattack in advance to prevent an insurance claim. The launch with Orange Belgium was finally announced in the 4th quarter. Orange Belgium is relying on cyan's products to be one of the first providers in the Belgian market to offer its customers effective protection against the many dangers of the Internet. The products will be integrated into tariffs and offered as a value-added service.

These new customer acquisitions and solid development among existing customers in the reporting period contributed to a further increase in the number of end customers. Overall, the end customer base increased by 86 % in 2024. Monthly recurring revenue also increased steadily as a result. In addition, the project teams were kept busy with work including the expansion of cooperation with the Orange Group in existing and new countries and preparations for the launch at Claro Chile. In addition, a new product was developed for SMEs that provides targeted protection against cyber-attacks for small and medium-sized enterprises.

⁶ Allianz Risk Barometer 2024

⁷ ENISA Telecom & Digital Infrastructure Security Forum 2024

Results of operations, net assets and financial position of the Group

Earnings situation

Revenue and costs

Consolidated operating revenue amounted to EUR 7.1 million in the 2024 financial year (2023: EUR 4.7 million), an increase of 50 %. Revenue was therefore in the upper half of the forecast range of EUR 6.6 million to EUR 7.4 million. This is due to solid growth among existing customers and the launch of Orange Spain and Belgium as new customers. The share of recurring revenue, which includes revenue from subscriptions and recurring service and maintenance fees, amounted to 95%. In addition to revenue, the Group generated Other Operating Income of EUR 0.4 million (2023: EUR 0.8 million). This mainly includes income from research grants for research services. Further details on research are explained in the section on research and development on page 21.

Despite the increase in sales, the cost of materials and purchased services remained almost unchanged at EUR 1.3 million (2023: EUR 1.3 million) due to economies of scale. Personnel costs rose slightly from EUR 5.1 million in 2023 to EUR 5.3 million in the 2024 financial year as a result of collective agreement increases. Other expenses fell from EUR 3.0 million in 2023 to EUR 2.4 million in 2024. This was primarily due to the legal and consulting costs incurred in 2023 in connection with the sale of i-new.

EBITDA

EBITDA improved significantly compared to the 2023 financial year from EUR -4.5 million to EUR -1.5 million, as forecasted. Depreciation and amortization remained at a similar level of EUR 2.5 million and mainly related to intangible assets.

EBIT and annual result

The loss from operating activities (EBIT) for the reporting period improved to EUR -4.0 million (2023: EUR -7.0 million) due to the aforementioned progress in the operating business. The sum of financial income and financial expenses amounted to EUR -0.006 million (2023: EUR -0.03 million), resulting in earnings before taxes of EUR -4.0 million (2023: EUR -7.0 million). Taxes on income amounted to EUR 0.3 million in 2024 (2023: EUR 1.7 million). The reduction is mainly due to the change in deferred income taxes. As a result, earnings after taxes from continuing operations amounted to EUR -3.7 million (2023: EUR -5.3 million). Total earnings after taxes amounted to EUR -3.8 million (2023: EUR -20.7 million), whereby the improvement is mainly due to the positive operating developments in the continuing operations as well as the discontinuation of the loss-making operations, which had burdened earnings with high impairment losses in the previous year. Accordingly, basic earnings per share from continuing operations amounted to EUR -0.17 (2023: EUR -0.28) and from discontinued operations to EUR -0.00 (2023: EUR -0.82). Basic earnings per share for both divisions amounted to EUR -0.17 (2023: EUR -1.10).

Financial position

Total assets decreased from EUR 43.7 million as at December 31, 2023 to EUR 32.7 million as at December 31, 2024. This is due to the disposal of assets in the course of the i-new sale in the amount of EUR 6.6 million and the reduction in intangible assets by EUR 2.1 million due to amortization. At 79 % (December 31, 2023: 64 %), they continue to represent the majority of assets and amount to EUR 25.9 million (December 31, 2023: EUR 28.1 million). Property, plant and equipment remained almost unchanged at EUR 1.9 million (31/12/2023: EUR 2.1 million), which is why total non-current assets amounted to EUR 27.8 million (31/12/2023: EUR 30.2 million). Current assets decreased by EUR 2.1 million mainly due to the reduction in cash and cash equivalents and amounted to EUR 4.9 million (31/12/2023: EUR 6.9 million).

More detailed explanations of individual balance sheet items can be found in the notes to the consolidated financial statements.

Financial position

Capital structure

Equity amounted to EUR 28.1 million as at December 31, 2024 (December 31, 2023: EUR 32.0 million). The reduction is due to the loss for the period of EUR 3.7 million. The equity ratio was 86 % (December 31, 2023: 73%). At the end of 2023, a convertible bond in the amount of EUR 1.5 million was issued, which could be converted until the end of 2024. The conversion price per share was EUR 1.00. A total of 1,488,720 new shares were issued, which were entered in the commercial register at the beginning of 2025. Non-current liabilities decreased slightly to EUR 2.1 million (31.12.2023: EUR 2.7 million). The decrease in current liabilities totaling EUR 3.0 million is largely due to the cancellation of the purchase price prepayment through payment after 31 December 2023. Cash and cash equivalents amounted to EUR 0.8 million as at December 31, 2024 (December 31, 2023: EUR 2.9 million). The disposals result from the negative operating result.

Cash flow

Net cash flow from operating activities before taxes improved to EUR -3.8 million in the 2024 financial year (2023: EUR -4.1 million). This includes the net cash flow from operating activities of the discontinued operation in the amount of EUR -2.0 million, which is why the net cash flow from the existing operation amounted to EUR -1.8 million in 2024. The improvement is due to higher customer payments received as part of the increase in revenue and consistent cost management in 2024. In principle, the provision of cybersecurity solutions requires only minor investments. However, the disposal of discontinued operations less cash and cash equivalents sold resulted in a cash inflow, which is why cash flow from investing activities amounted to EUR 1.1 million in total (2023: EUR -0.5 million). The cash outflow from financing activities amounted to EUR 0.3 million in the reporting period (2023: cash inflow of EUR 2.9 million). This includes cash outflows for leases in accordance with IFRS 16. The change from convertible bonds was almost entirely offset by the issue of new shares from the convertible bond.

In total, there was a net cash flow of EUR -3.0 million in the 2024 financial year (2023: EUR -1.6 million), as operating expenses still exceeded income. This includes the net cash flow from discontinued operations of EUR -0.9 million, which is why the net cash flow from continuing operations amounted to EUR -2.1 million. Due to its access to cash and cash equivalents, the Group was able to always meet its payment obligations despite the losses. The cash and cash equivalents were mainly used to finance ongoing operations.

Overall statement

Overall, the Group closed the 2024 financial year with earnings after taxes of EUR -3.8 million (2023: EUR -20.7 million). An operating margin (EBITDA) of EUR -1.5 million was achieved (2023: EUR -4.5 million), which corresponds to a significant increase on the previous year. In particular, the solid development of existing

customers, which increased by 86 %, and the expansion of the cooperation with the Orange Group in Spain and Belgium contributed to the 50 % increase in revenue compared to 2023. Nevertheless, the increase in expense items could not yet be fully compensated for. However, the Group's solvency was secured at all times during the reporting period. Despite the loss, the Management Board considers the business performance in the 2024 financial year to be positive, not least due to the growing number of end customers, two significant new customer wins with Orange Spain and Belgium, and the significant increase in revenue. The loss was also significantly reduced.

Opportunity and risk report

Risks

At cyan, risks are aggregated into three categories - significant risks, moderate risks and low risks. These categories are based on the internal structure of the risk discussion, which is also conducted in meetings with the Management Board and the responsible divisional managers and reported to the Supervisory Board. Significant risks represent risks with a higher probability of occurrence, while moderate risks are possible but not very likely. Low risks are very unlikely to occur.

Operational risk (low risk)

As a matter of principle, cyan's solutions aim for failure-free operation. In doing so, cyan is dependent on its partners, including data center and network operators, who act as integration and sales partners. This means that cyan, or the customers from whom cyan receives a fee for each active end customer (subscriber), is dependent on the functionality of the infrastructure. Even short-term poor service can affect end customer satisfaction. In the event of a failure of the platform/software itself or of one or more suppliers (e.g. data centers), this can lead to a standstill of operations and unprotected end customers, which in turn can lead to a reduction in the number of end customers and, if cyan is at fault, to claims for damages. To prevent failures, cyan relies on several data centers, an appropriately qualified operations team and continuous monitoring of the systems.

Attracting and retaining highly qualified employees is a key success factor for the entire technology and software industry. Key employees, particularly in the areas of cybersecurity research, development and operations, but also sales, are essential for the development, distribution and implementation of solutions thanks to their knowledge, skills and contacts. Unemployment figures are still quite low - this shortage of personnel can lead to positions remaining unfilled for longer periods of time and increase the effort involved in recruiting and retention. Increased marketing as a strategic goal of the Management Board will not only improve the perception of cyan among direct customers, partners and end users, but will also make it easier to recruit staff.

Competition risk (moderate risk)

The market for cybersecurity is characterized by above-average growth with continued strong growth forecasts. This makes new market entries relatively attractive for start-ups and established providers despite high barriers to entry. cyan was able to position itself early on with its cybersecurity technology and still sees itself in a window of opportunity, driven by publicly known cyber incidents and at the same time the goal of telecom companies to grow through relevant additional services. No direct competitor currently has solutions on the market that combine network and devicebased cybersecurity in the form of an in-house solution. The current technological competitive edge is illustrated by the leading international customer references.

Technological risk (low risk)

In the fight against cybercrime and threats on the Internet, cyan is not only exposed to continuous competition with other companies, but also to a race with cybercriminals. Among other things, cyan develops network-integrated, highly complex cybersecurity solutions for the detection of potential threats such as phishing, malware or identity theft for users of smartphones and tablets. By using machine learning and artificial intelligence in the threat analysis processes, cyan can react promptly to new threats. Nevertheless, there is a risk that cyan will not react in time to technical progress or changing requirements for cybersecurity products and services or the entire cybersecurity market. Risks are also reduced through active research and development. In addition, any software can have bugs and gaps. cyan also uses software components (e.g. libraries) from third parties and open source code for development and in its own products, which contain a residual risk in terms of compatibility and security despite extensive testing in advance. In order to maintain its market position, the company is constantly developing and optimizing its products and investing in research and development (see also Research and development). In addition, an extensive information security management system has already been established to monitor risks, particularly in connection with data processing.

Reputation and brand risk (low risk)

cyan's direct customers are mostly large international corporations that entrust cyan with the security of their end customers' data traffic. Professional implementation and ongoing operation are important criteria by which technology companies like cyan are measured. The launch of the solutions at several internationally renowned customers such as Orange, T-Mobile and dtac has made a significant contribution to cyan's strong reputation. The cybersecurity solutions are offered "white-labeled", so it is crucial to ensure the best possible protection for end customers' mobile devices, as any damage to the partner's reputation could fall back on cyan. Equally important is the medium and long-term marketing success. Targeted marketing is intended to further emphasize the strengths of the solutions with direct partners and potential customers, thereby supporting sales. Subsequently, penetration rates among existing customers should also be increased as a result of increased awareness among end consumers. This results in a risk from the strategic orientation of the measures.

Market concentration on the customer side (low risk)

The market for telecommunications providers is characterized by an oligopoly, which is why the majority of cyan's revenues are attributable to a few major customers, as shown in Note 1 to the consolidated financial statements. However, the barriers to market entry are high and a short-term loss of customers is unlikely due to longterm framework agreements, so that cyan currently considers the risk to be acceptable. However, should major customers decide to switch providers at the end of the contract terms in the future, this could have a negative impact on earnings. However, the Management Board plans to further reduce the risk in the future through further growth and new customers.

Financial risks

Financial risks primarily include default and credit risk, liquidity risk, interest rate risk and currency risk. Further information on financial risks can be found in the Notes.

Default and credit risk (low risk)

The Management Board is endeavoring to place sales on a broader basis, in particular by concluding contracts with new customers from other regions. The current economic situation increases the risk of one or more customers becoming insolvent. Effective systems are in place to monitor creditworthiness. The debtor-side default risk is reduced due to the increasingly diversified portfolio.

Liquidity risk (moderate risk)

cyan uses rolling financial and liquidity planning to determine liquidity requirements. Care is taken to ensure that sufficient cash and cash equivalents are available at all times to settle liabilities due at the companies, and cash equivalents are held at banks with a very high credit rating. The Group had cash and cash equivalents of EUR 0.8 million as at December 31, 2024. The future liquidity situation at cyan depends largely on payments from customers and therefore the development of sales. By gaining new customers, the Management Board assumes a stable future liquidity position, although cyan is also dependent on marketing by its partners. Based on the steady subscriber growth among existing customers in the cybersecurity segment and new customer projects in the 2024 financial year, the Management Board assumes that revenue will most likely increase significantly compared to the previous year, as shown in the forecast, and that the cash and cash equivalents generated in this way will be sufficient to cover the ongoing financial requirements. Nevertheless, project delays could occur, for example, as a result of which individual projects may only generate revenue with a delay and thus generate cash flows at a later date, existing customers may default entirely or the planned revenue growth may not materialize due to a lower number of end customers. Consequently, there is a residual risk that cash flows will not occur as planned. The option of a short-term factoring program is planned as a means of bridging potential liquidity bottlenecks. In the event of further financing requirements, e.g. to implement strategic projects or in the event of unforeseen adverse economic developments, the company would be reliant on external financing in the forecast period. However, the Management Board assumes that the Group and its companies will be able to meet their payment obligations and continue their business activities, in particular due to the positive developments in cyan's core business that have already occurred up to the preparation of this management report, the conservative planning assumptions and the available financing framework.

Interest rate risk (low risk)

The interest rate risk as at December 31, 2024 does not have a direct impact on the financial result due to the fact that cyan only has fixed-interest financial liabilities outstanding as at the reporting date. However, current changes in the interest rate landscape may be reflected in future financing.

Currency risks (low risk)

There is a very low currency risk, as the majority of business in the cybersecurity sector is conducted in Euros.

Opportunities

In addition to the aforementioned risks, there are a large number of opportunities that represent key drivers for growth and further development at cyan. The opportunities are aggregated into four categories: technological change, expansion into new markets, increasing awareness and new sales strategies. For more detailed information on the underlying market drivers and their classification in the overall context, please refer to the following description of industry-specific developments.

Opportunities due to technological change

In an increasingly networked world, the secure use of the internet plays a key role. Mobile devices, especially smartphones, play a particularly important role here. They are no longer used exclusively for sending text messages and making voice calls, but have become a key to accessing an endless range of digital services. Increasing network coverage with at least 4G and the widespread availability of internet-enabled devices are contributing to further growth in potential end customers. At the same time, network operators are continuing to invest in the expansion of the 5G infrastructure, which has the advantage of high speeds and low latency. Together with the increasing encryption of traffic, this makes deep packet inspection (DPI) more difficult, which brings DNS filter technology into focus. Furthermore, cyan has demonstrated another important technological competence with the cloud-based provision of the cybersecurity solution and is thus also ready for the massive trend towards cloud solutions that is being observed in the industry.

It is expected that not only the number of smartphones, but also the number of other internet-connected end devices, Internet-of-Things (IoT), will grow strongly worldwide. This will lead to further fragmentation of the system landscape, as there is generally no standardized hardware and software and many devices, especially smaller ones, do not yet have the computing power to run complex endpoint solutions directly. Nevertheless, many smart TVs, smart watches, home automation devices and even vehicles - the keyword here is "connected mobility" - are constantly communicating with each other and with the internet. Network-integrated solutions can also be used to protect users in this area. The end user expects a homogeneous user interface with simultaneous adaptability to personal needs.

Opportunities through new markets

In recent years, cyan has already been able to reach many new markets by expanding the product, gaining customers in other countries and addressing additional end customer segments. At the same time, cyan is constantly working on new solutions to provide end customers with the best possible protection. Not least through the further development of the Seamless Security platform to include an OnNet solution for PCs in the fixed-line Internet, app-based solutions (for example the SDK) and the convergent solution based on DNS-over-VPN, which enables a broader range of accessible partners and further upselling to existing customers . cyan's cybersecurity is based on DNS, a fundamental technology for the Internet, which means that the solutions can be used universally internationally. With an increased global presence by cyan and its partners, new geographies can be opened up that offer additional sales potential.

Opportunities due to increasing awareness of cybersecurity issues

In recent years, the consequences of increasing digitalization, such as data protection and cybersecurity, have increasingly become the focus of public attention. The European Union created a first milestone with the General Data Protection Regulation, which came into force in 2018. Since then, numerous high-profile IT security incidents have come to light, shedding media light on the security of foreign telecoms equipment, and the population has experienced an unprecedented wave of digitalization triggered by global home office instructions. As a result, internet security has become an important issue for the general public as well as for national governments and the European Union. This awareness among the public is also leading companies to invest more in cybersecurity. In view of the comparatively strict European regulation, European providers are viewed internationally as trustworthy. This is an opportunity for cyan to benefit from the momentum.

Opportunities through new sales strategies

An important element of the sales strategy is the greater involvement and active support of customers in the go-to-market area as well as in end customer sales. The aim is to pursue focused leads and thus enable better partnership-based support right from the start. The OnNet Core product enables faster implementation in less than six weeks. This means that partners can plan for faster sales. In addition, greater customization is possible with the OnNet Plus product, which is also sold and enables special reporting and analytics methods. In addition, the development of strategic partnerships is to be driven forward - in particular for the development of new markets and target groups. In particular, the terminal-based solution will be tailored to new sectors, such as the insurance industry. This is intended to protect end customers in the sector preventively and protect insurance companies from potential claims. The use cases extend beyond traditional smartphones and also include IoT (Internet of Things) endpoints. Most recently, the cyan Guard 360 cyber security product was developed specifically for SMEs, which will be marketed from 2025 and will open up a new customer group for cyan.

Opportunities and risk profile

As a growth company, cyan operates in a continuously evolving technology industry that is characterized by disruptive innovations. This results in risks and opportunities that are influenced by various factors. In the opinion of the Management Board, the risk management system used at cyan is suitable for identifying and analyzing existing risks in order to manage them adequately. The Management Board strives to make the best possible use of opportunities and reduce risks as far as possible. Future developments are subject to uncertainty, particularly due to the macroeconomic environment. Changes in external and internal factors are therefore regularly analyzed and opportunistic measures are taken as required.

Based on the multi-year overall planning for the Group, the long-term assumption of sales increases, particularly through new customer business and steady growth with existing customers, the Management Board assumes that the company will continue as a going concern. The Management Board classifies the risks described as manageable and sees very good opportunities for cyan to continue to grow in the future.

Forecast

According to the forecast of the International Monetary Fund (IMF), global economic growth is expected to amount to 2.8% in 2025, which represents a slight improvement compared to 2024, but is below the historical average.8 The investment situation at cyan's partners, particularly in the telecommunications sector, is linked to economic developments in many areas. Irrespective of this, cybersecurity continues to be a very important topic in social, political and economic terms and is therefore growing at an above-average rate, irrespective of general economic developments.9 In particular, the rapid progress of artificial intelligence will enable more sophisticated cyber-attacks in the future. To counteract this, cyan is continuing its efforts in the area of research and development in 2025 and is focusing primarily on projects that further expand the use of artificial intelligence in cyan technology. In addition, modern solutions for increasing sales and margins are becoming increasingly important for telecommunications companies under interest rate and price pressure. As a result, telecommunications providers need agile and cost-efficient products with innovative ways to increase sales and customer loyalty. This is exactly what cyan's products offer. The new cyan Guard 360 cyber security product for SMEs also aims to protect an industry that is increasingly confronted with cyber-attacks such as phishing.

The forecast takes into account external factors, which are offset by solid internal developments. With a new record number of partners, the growth base of end customers has broadened further. Developments in the first four months of the 2025 financial year continue to show steady growth in the number of end customers. In order to further expand the customer base, investments in the further development and market launch of the cyan Guard 360 cybersecurity solution in particular play a key role in the company's growth. At the same time, cyan is investing more in sales in 2025 through new employees and sales activities to further increase market penetration, especially in the telecommunications sector, and to tap into additional growth potential. Together with the recently launched and upcoming implementations, as well as the pipeline of potential new customers, the number of end customers will continue to increase significantly in the future.

Based on the increasing number of end customers, due to solid growth with existing customers and new customer implementations and the associated increase in recurring revenue, the Management Board expects operating revenue to grow from EUR 7.1 million in 2024 to between EUR 8.4 million and EUR 9.2 million in the 2025 financial year. Together with the increase in revenue, the Management Board expects a further significant improvement in the operating margin (EBITDA) at Group level for 2025, with the aim of achieving a black zero.

Munich, April 25, 2025

The Management Board

⁸ International Monetary Fund (IMF)

⁹ Allianz Risk Barometer 2024

Financial Statements

of cyan AG, Munich as of December 31, 2024

Statement of comprehensive income

Income statement

in EUR thousand	Notes	2024	2023
Continued operations
Revenues	1	7,095	4,716
Other operating income	2	354	814
Costs of materials and services	3	- 1,289	- 1,263
Personnel expenses	4	- 5,267	- 5,145
Value adjustments	5	- 17	-
Loss from derecognition of financial assets	6	-	- 577
Other expenses	7	- 2,359	- 3,014
EBITDA		- 1,483	- 4,470
Depreciation and amortization	8	- 2,495	- 2,539
Operating result (EBIT)		- 3,978	- 7,009
Financial income	9	16	13
Financial expenses	9	- 22	- 45
Earnings before taxes		- 3,984	- 7,041
Taxes on income and earnings	10	311	1,729
Result after taxes from continuing
operations		- 3,674	- 5,312
Result from discontinued operations	11	- 63	- 15,404
Result after taxes total		- 3,737	- 20,717

Other comprehensive income (OCI)

in EUR thousand	2024	2023
Gains (losses) from exchange rate differences
from continuing operationsa	- 2	- 5
Gains (losses) from exchange rate differences
from discontinued operationsb	-	149
Total result for the fiscal year	- 3,736	- 20,572

a recyclable

b non-recyclable

The entire results are attributable to the shareholders of the company.

Earnings per share from continuing operations

in EUR per share	Notes	2024	2023
Undiluted earnings per share		- 0.17	- 0.28
Diluted earnings per share		- 0.17	- 0.28

Earnings per share from discontinued operations

in EUR per share	Notes	2024	2023
Undiluted earnings per share		0.00	- 0.82
Diluted earnings per share		0.00	- 0.82

Earnings per share from continuing and discontinued operations

in EUR per share	Notes	2024	2023
Undiluted earnings per share		- 0.17	- 1.10
Diluted earnings per share		- 0.17	- 1.10

The comparative figures for the previous year have been adjusted due to error corrections from previous periods

The notes are an integral part of these consolidated financial statements.

Balance sheet

Assets

in EUR thousand	Notes	31/12/2024	31/12/2023
Intangible assets		25,918	28,067
Patents, trademark rights, customer
relationships and similar rights	12	3,423	4,155
Software	12	41	1,404
self-developed software	12	675	729
Goodwill	12	21,779	21,779
Tangible assets		1,905	2,124
Land and buildings	13	1,369	1,573
Business and office equipment	13	536	551
Other receivables	17	7	3
Deferred tax assets	15	-	1
Subtotal Non-current assets		27,830	30,195
Trade receivables and other receivables	14, 16, 17	1,230	1,047
Contract assets	14	704	489
Inventories		20	-
Tax receivables	17	8	4
Other receivables and assets	17	2,092	2,463
Cash and cash equivalents	18	816	2,872
Subtotal current assets		4,870	6,875
Assets held for sale	11	-	6,648
Total current assets		4,870	13,524
Total assets		32,700	43,718

Liabilities

in EUR thousand	Notes	31/12/2024	31/12/2023
Share capital	19	20,189	20,189
Reserves		7,911	11,793
Capital reserves	19	88,131	88,131
Adjustments in accordance with IAS 8	19	- 21,970	- 21,976
Other reserves	19	89	240
Reserves according to IAS 19	19	-	2
Profit / loss carried forward		- 58,340	- 54,605
Total Equity		28,100	31,983
Leasing liabilities	16, 20	1,003	1,168
Other financial liabilities	16, 20	784	748
Other non-current liabilities	16, 21	84	207
Deferred tax liabilities	15	196	557
Total non-current liabilities		2,067	2,680
Trade payables and other liabilities	16, 21	1,986	4,712
Provisions	22	-	88
Financial liabilities	16, 20	-	0
Leasing liabilities	16, 20	267	257
Tax liabilities		279	455
Subtotal current liabilities		2,533	5,512
Liabilities directly associated with assets held for
sale	11	-	3,543
Total current liabilities		2,533	9,056
Total liabilities		4,600	11,736
Total equity and liabilities		32,700	43,718

The notes are an integral part of these consolidated financial statements.

Cash flow statement

in EUR thousand	2024	2023






































equivalents received in foreign currencies	-	19

The notes are an integral part of these consolidated financial statements. The effects of IFRS 5 have not been taken into account in this cash flow. They are explained in Note 10 Discontinued operations.

Consolidated statement of changes in equity

in EUR thousand	Share capital	Capital reserves	Reserves in accordance with IAS 8	Other reserves / currency reserves	Reserves in accordance with IAS 8	Profit / loss carried forward	Total
01/01/2023	17,017	84,358	- 21,976	99	- 1	- 33,888	45,609
Net profit/loss for the year	-	-	-	-	-	- 20,717	- 20,717
Change in the scope of consolidation	-	-	-	-	-	-	-
Other comprehensive income, net of tax	-	-	-	142	3	-	144
Comprehensive income for the financial year	-	-	-	142	3	- 20,717	- 20,572
Issue of convertible bonds	-	1,500	-	-	-	-	1,500
Capital increase	3,173	2,273	-	-	-	-	5,446
00/01/1900	20,189	88,131	- 21,976	240	2	- 54,605	31,983
Net profit/loss for the year	-	-	-	-	-	- 3,737	- 3,737
Net profit/loss for the year	-	-	6	- 150		2	- 142
Change in the scope of consolidation/disconti nued operations	-	-	-	- 2	-	-	- 2
Comprehensive income for the financial year	-	-	6	- 151	- 2	- 3,735	- 3,882
Capital increase	-	-	-	-	-	-	-
Issue of convertible bonds	20,189	88,131	- 21,970	89	-	- 58,340	28,100

Information about the company

cyan AG, headquartered in Munich (Josephspitalstraße 15 (formerly: Theatinerstraße 11), 80333 Munich), is a stock corporation registered in the Commercial Register B of the Munich Local Court under HRB 232764. cyan AG has been listed on the German stock exchange in the Scale segment of the Open Market since March 2018. cyan AG acts as a holding company within cyan. Operational services are provided by the Austrian subsidiary cyan Digital Security GmbH (formerly: I-New Unified Mobile Solutions GmbH) and its subsidiaries, in particular cyan Security Group GmbH. cyan Digital Security GmbH (formerly: I-New Unified Mobile Solutions GmbH) operates as a Mobile Virtual Network Enabler (MVNE). cyan Security Group GmbH offers cybersecurity solutions for end customers of mobile network operators (MNOs), mobile virtual network operators (MVNOs) and financial service providers. In 2023, the decision was made to sell the BSS/OSS division in order to focus on cybersecurity solutions. The contracts were signed in December 2023. The sale took place with effect from January 1, 2024.

Accounting principles

The significant accounting policies applied in the voluntary preparation of these consolidated financial statements are presented below. Unless otherwise stated, these principles were applied for all years presented.

The consolidated financial statements consist of the consolidated statement of comprehensive income, consolidated balance sheet, consolidated cash flow statement, consolidated statement of changes in equity and notes to the consolidated financial statements.

The Management Board of cyan AG approved the consolidated financial statements on April 25, 2025 and released them for forwarding to the Supervisory Board.

Basics of creation

These interim consolidated financial statements as at December 31, 2024 were prepared voluntarily in accordance with the applicable International Financial Reporting Standards (IFRS) as adopted by the EU. The term IFRS also includes the International Accounting Standards (IAS) still in force, the International Financial Reporting Standards (IFRS) and the interpretations of the Standing Interpretations Committee (SIC) and the International Financial Reporting Interpretations Committee (IFRIC).

The statement of comprehensive income is presented using the nature of expense method. In the statement of comprehensive income and in the balance sheet, individual items are summarized for better understanding or due to immateriality. In accordance with IAS 1, assets and liabilities are classified by maturity. Items are classified as current if they are due within one year. Otherwise they are classified as non-current. The consolidated statement of changes in equity and the consolidated cash flow statement have been classified in accordance with IAS 1.

The accounting and valuation methods were applied uniformly to the consolidated financial statements and the previous year's figures. The balance sheet dates of the consolidated companies are identical.

Going concern

The future liquidity situation at cyan is largely dependent on payments from customers and therefore the development of sales. Due to the acquisition of new customers, the Management Board assumes a stable future liquidity situation, whereby cyan is also dependent on marketing by its partners. Based on the steady subscriber growth among existing customers in the cybersecurity segment and new customer projects in the 2024 financial year, the Management Board assumes that revenue will most likely increase significantly compared to the previous year, as shown in the forecast, and that the cash and cash equivalents generated will be sufficient to cover ongoing financial requirements. Nevertheless, project delays could occur, for example, as a result of which individual projects may only generate revenue with a delay and thus generate cash flows at a later date, existing customers may default entirely or the planned revenue growth may be lower due to lower subscriber numbers. Consequently, there is a residual risk that cash flows will not occur as planned. The option of a short-term factoring program is planned as a means of bridging potential liquidity bottlenecks. In the event of further financing requirements, e.g. to implement strategic projects or in the event of unforeseen adverse economic developments, the company would be reliant on external financing in the forecast period. However, the Management Board assumes that the Group and its companies will be able to meet their payment obligations and continue their business activities, in particular due to the positive developments in cyan's core business that have already occurred up to the preparation of these consolidated financial statements, the conservative planning assumptions and the available financing framework. The consolidated financial statements were therefore prepared unchanged on the basis of the going concern assumption.

Functional currency

The interim consolidated financial statements of cyan AG are prepared in thousands of euros. When adding up rounded amounts, rounding differences may occur due to the use of automatic calculation aids.

In the opinion of the management, the consolidated interim financial statements include all adjustments necessary to give a true and fair view of the net assets, financial position and results of operations.

The annual financial statements of subsidiaries whose functional currency is a currency other than the euro are translated in accordance with the functional currency principle. Balance sheet items are translated at the closing rate. Income and expense items are translated at the average exchange rate for the year. Resulting translation differences are recognized in other comprehensive income (OCI) and presented in the currency translation reserve in equity until the subsidiary is sold.

Currency translation differences arising from exchange rate fluctuations between the recognition of the transaction and its cash effect or valuation on the balance sheet date are recognized in profit or loss and reported in the operating result.

The following table shows the exchange rates of the foreign currencies in which cyan AG and its subsidiaries conduct their business:

	Average rate		Closing rate
	2024	2023	31/12/2024	31/12/2023
Argentine Peso (ARS)	-	343.675	-	892.045
Bangladeshi Taka (BDT)	-	118.752	-	124.628
Brazilian Real (BRL)	5.827	5.402	6.384	5.343
Chilean Peso (CLP)	-	911.534	-	979.400
Colombian Peso (COP)	-	4,625.882	-	4,223.365
Mexican Peso (MXN)	-	19.190	-	18.767
Peruvian Sol (PEN)	-	4.103	-	4.175
Thai Baht (THB)	38.179	37.633	35.794	38.176
Hungarian Forint (HUF)	-	381.758	-	381.800
US Dollar (USD)	1.082	1.082	1.048	1.090

As cyan Security Argentina SpA is located in a hyperinflationary economy, IAS 29 must always be observed. Due to the immateriality of the amounts and the fact that the company was dissolved in 2023, no further disclosure requirements were made.

Estimates and exercise of discretion

The preparation of the consolidated financial statements requires estimates and assumptions that influence the reported values in the consolidated financial statements. Actual results may differ from these estimates. The estimates and the assumptions on which they are based are reviewed on an ongoing basis. Changes in accounting estimates are recognized in the period in which the estimate is changed and in all subsequent periods affected. Valuations made by the management in application of IFRS that have a significant impact on the consolidated financial statements and estimates with a significant risk of material adjustment in the following year are explained in the respective items.

Impairment of assets

The assessment of the recoverability of intangible assets, goodwill and property, plant and equipment is based on forward-looking assumptions. The assumptions used as a basis for goodwill impairment tests are explained in Note 12 Intangible assets. Estimates are involved in determining the useful life of assets.

Claims

Impairment losses on receivables are recognized on the basis of assumptions about the probability of default in accordance with the expected credit losses model.

Other provisions

Other provisions are recognized for current obligations resulting from past events that lead to an outflow of resources embodying economic benefits at the amount that is most probable on the basis of reliable estimates. Details of the provisions can be found in the notes to the consolidated balance sheet, Note 22 Provisions.

Income taxes

The recognition and subsequent measurement of current and deferred taxes are subject to uncertainties due to complex tax regulations in the various national jurisdictions, which are also subject to ongoing changes. Furthermore, the utilization of loss carryforwards depends on future results. The Management Board believes that it has made a reasonable assessment of the tax uncertainties and future results. However, due to the existing tax uncertainties and the uncertainty in estimating future results, there is a risk that differences between the actual results and the assumptions made may have an impact on the recognized tax liabilities and deferred taxes. The tax details are explained in more detail in the following sections on income tax.

Revenue from contracts with customers

The assessment of contracts with customers based on the criteria of IFRS 15 required the use of estimates and judgment, particularly with regard to the identification of separate performance obligations within a contract and the allocation of the transaction price to these in accordance with their stand-alone selling prices. Further details are provided in the accounting policies under "Revenue from contracts with customers".

Leasing

When calculating the rights of use and the associated lease liabilities or lease receivables, significant estimates were required as lessee or lessor, which are explained in more detail in the accounting policies under "Leases".

Scope and method of consolidation

The scope of consolidation is determined in accordance with the provisions of IFRS. In addition to the financial statements of cyan AG, the consolidated financial statements also include the financial statements of the companies controlled by cyan AG (and its subsidiaries).

Subsidiaries are companies that are controlled by cyan AG. Control exists when cyan AG can exercise power over the investee, is exposed to variable returns from its involvement with the investee and has the ability to affect the amount of those returns through its power over the investee. The financial statements of subsidiaries are included in the consolidated financial statements from the date on which cyan AG obtains control over the subsidiary until the date on which cyan AG ceases to have control.

The parent company of these consolidated financial statements is cyan AG. All companies under the control of the parent company are fully consolidated in the consolidated financial statements.

Company	Registered office	Share	Fully consolidated since	Fully consolidated until
cyan AG	Germany
CYAN Licencing GmbH	Austria	100%	01/01/2018
cyan Seamless Solution Mèxico, S.A. de C.V. (fmr. I-New Unified Mobile Solutions,
S.A. de C.V.)b	Mexico	100%	31/07/2018	31/12/2023
cyan digital security (Thailand) Ltd.a	Thailand	100%	30/11/2022
cyan Security Argentina SRLa	Argentinia	100%	01/12/2022	31/12/2023
cyan security Brasil Ltds	Brazil	100%	31/12/2022	30/06/2024
cyan security Chile S.p.Ab	Chile	100%	31/07/2018	31/12/2023
cyan security Colombia S.A.S.b	Colombia	100%	31/07/2018	31/12/2023
cyan security Ecuador SASc	Ecuador	100%	31/12/2020	30/06/2024
cyan Security Group GmbH	Austria	100%	31/01/2018
cyan security Peru S.A.C.b	Peru	100%	31/07/2018	31/12/2023
cyan security USA, Inc.b	USA	100%	31/07/2018	31/12/2023
I-New Bangladesh Ltd.b	Bangladesh	100%	31/07/2018	31/12/2023
I-New Hungary Kft.b	Hungary	100%	31/07/2018	31/12/2023
cyan Digital Security GmbH (fmr. I-New
Unified Mobile Solutions GmbH)	Austria	100%	31/07/2018
smartspace GmbHb	Austria	100%	31/07/2018	31/12/2023

The scope of consolidation as at December 31, 2024 is as follows

a cyan Security Argentina SpA was dissolved in 2023, which is why it was deconsolidated.

b The agreement dated 19.12.2023 stipulates the sale of the companies with effect from 01.01.2024. c cyan security Brasil Ltda and cyan security Ecuador SAS were dissolved in 2024, which is why they were deconsolidated.

The parent company of these consolidated financial statements is cyan AG. All companies under the control of the parent company are fully consolidated in the consolidated financial statements.

The following table shows the changes in the scope of consolidation:

	Full consolidation		At-equity
	31/12/2024	31/12/2023	31/12/2024	31/12/2023
Balance at the beginning of the
reporting period	15	16	0	0
Included for the first time	0	0	0	0
Deconsolidation due to mergers	0	0	0	0
Sold	- 8	0	0	0
Deconsolidated	- 2	- 1	0	0
Balance at the end of the
reporting period	5	15	0	0

New and amended accounting rules to be applied

Standard	Content	Effective
	General requirements for the disclosure of sustainability
IFRS S1	related financial information (not mandatory to date)	01/01/2024
IFRS S2	Climate-related disclosures (not mandatory to date)	01/01/2024
	Amendments to clarify the subsequent measurement of sale
IFRS 16	and leaseback transactions by a seller-lessee	01/01/2024
IAS 1	Amendments relating to the classification of liabilities and
	ancillary conditions	01/01/2024
IFRS 7 +
IAS 7	Amendments relating to supplier financing agreements	01/01/2024

The following amended standards must be applied for the first time:

Please note that the IFRS S1 and IFRS S2 standards have not yet been adopted into EU law, which is why they have not yet been applied in the consolidated financial statements. The amendments had no material effect on cyan's net assets, financial position and results of operations.

The following amendments or new versions of standards and interpretations are not yet mandatory or applicable or have not yet been adopted by the EU:

Standard	Content	Effective
IAS 28 /	Amendments relating to the sale or contribution of assets
IFRS 10	between an investor and its associate or joint venture	postponed
IAS 21	Amendments relating to lack of exchangeability	01/01/2025
IFRS 7 +	Amendments relating to the classification and measurement
IFRS 9	of financial instruments	01/01/2026
AS 7, IFRS 1,
IFRS 7,
IFRS 9 und
IFRS 10	Improvements to the IFRS cycle	01/01/2026
IFRS 18	Presentation and disclosures in the financial statements	01/01/2027
IFRS 19	Subsidiaries without public accountability: disclosures	01/01/2027

The standards listed - if adopted by the EU - will not be applied early. From today's perspective, the amendments and new versions of the standards and interpretations are not expected to have any material impact on cyan's net assets, financial position and results of operations.

Accounting and valuation methods

Revenue from contracts with customers

cyan has applied IFRS 15 "Revenue from Contracts with Customers". In accordance with IFRS 15, the point in time at which control of the goods and services is transferred and the customer can therefore benefit from them is decisive for revenue recognition. For this purpose, Cyan has applied the newly introduced 5-step model for determining the extent and timing of revenue recognition:

Identification of the contract
Identification of performance obligations
Determination of the transaction price
Allocation of the transaction price to the performance obligations
Revenue recognition over time or at a point in time

Cyan has identified the following performance obligations in its customer contracts: License issuance, technical support and maintenance, and updates.

Licensing

As part of the sale of licenses by cyan, the customer acquires the right to use intellectual property and thus revenue is recognized at a point in time. The decisive factor here is the point in time from which the customer can use the license and benefit from it. On the one hand, these are licenses for the use of the cybersecurity software developed by cyan, on the other hand licenses for the use of the BSS/OSS software solution.

Technical support and maintenance

During the term of the contract, further services are to be rendered in the form of the provision of any technical support and maintenance. A provision obligation in accordance with IFRS 15.26 e) and therefore revenue recognition over time is assumed here.

Updates

Some customer contracts in the Cybersecurity segment involve ongoing database updates. These are fully automated using self-learning algorithms. The originally granted version of the software that is installed on the customer systems continues to function and can be used effectively even without updates in order to offer end customers the appropriate cybersecurity. Although updates can improve the quality or update, they are not "critical" for the functionality of the software, as the updates only relate to part of the functional scope and are not essential for the usability of the software or licenses for the customer. For this reason, the existence of a provision obligation in accordance with IFRS 15.26 e) and therefore revenue recognition over time is also assumed for the updates.

Revenue is recognized at the transaction price. The transaction price is the consideration that is expected to be received in exchange for the provision of the service. Expected rebates and discounts as well as amounts collected on behalf of third parties (VAT) are deducted. If the service and payment are made within one year, no adjustment needs to be made with regard to interest.

The transaction prices are to be regarded as fixed (purchase quantity x unit price), particularly with regard to revenue recognition at a point in time. In the case of contracts that include longer payment terms, a significant financing component is assumed for those sales revenues that are allocated to services that are already provided at the beginning of the contract. The transaction price allocated to this service is therefore discounted and interest income is subsequently recognized.

Revenue is recognized over time on the basis of the elapsed contract term in relation to the total term of the respective contract. The management has come to the conclusion that the proportion of the time elapsed on the reporting date in relation to the total time expected for the provision of services represents an appropriate measure of the stage of completion of these performance obligations in accordance with IFRS 15.

The usual payment terms granted by cyan are 45 days.

Redemption agreements are only included on a "best effort" basis and therefore have no effect on the allocation of the transaction price or revenue recognition.

If the service is rendered before consideration is received, contract assets are capitalized.

Trade receivables are recognized when there is an unconditional right to payment.

If additional costs are incurred when a contract is concluded and the associated revenue is recognized over a year, these costs must be capitalized and amortized in the course of revenue recognition.

Income taxes

The income tax expense (or income) for the period is the tax payable on the taxable income for the current period, based on the applicable income tax rate (adjusted for changes in deferred tax assets and liabilities attributable to temporary differences and any unused tax losses).

Deferred income taxes (income or expenses) result from temporary differences between the carrying amount of an asset or liability in the balance sheet and its tax base. In accordance with IAS 12 (Income Taxes), deferred tax assets/liabilities reflect all temporary valuation and accounting differences between the tax balance sheet and the IFRS financial statements. In addition, deferred taxes are recognized on tax loss carryforwards.

cyan AG has a trade tax loss carryforward of around EUR 6.71 million (2023: EUR 7.05 million) and a corporation tax loss carryforward of around EUR 6.72 million (2023: EUR 7.06 million). As there is considerable uncertainty regarding the future use of the loss carryforwards, no deferred tax assets were recognized.

The core concept of Austrian group taxation involves the aggregation of the taxable results of financially related corporations at the head of the group. All companies belonging to the group calculate the respective income. The resulting tax burden is offset against the group parent in the form of tax allocations (stand-alone method). The results of all companies are combined at the head of the group and taxed accordingly.

In 2019, a group was applied for with cyan Digital Security GmbH (formerly: I-New Unified Mobile Solutions GmbH) as the group parent. The following companies subsequently acted as group members: cyan Security Group GmbH, CYAN Licencing GmbH and smartspace GmbH. With the sale of the shares in smartspace GmbH on January 1, 2024 and the opening of the liquidation of Cyan Licencing GmbH in 2024, both companies will cease to be group members from 2024.

Group loss carryforwards of around EUR 72.9 million are available for subsequent years. These can be offset against future profits for an unlimited period of time up to an amount of 75%. The management has prepared planning calculations for the next 6 years and, based on these calculations, it is expected that a loss carryforward of around EUR 24 million can be utilized in the next 6 years. As it is not yet possible to estimate future developments, the deferred tax assets recognized in the calculation of deferred taxes for loss carryforwards were limited to the loss carryforward of EUR 19.5 million.

The following income tax rates were applied for the fully consolidated companies:

Company	2024	2023
cyan AG	32.975%	32.975%
CYAN Licencing GmbH	24.0%	25.0%
cyan digital security (Thailand) Ltd.	15.0%	15.0%
cyan Seamless Solution México, S.A. de C.V.	30.0%	30.0%
cyan security Brasil Ltda	25.0%	25.0%
cyan security Chile S.p.A	27.0%	27.0%
cyan security Colombia S.A.S.	35.0%	35.0%
cyan security Ecuador SAS	22.0%	22.0%
cyan Security Group GmbH	24.0%	25.0%
cyan security Peru S.A.C.	29.5%	29.5%
cyan security USA, Inc.a	26.5%	26.5%
I-New Bangladesh Ltd.	b	b
I-New Hungary Kft.	9.0%	9.0%
cyan Digital Security GmbH (vormals: I-New Unified Mobile
Solutions GmbH)	24.0%	25.0%
smartspace GmbH	24.0%	25.0%

b tax-exempt

Intangible assets and goodwill

Purchased intangible assets are measured in accordance with IAS 38 at acquisition or production cost and any impairments less scheduled pro rata temporis amortization. An impairment loss is recognized if there are circumstances that indicate an impairment.

Purchased licenses for software are capitalized on the basis of the cost of acquiring and commissioning the software. These costs are amortized on a straight-line basis over the estimated useful life of 3 to 5 years.

As the period in which trademark rights are expected to generate cash flows cannot be estimated, they are not amortized. They are amortized when impairment losses have been incurred.

Research expenses are recognized as expenses. Development expenses are capitalized if the relevant criteria of IAS 38 are met. Capitalized development expenses are recognized at cost less amortization and impairment losses with an amortization period of 3 to 10 years.

Intangible assets acquired as part of a business combination are recognized separately from goodwill and measured at fair value at the time of acquisition.

In subsequent periods, intangible assets acquired as part of a business combination are measured at cost less accumulated amortization and any accumulated impairment losses in the same way as individually acquired intangible assets.

In the course of company acquisitions, goodwill results from the fair value of the consideration transferred and the amount of all non-controlling interests in the acquired company less the balance of the identifiable assets acquired and liabilities assumed measured at fair value.

If the difference is negative, the calculation of the consideration transferred and the purchase price allocation must be reviewed. If a new review reveals a negative difference, this is recognized in the income statement.

If the difference is positive, goodwill is recognized.

Goodwill, technologies and customer relationships were capitalized as part of the acquisition of cyan Security Group GmbH and its subsidiaries. Goodwill is not amortized. In accordance with IAS 36, an impairment test is to be carried out once a year. If there is any indication of impairment, an impairment test must be carried out immediately.

Technologies are amortized on a straight-line basis over their useful life (7 years). Customer relationships are amortized on a straight-line basis over their useful life (9 or 12 years).

Property, plant and equipment

Property, plant and equipment are recognized at cost less accumulated depreciation. The acquisition costs include the purchase price, ancillary costs and subsequent acquisition costs less any discounts received on the purchase price.

Subsequent costs are included in the asset's carrying amount or recognized as a separate asset, as appropriate, but only when it is probable that future economic benefits associated with the item will flow to the entity and the cost of the item can be measured reliably. The carrying amount of any replaced part is derecognized. All other repair and maintenance costs are recognized in the statement of comprehensive income in the reporting period in which they are incurred.

Property, plant and equipment are depreciated on a straight-line basis over their estimated useful life. The economic and technical life expectancy was taken into account when determining the estimated useful life. The estimated useful lives of property, plant and equipment are as follows: 3 to 5 years for IT equipment, 4 to 10 years for other operating and office equipment and 33.33 years for office buildings. The recoverability of the carrying amounts and useful lives of the assets are reviewed at each balance sheet date and adjusted if necessary. If assets are sold, decommissioned or scrapped, the difference between the net proceeds and the net carrying amount of the asset is recognized as a gain or loss in other operating income or expenses.

Investment grants are recognized directly in equity using the gross method in a liability item, which is reported under other liabilities. Investment grants are recognized as other income in the consolidated income statement over the useful life of the assets for which they are granted.

Impairment test

An impairment test in accordance with IAS 36 must be carried out at least annually for goodwill, intangible assets with an indefinite useful life and intangible assets that are not yet available for use. The recoverability of the carrying amounts of all other assets, with the exception of those that are measured at fair value through profit or loss or that are subject to special rules on impairment testing from another standard, is only to be tested if there is an indication of impairment.

As the relevant data for carrying out an impairment test at the level of individual assets is often not available, cash-generating units are formed for the purpose of impairment testing. These are defined as the smallest identifiable group of assets that generates cash inflows that are largely independent of the cash inflows from other assets or groups of assets. For the purpose of impairment testing, goodwill is allocated on acquisition to those cash-generating units (or groups thereof) of cyan that are expected to benefit from the synergies of the combination. Cash-generating units to which a portion of the goodwill has been allocated must be tested for impairment at least annually. If there are indications that a unit is impaired, it may be necessary to carry out impairment tests more frequently. If the recoverable amount of a cash-generating unit is less than the carrying amount of the unit, the impairment loss is first allocated to the carrying amount of any goodwill allocated to the unit and then to the other assets pro rata on the basis of the carrying amounts of each asset in relation to the total carrying amount of the assets within the unit. The recoverable amount is the higher of value in use and fair value less costs to sell.

The impairment test is carried out according to the value-in-use concept; the recoverable amount is determined on the basis of the value in use.

Any resulting impairment loss must be recognized in the income statement. If the reason for an impairment loss no longer exists in a subsequent period, the impairment loss must be reversed through profit or loss. An impairment loss recognized for goodwill may not be reversed in future periods.

Leasing

For recognition in accordance with IFRS 16, the decisive factor is whether the leased asset is an identifiable asset, the lessee can determine its use and is entitled to the economic benefits from the asset. For each lease, the lessee recognizes a liability for the future lease payments to be made. At the same time, a right-of-use asset is recognized in the amount of the present value of the future lease payments and subsequently depreciated on a straight-line basis. The standard particularly affects cyan in connection with the leasing of office space, server rooms, data lines and vehicles.

The lease liability is measured at the present value of the future lease payments. The lease payments are discounted using the incremental borrowing rate. The right-ofuse assets are measured at the amount corresponding to the respective lease liability, adjusted for any lease payments made in advance or deferred.

The incremental borrowing rate used to discount the lease liabilities was derived on the basis of the interest rate for German government bonds, taking into account the credit spread, the country risk and the inflation differential. The weighted average incremental borrowing rate of cyan is calculated at 3.55% (2023: 2.56% - 1.08% after IFRS 5 reclassification).

The lease liabilities have the following maturities:

in EUR thousand	31/12/2024	31/12/2023
Leasing liabilities	1,270	2,333
Thereof non-current	1,003	1,645
Thereof current	267	688
IFRS 5 reclassification	-	- 908
Lease liabilities according to IFRS 5 Reclassification	1,270	1,426

IFRS 16 requires estimates that affect the measurement of both right-of-use assets and lease liabilities. These include the contract terms and the incremental borrowing rate used to discount future payment obligations.

The following table shows the effect of leases on the income statement:

in EUR thousand	31/12/2024	31/12/2023
Depreciation of buildings	236	670
Depreciation of other equipment, operating and office
equipment	25	45
Interest expense	16	73
Income from subleasing of rights of use in connection with
buildings	-	232
Interest income	-	1

The following table shows the effect of leases on the income statement for continuing operations (after IFRS 5 reclassification):

in EUR thousand	31/12/2024	31/12/2023
Depreciation of buildings	236	231
Depreciation of other equipment, operating and office
equipment	25	17
Interest expense	16	17
Income from subleasing of rights of use in connection with
buildings	-	76
Interest income	-	0

The total payments for leases in 2024 amounted to EUR 295 thousand (2023: EUR 1,083 thousand - after IFRS 5 reclassification EUR 384 thousand).

Cyan leases various office premises, server rooms, vehicles and fiber optic cables. The rental agreements for office premises generally run for 10 years or an indefinite period, for server premises 5 years, for vehicles 5 years and for fiber optic cables 5 years.

In 2019, a larger office was rented due to a lack of space and the previously used office was sublet from November 2019. The term of the subletting agreement corresponds to that of the rental agreement. For this purpose, the right of use was derecognized and a lease receivable was taken into account. A lease receivable was capitalized in 2020 as part of the sublease agreement with a customer. There is also a sublease agreement for the rental of server premises, which is why a lease receivable was also capitalized here. The subleases expired in 2023.

Extension and termination option

A number of cyan's real estate and equipment leases contain extension and termination options. Such contractual terms are used to give cyan maximum operational flexibility with regard to the assets used by the Group. The majority of the existing extension and termination options can only be exercised by the Group and not by the respective lessor.

The application of IFRS 16 will have a positive effect of EUR 295 thousand on EBITDA at cyan in 2024, as no rental expenses will be incurred in connection with IFRS 16. Furthermore, depreciation and amortization in the amount of EUR 261 thousand will be incurred, which will reduce EBIT. Taking into account interest expenses of EUR 16 thousand, IFRS 16 has an effect of EUR 18 thousand on the result for the period.

Interest incurred is recognized in the financial result.

The options under IFRS 16.5 for short-term leases with a term of up to one year and leases where the underlying asset is of low value (less than EUR 5,000) are exercised. The associated lease payments are recognized as an expense on a straight-line basis over the term of the lease. Amounts of EUR 2 thousand were incurred for short-term leases and amounts of EUR 8 thousand for low-value leases.

Financial instruments

IFRS 9 contains three measurement categories, which represent measurements at amortized cost, measurements at fair value with changes in value in the income statement and measurements at fair value with changes in value in other comprehensive income.

At cyan, only measurement at amortized cost is currently applied for the following reasons.

The fair values of the financial instruments essentially do not differ from the carrying amounts, as the interest receivables and liabilities either almost correspond to the current market rates or the instruments are short-term.

In the case of trade receivables, other receivables, cash and cash equivalents, trade payables and other liabilities, it is assumed that the carrying amounts essentially correspond to the fair values due to the predominantly short-term nature of the items.

The financial liabilities have fixed interest rates, but there are no significant differences to the fair value or the fair values with fixed interest rates almost correspond to the carrying amounts.

Impairment losses must be recognized for financial assets measured at amortized cost and for contract assets.

Cyan makes use of the simplified approach for trade receivables, according to which, under certain conditions, the impairment of these financial assets must always be measured in the amount of the credit losses expected over the term using a distribution matrix (expected credit loss).

The estimated expected credit losses are based on empirical values from actual historical credit losses over the last three years. Specific valuation allowances are recognized for receivables and lease receivables with impaired creditworthiness ("Stage 3") and for contract assets.

Inventories

Inventories are measured at the lower of cost and net realizable value. Net realizable value is the estimated selling price less the estimated costs of completion and the estimated costs necessary to make the sale. Cost is determined using the moving average cost method.

Cash and cash equivalents

Cash and cash equivalents are classified as cash on hand and bank balances and may include other short-term, highly liquid investments with an original term of up to three months. They are recognized at their nominal amount.

Financial liabilities

In accordance with IFRS 9, financial liabilities are initially recognized at fair value less transaction costs incurred. Subsequent measurement is at amortized cost. The difference between the inflow (after deduction of transaction costs) and the repayment amount is recognized in the statement of comprehensive income over the term of the financial liabilities using the effective interest method.

Trade payables are obligations to pay for goods or services purchased from suppliers in the ordinary course of business. Trade payables are classified as current liabilities if payment is due within one year or earlier.

Trade payables are initially recognized at fair value and subsequently measured at amortized cost using the effective interest method.

The carrying amount of other liabilities corresponds to the fair value, as they are predominantly current.

Provisions

Provisions are recognized when the company has a present obligation (legal or constructive) as a result of a past event, it is probable that the company will be required to settle the obligation and a reliable estimate can be made of the amount of the obligation. Provisions are measured at the present value of the Management Board's best estimate of the expenditure required to settle the present obligation at the end of the reporting period. The expense for a provision is recognized in the statement of comprehensive income.

Provisions for severance payments/retirement benefit plans

Defined benefit plans

Provisions for defined benefit obligations are recognized for employees' statutory entitlements. Employees are entitled to a severance payment when they reach retirement age and when their employment is terminated by the employer. The amount of the entitlement depends on the number of years of service and the relevant salary when the severance payment is due. The calculation is based on actuarial principles using the projected unit credit method.

Defined contribution plans

Defined contribution obligations exist for employees in Austria whose employment did not begin until after December 31, 2002. These severance obligations are settled through the ongoing payment of corresponding contributions to an employee pension fund to employee accounts and amount to EUR 52 thousand (2023: EUR 81 thousand - EUR 57 thousand after IFRS 5 reclassification). In addition, voluntary severance payments of EUR 12 thousand (2023: EUR 45 thousand after IFRS 5 reclassification EUR 43 thousand) were incurred.

Company acquisitions/acquisitions of other business units

There were no company acquisitions in 2024 and 2023.

Segment reporting

The operating segments are reported on in a way that is consistent with the internal reporting to the Management Board, which acts as the chief operating decision maker (management approach). Accordingly, the Management Board is responsible for allocating the company's resources to the two segments.

cyan had two segments in 2023 that are used to manage the company: Cybersecurity and BSS/OSS, which are based on the type of products offered. The Management Board opted for this segmentation as it best reflects the company's opportunity and risk structure. The segments are clearly differentiated from one another due to the diversity of the customer groups and the technical solutions and products used.

Following the disposal of the BSS/OSS division, there will only be one segment from 2024, as there are no longer any objective criteria for identifying multiple operating segments in accordance with IFRS 8.5. For this reason, internal segment reporting is no longer required.

Notes to the statement of comprehensive income

[1] Sales revenue

Revenue results exclusively from contracts with customers within the meaning of IFRS 15 and includes all income resulting from cyan's ordinary business activities.

The following chart shows cyan's sales revenue broken down by the business partner's region of origin.

in EUR thousand	2024	2023
Americas	2	1,214
thereof Colombia	-	407
thereof Mexico	-	444
thereof other countries	-	364
APACa	234	1,514
thereof Bangladesh	-	320
thereof New Zealand	-	899
thereof other countries	234	295
EMEAb	6,859	5,896
thereof Austria	3,634	3,568
there of Slovenia	-	868
thereof other countries	3,219	1,459
Revenues	7,095	8,623

aAsia and Pacific

bEurope, Middle East and Africa

The impact of IFRS 5 on revenue is explained below.

in EUR thousand	2024	2023
Revenue before IFRS 5	7,095	8,623
Reclassification IFRS 5	-	- 3,907
Total revenue after IFRS 5	7,095	4,716

In the Cybersecurity segment, revenue from two (2023: 2) customers exceeded the 10% threshold (EUR 4,917 thousand; 2023: EUR 3,596 thousand); in the BSS/OSS segment, this also applied to two customers in 2023 (2023: EUR 1,767 thousand).

[2] Other income, income from reversals of impairment losses and changes in inventories

Other income, income from reversals of impairment losses and changes in inventories consist of the following items:

in EUR thousand	2024	2023
Change in inventory	-	-
Income from grants/research premium	232	786
Income from reversals of write-downs of receivables	-	-
Exchange gains	12	1
Other	109	27
Total	354	814

The research premium is a subsidy for expenditure on research and development, which is granted by the Austrian Federal Ministry of Finance.

The "Other" item largely relates to various recharges of current expenses to the buyer of the discontinued business operations and the subsequent reimbursement of rental expenses.

[3] Cost of materials and purchased services

The income statement and the statement of comprehensive income include expenses for materials and purchased services as follows:

2024	2023
- 0	- 13
- 1,288	- 1,250
- 1,289	- 1,263

Purchased services mainly relate to external services such as various services (e.g. maintenance services and technical consulting) in Germany, the EU and third countries.

[4] Personnel expenses

Personnel expenses include the following items:

in EUR thousand	2024	2023
Salaries	- 4,240	- 4,188
Expenses for social security contributions and payroll taxes	- 1,016	- 1,075
Other personnel expenses	- 11	118
Personnel expenses	- 5,267	- 5,145

The average number of employees including employees on maternity leave is 49 (31.12.2023: 137 - after IFRS 5 reclassification 52). These are broken down by geographical characteristics as follows

in EUR thousand	2024	2023
European Union (excl. Austria)	0	28
Austria	47	70
South America	0	29
Asia	2	10
Rest of the world	0	0
Total	49	137
Rest of the world	-	85
Total	49	52

[5] Impairment losses on trade receivables and contract assets

In 2023, there was a minimal impairment loss on trade receivables and contract assets in continuing operations. In 2024, receivables in connection with foreign investments and withholding tax were written down in the amount of approximately EUR 16.5 thousand.

[6] Loss from the derecognition of financial assets measured at amortized cost

In 2023, the loss from the derecognition of financial assets measured at amortized cost relates to a debt waiver in the amount of EUR 577 thousand, which relates to a receivable from a customer. There were no such transactions in 2024.

[7] Other expenses

Other expenses include the following items (type of expenses):

in EUR thousand	2024	2023
Consulting fees	- 976	- 1,194
Advertising expenses	- 143	- 184
Rental expenses	- 41	- 143
Fees	- 107	- 134
insurance	- 177	- 193
Research and development	- 105	- 74
Travel expenses	- 81	- 181
Exchange rate differences	- 1	- 25
Maintenance expenses	- 99	- 110
Operating costs	- 59	- 71
Licenses and patents	- 177	- 213
Other expenses	- 392	- 493
Total Other expenses	- 2,359	- 3,014

Consulting expenses include expenses for technical advice, legal and tax advice and other consulting services. Other expenses include Supervisory Board remuneration, commissions, administrative costs and contributions.

[8] Depreciation and amortization

The statement of comprehensive income includes the following expenses for depreciation and amortization:

in EUR thousand	2024	2023
Amortisation of intangible assets	- 2,149	- 2,188
Depreciation on property, plant and equipment	- 346	- 351
Depreciation and amortization	- 2,495	- 2,539

Further information on depreciation and amortization can also be found in notes 12 and 13, as well as in the accounting policies under intangible assets, property, plant and equipment and leases.

in EUR thousand	2024	2023
Interest income
Loans	16	13
Other	-	0
Financial income	16	13
Interest and similar expenses
Leasing liabilites	- 16	- 17
Interest on loans	- 7	- 17
Other	- 0	- 12
Financial expenses	- 22	- 45
Financial result	- 6	- 32

[9] Financial income and financial expenses

[10] Income taxes

Actual tax refund claims and tax liabilities are offset if the company has a legally enforceable right of set-off and intends to settle on a net basis or to settle the obligations simultaneously with the realization of the claims.

in EUR thousand	2024	2023
Expenses for current income taxes	- 37	- 8
Tax credits/back payments for previous years	- 7	- 15
Change in deferred income taxes	355	1,751
Income taxes	311	1,729

Tax reconciliation statement

The Group tax rate is defined as the ratio of recognized income tax expense to earnings before income taxes.

The tax expense is calculated using the tax rates applicable in the respective jurisdictions. In accordance with IAS 12, the tax rate that is most appropriate for the information interests of the users of the financial statements is to be applied. In most cases, this will be the tax rate of the country in which the company is based. As cyan AG, based in Germany, acts exclusively as a holding company and the majority of its operating subsidiaries are based in Austria, the Austrian corporate income tax rate of 23% (2023: 24%) was applied when preparing the tax reconciliation.

The reconciliation of the calculated income tax to the recognized income tax expense is as follows:

in EUR thousand	2024	2023
Income before income taxes	- 3,984	- 7,041
Income tax expense based on the Austrian corporate income
tax rate (24% or 25%)	916	1,690
Differences due to different tax rates	120	- 81
Tax-free income	148	207
Non-deductible expenses	- 107	- 87
Taxes from previous period	- 7	- 15
Losses in the current year for which no deferred tax asset
was recognized	- 1,611	- 1,555
Recognition of tax effects of previously unrecognized loss
carryforwards	190	324
Changes in deferred tax assets from adjustment of loss
carryforwards	- 112	1,111
Taxes from abroad	- 33	- 3
Changes in estimates from previous years	-	-
Other differences	808	142
Minimum corporate income tax	- 1	- 5
Effective Group tax expense	311	1,729

[11] Discontinued operation

In 2023, it was decided to sell the BSS/OSS segment in order to focus on cybersecurity solutions. In December 2023, a framework agreement was concluded and it was agreed to sell the operating business of cyan Digital Security GmbH (formerly I-New Unified Mobile Solutions GmbH) by means of an asset deal and the subsequent companies by means of a share deal with effect from January 1, 2024.

cyan Seamless Solution Mèxico, S.A. de C.V. (formerly I-New Unified Mobile Solutions, S.A. de C.V.)
cyan security Chile S.p.A
cyan security Colombia S.A.S
cyan security Peru S.A.C.
cyan security USA, Inc.
I-New Bangladesh Ltd.
I-New Hungary Kft.
smartspace GmbH

The associated assets and liabilities were therefore reported as "held for sale" or under "discontinued operation" in the 2023 financial year. Financial information on the discontinued operation for the period up to the date of disposal is presented below. The assets and liabilities held for sale as at December 31, 2023 and the net assets of the discontinued operation at the time of disposal on January 1, 2024 are made up as follows

in EUR thousand	31/12/2023 / 01/01/2024
Intangible assets	301
Tangible assets	1,178
Trade receivables and other receivables	19
Inventories	2,231
Inventories	9
Tax receivables	526
Other receivables and assets	443
Contract assets	1,035
Cash and cash equivalents	907
Total assets held for sale	6,648
Provisions	11
Lease liabilities	477
Liabilities for goods and services and other liabilities	1,451
Current provisions	33
Current liabilities to banks	0
Current lease liabilities	431
Tax liabilities	1,140
Total liabilities in connection with assets held for sale	3,543
Net assets of the disposal group	3,105

in EUR thousand	01/01/2024
Cash and cash equivalents	2,000
Escrow account	884
Total consideration	2,884
Net assets of the disposal group	3,105
Result from the sale of the discontinued operation	- 221
Reclassification Translation reserve	150
Reclassification reserve IAS 8	- 6
Other	14
Tax on result	-
Result from the sale of the discontinued operation after tax	- 63
Other comprehensive income (OCI)
Reclassification reserve IAS 19 (non-recyclable)	2
Comprehensive income from the sale of discontinued operations	- 61

The result from the sale of the discontinued operation is made up as follows:

The change in consideration is due to the fact that receivables taken over subsequently turned out to be doubtful. There were also changes with regard to foreign taxes and the recharging of administrative expenses. In this context, an amount of EUR 68 thousand is reported under other operating income.

The purchasers of the BSS/OSS have undertaken to pay a purchase price improvement in the form of an earn-out in addition to the base purchase price if the adjusted revenue generated by the divested division in the financial years 2024 to 2027 exceeds a certain threshold. This earn-out agreement has not been taken into account in the result from the sale of the discontinued operation.

The net cash inflow from the sale is shown below:

in EUR thousand	01/01/2024
Consideration received in the form of cash and cash equivalents	2,000
Cash and cash equivalents disposed of with the sale	- 907
Net cash inflow from the disposal	1,093

The statement of comprehensive income and cash flow statement for the discontinued operation are as follows:

in EUR thousand	2024	2023
Discontinued operation
Revenues	-	3,907
Other operating income	-	975
Income from reversal of impairment losses on receivables	-	31
Change in inventories	-	54
Cost of materials and services procured	-	- 3,445
Personnel expenses	-	- 4,175
Impairment losses	-	- 9,628 a
Other expenses	-	- 2,497
EBITDA	-	- 14,778
Depreciation and amortization	-	- 644
Operating result (EBIT)	-	- 15,422
Financial income	-	461
Financial expenses	-	- 58
Earnings before taxes	-	- 15,019
Taxes on the result from ordinary activities of the
discontinued operation	-	- 386
Net profit/loss for the year from discontinued
operations	-	- 15,404
Profit/Loss from the sale of the discontinued operation	- 63	-
Profit/Loss from the discontinued operation	- 63	- 15,404
Other comprehensive income (OCI)
Gains (losses) from exchange rate differences from
discontinued operations	-	149
Reclassification reserve IAS 19 (non-recyclable)	2	-
Total result for the financial year	- 61	- 15,255

aThe impairment loss of EUR 9.6 million results from the impairment allocated to contract assets at fair value less costs to sell. The fair value was based on the purchase price provisionally agreed with the buyer at the time for the discontinued operation.

in EUR thousand	2024	2023
Cash flow from operating activities of the discontinued
operation	- 2,000	984
cash flow from investing activities	1,093	- 66
cash flow from financing activities	-	- 703
Change in cash and cash equivalents of discontinued
operations	- 907	215

Notes to the consolidated balance sheet

[12] Intangible assets

The following table shows the development of intangible assets:

in EUR thousand	Patents, customer relations & similar rights	Software	Self developed software	Goodwill	Total
As of 01/01/2023
Acquisition costs	17,916	20,923	966	30,779	70,584
Accumulated depreciation	- 12,854	- 17,951	- 183	- 9,000	- 39,988
Book value before IFRS 5 reclassification	5,062	2,972	783	21,779	30,596
Financial year 31/12/2023
Opening book value	5,062	2,972	783	21,779	30,596
Additions – purchases	8	17	-	-	24
Reclassifications Acquisition costs	27	- 27	-	-	-
Reclassification of accumulated depreciation	-	-	-	-	-
Disposals of acquisition costs	-	- 54	-	-	- 54
Disposals of accumulated depreciation	-	52	-	-	52
Depreciation	- 773	- 1,422	- 54	-	- 2,249
Currency difference Depreciation	-	- 0	-	-	- 0
Book value before IFRS 5 reclassification	4,323	1,538	729	21,779	28,369
IFRS 5 reclassification	168	134	-	-	301
Book value after IFRS 5 reclassification	4,155	1,404	729	21,779	28,067
Currency translation Acquisition costs	-	5	-	-	5
Currency translation accumulated
depreciation	-	- 5	-	-	- 5
As of 01/01/2024
Acquisition costs	17,950	20,864	966	30,779	70,559
Accumulated depreciation Book value before IFRS 5 reclassification	- 13,627 4,323	- 19,326 1,538	- 237 729	- 9,000 21,779	- 42,191 28,369

IFRS 5 reclassification	168	134	-	-	301
Carrying amount after IFRS 5
reclassification	4,155	1,404	729	21,779	28,067
Financial year December 31, 2024
Opening carrying amount before IFRS 5	4,323	1,538	729	21,779	28,369
Additions – purchases	-	-	-	-	-
Reclassifications	-	-	-	-	-
Reclassification	-	-	-	-	-
Disposals	- 257	- 25,033	-	-	- 25,290
Depreciation	89	24,900	-	-	24,989
Currency difference	- 731	- 1,363	- 54	-	- 2,149
Depreciation	-	-	-	-	-

Carrying amount	3,423	41	675	21,779	25,918
As at 30 June 2024
Currency conversion Acquisition costs	-	- 2	-	-	- 2
Currency conversion Accumulated
depreciation	-	2	-	-	2
Acquisition costs	17,693	- 4,171	966	30,779	45,267
Accumulated depreciation	- 14,270	4,212	- 291	- 9,000	- 19,349
Book value	3,423	41	675	21,779	25,918

Most of the disposals in 2024 are attributable to the sale of the BSS/OSS division.

The capitalized development costs of internally generated software amount to EUR 675 thousand (2023: EUR 729 thousand) and mainly consist of personnel costs.

Trademark rights, which have an indefinite useful life and are included in the item patents, customer relationships & similar rights, have a carrying amount of EUR 32 thousand (2023: EUR 32 thousand).

Goodwill in the amount of EUR 21,779 thousand is reported in the consolidated financial statements. This results from the acquisition of cyan Security Group GmbH by cyan AG in the course of the IPO in 2018. The goodwill was therefore allocated in full to the cash-generating unit (CGU) "Cybersecurity". This consists of the cyan companies that were already part of the cyan Digital Security GmbH (formerly: I-New Unified Mobile Solutions GmbH) subgroup before its acquisition in July 2018 and at the same time form an operating segment within the meaning of IFRS 8. An impairment test was therefore mandatory for the CGU Cybersecurity

For this purpose, the recoverable amount of the CGU must be compared with its carrying amount. The recoverable amount is the higher of the fair value less costs to sell and the value in use. In accordance with the measurement hierarchy in IFRS 13, fair values are to be determined primarily on the basis of market prices and can, for example, be based on existing, binding purchase offers, secondary pricing on active markets or comparable recent transactions within the industry. If it is not possible to use market price-oriented methods, capital value-oriented methods (discounted cash flow method) are used, as in this case.

The recoverable amount of the CGU was determined as its value in use using a discounted cash flow calculation. The cash flows are derived from the business plan, including the cash flow plan, which is approved by the Management Board and updated on a regular basis. Future expansion investments and restructuring expenses are only included in the calculation of the value in use if there is already an official obligation to do so, as the value in use must correspond to the value of the asset or group of assets in its current condition. An after-tax interest rate that reflects current market assessments, the time value of money and the specific risks of the asset or CGU is used as the discount rate. The corresponding pre-tax interest rate is determined iteratively. The weighted average cost of capital (WACC) is used to determine recoverable amounts using capital value-oriented methods. The WACC, the planned sales and the growth rate for the perpetual annuity are the most important planning assumptions to whose change the recoverable amount reacts most sensitively.

The return on equity is determined using the capital asset pricing model (CAPM) from the base interest rate, market risk premium and beta factor (9.56%, previous year: 11.1%). The interest rate on borrowed capital corresponds to the risk premium for corporate loans for comparable companies (pre-tax interest rate: 5.8%, previous year 4.7%). Appropriate surcharges are taken into account to reflect the country risk. On this basis, the WACC was determined at around 9.4% (previous year: 10.5%) (pre-tax interest rate: 11.6%, previous year: 13.6%). Due to the volatile financial market environment, the development of the cost of capital (and country risk premiums in particular) is continuously monitored. Financial surpluses expected after the detailed planning period of five years are taken into account using a terminal value calculation, assuming an infinite growth rate of 2%.

The impairment test did not reveal any need for impairment as at December 31, 2024. Cyan has performed a sensitivity analysis to changes in the key assumptions used to determine the recoverable amount of the CGU. The management is of the opinion that any reasonably possible change in the key assumptions on which the recoverable amount of the CGU is based would not result in the carrying amount exceeding the total recoverable amount.

[13] Property, plant and equipment

The development of property, plant and equipment is as follows:

in EUR thousand	Building equipment	Machinery and similar equipment	Other equipment/ office equipment	Total
As of 01/01/2023
Acquisition costs	4,481	606	798	5,885
Accumulated depreciation	- 1,817	- 138	- 598	- 2,553
Book value before IFRS 5 reclassification	2,664	468	201	3,332

Financial year as at 31/12/2023
Opening book value	2,664	468	201	3,332
Additions – purchases	624	309	524	1,457
Reclassifications Acquisition costs	-	-	-	-
Reclassifications of accumulated depreciation	-	-	-	-
Disposals Acquisition costs	- 209	- 385	8	- 586
Disposals of accumulated depreciation	-	-	- 8	- 8
Depreciation	- 731	- 100	- 103	- 934
Exchange rate difference Book value before IFRS 5 reclassification	- 16 2,332	0 291	- 0 621	- 16 3,244

Currency conversion Acquisition costs	184	- 6	7	185
Currency conversion accumulated depreciation	- 121	- 1	- 6	- 127
Book value before IFRS 5 reclassification	2,395	284	623	3,302
IFRS 5 reclassification	822	284	72	1,178
Book value after IFRS 5 reclassification	1,573	-	551	2,124
As of 01/01/2024
Acquisition costs	5,080	523	1,338	6,941
Accumulated depreciation	- 2,685	- 239	- 715	- 3,639
Book value before IFRS 5 reclassification	2,395	284	623	3,302
IFRS 5 reclassification	822	284	72	1,178
Carrying amount after IFRS 5
reclassification	1,573	-	551	2,124
Financial year December 31, 2024
Opening book value	2,395	284	623	3,302
Additions – purchases	88	-	47	134
Reclassifications	-	-	-	-
Acquisition costs	-	-	-	-
Reclassifications	- 2,591	- 523	- 464	- 3,579
Disposals	1,765	239	384	2,388
Acquisition costs	- 293	-	- 54	- 346
Disposals	- 1	-	- 0	- 1
Depreciation	1,363	-	535	1,899
Exchange rate difference	7	-	1	7

Book value	- 1	-	- 0	- 1
Currency conversion acquisition costs	1,369	-	536	1,905
Currency conversion accumulated depreciation
Book value	2,583	-	921	3,504
As of 30 June 2024	- 1,214	-	- 385	- 1,599
Acquisition costs	1,369	-	536	1,905

This table also includes the rights of use arising from IFRS 16.

Most of the disposals in 2024 are attributable to the sale of the BSS/OSS division.

The following table shows the development of right-of-use assets within the balance sheet item property, plant and equipment:

in EUR thousand	Buildings	Vehicles	Fiber Optic	Total
As of 01/01/2023
Acquisition costs	3,907	82	129	4,117
Accumulated depreciation	- 1,647	- 75	- 49	- 1,770
Book value	2,260	7	80	2,347
Financial year 31/12/2023
Opening book value	2,260	7	80	2,347
Additions	624	34	8	666
Disposals Acquisition costs	- 209	-	-	- 209
Disposals accumulated depreciation	-	-	-	-
Depreciation	- 670	- 17	- 29	- 715
Currency difference	- 16	-	-	- 16
Book value	1,990	24	60	2,073
Currency conversion acquisition costs	175	-	-	175
Currency conversion accumulated depreciation	- 114	-	-	- 114
Book value before IFRS 5 reclassification
	2,051	24	60	2,134
IFRS 5 reclassification	796	-	60	855
Book value after IFRS 5 reclassification	1,255	24	-	1,279
As of 01/01/2024
Acquisition costs	4,497	115	137	4,749
Accumulated depreciation	- 2,447	- 91	- 77	- 2,615
Book value before IFRS 5 reclassification	2,051	24	60	2,134
IFRS 5 reclassification	796	-	60	855
Book value after IFRS 5 reclassification	1,255	24	-	1,279
Financial year December 31, 2024
Opening book value	2,051	24	60	2,134
Additions	88	43	-	131
Disposals Acquisition costs	- 2,504	- 115	- 137	- 2,756
Disposals accumulated depreciation	1,704	107	77	1,888

Depreciation	- 236	- 25	-	- 261
Currency difference	- 1	-	-	- 1
Book value	1,102	33	-	1,135
Currency conversion acquisition costs	7	-	-	7
Currency conversion accumulated depreciation	- 1	-	-	- 1
Book value	1,107	33	-	1,141
As at 31 December 2024
Acquisition costs	2,087	43	-	2,131
Accumulated depreciation	- 980	- 10	-	- 990
Book value	1,107	33	-	1,141

Most of the disposals in 2024 are attributable to the sale of the BSS/OSS division.

[14] Contract assets, contract costs and contract liabilities from contracts with customers

The following table contains the status of contract costs (costs to initiate a contract and costs to fulfill a contract), receivables, contract assets and contract liabilities from contracts with customers in accordance with IFRS 15:

in EUR thousand	31/12/2024	31/12/2023
Trade accounts receivable	1,230	1,047
thereof non-current	-	-
thereof current	1,230	1,047
Contract assets	704	489
thereof non-current	-	-
thereof current	704	489

In connection with the insolvency filing of Wirecard Technologies GmbH, the contract assets recognized in 2019 on the basis of the Wirecard contract were impaired by 100% (i.e. EUR 4,785 thousand) in 2020.

[15] Deferred taxes

The tax effects of temporary differences, tax loss carryforwards and tax credits that lead to the recognition of deferred tax assets and liabilities are as follows:

in EUR thousand	31/12/2024	31/12/2023
Deferred tax assets
Non-current assets	-	1
Losses carried forward	-	0
Deferred tax liabilities
Non-current assets	-	0
Net deferred tax assets	-	1

Due to tax planning, future profits are expected against which the deferred tax assets can be offset.

in EUR thousand	31/12/2024	31/12/2023
Deferred tax assets
Non-current assets	11	14
Current assets	0	0
Non-current provisions and liabilities	213	249
Current provisions and liabilities	69	67
Losses carried forward	4,808	4,920
Deferred tax liabilities
Non-current assets	1,189	1,700
Current assets	0	1
Non-current provisions and liabilities	4,106	4,106
Current provisions and liabilities	0	0
Net deferred tax liabilites	196	557

Deferred tax assets and deferred tax liabilities are netted for each country if certain conditions are met. These conditions are met if there is a legally enforceable right to offset current tax assets against current tax liabilities, if these relate to income taxes levied by the same tax authority and cyan intends to settle its current tax assets and liabilities on a net basis. The net deferred tax liabilities originate from the companies in Germany. The deferred tax assets originate from Thailand.

In accordance with the eco-social tax reform in Austria, which was passed in January 2022, the corporate tax rate was 24% in 2023 and was reduced to 23% from 2024.

The development of deferred taxes and the breakdown of changes into components recognized in profit or loss and components recognized directly in equity are shown in the following table:

in EUR thousand	Deferred tax assets	Deferred tax liabilities	Currency difference	Losses from disposal of business operations
Balance as at January 1, 2023	593	2,505	-	-
Changes recognized in profit or loss	- 593	- 1,948	34	-
Changes recognized directly in equity	-	-	-	-
Balance as at December 31,
2023	1	557	-	-
Balance as at January 1, 2024	1	557	-	-
Changes recognized in profit or
loss	- 1	- 361	- 0	- 6
Changes recognized directly in equity	-	-	-	-
Balance as at December 31, 2024	-	196	-	-

[16] Financial instruments

in EUR thousand	IFRS 9a	Level	Book values 31/12/2024	Book values 31/12/2023
Assets
Cash and cash equivalents	AC	n/a	816	2,872
Trade receivables and other
receivables	AC	n/a	1,230	1,047
Liabilities
Leasing liabilities (non-current)	AC	n/a	1,003	1,168
Leasing liabilities (current)	AC	n/a	267	257
Current financial liabilities	AC	n/a	-	0
Trade payables and other liabilities	AC	n/a	1,940	4,712
Other non-current financial
liabilities	AC	n/a	784	748
Other non-current liabilities	AC	n/a	84	207

aClassification in accordance with IFRS 9 (AC = Accumulated Cost).

A fair value measurement according to level 2 (capital value-oriented) resulted in a fair value of EUR 1,255 thousand for the lease liabilities as at December 31, 2024.

Non-current financial liabilities include fixed-interest loans from the Austrian Research Promotion Agency (FFG). The FFG loans are measured at amortized cost and amounted to EUR 784 thousand as at 31 December 2024. A fair value measurement according to level 2 (capital value-oriented) resulted in a fair value of EUR 760 thousand.

[17] Receivables

Receivables are classified by maturity as follows:

in EUR thousand	31/12/2024	31/12/2023
Other receivables	7	3
Non-current receivables	7	3
Trade receivables	1,230	1,047
Receivables from taxes on income	8	4
Accruals and deferred income	179	94
Other receivables and assets	1,913	2,368
Current receivables	3,329	3,514
Receivables	3,337	3,516

Other non-current receivables consist mainly of security deposits. None of them were overdue or impaired.

Specific valuation allowances of EUR 4,785 thousand (2023: EUR 7,609 thousand - EUR 4,785 thousand after IFRS 5 reclassification) and no impairment losses in accordance with IFRS 9 (2023: EUR 42 thousand - EUR 0 thousand after IFRS 5 reclassification) were deducted from trade receivables.

Other current receivables mainly consist of the portion of the purchase price for the discontinued operation deposited in an escrow account and research premiums.

The following table shows the development of impairment losses on financial assets with an impaired credit rating as at the reporting date:

in EUR thousand	2024
Impairment losses 01/01	4,785
Allocation	-
Reversal of impairment losses	-
Currency difference	-
Foreign currency valuation	-
Impairment losses 31/12	4,785

Assignment by way of security

Cyan had transferred trade receivables to Erste Bank der oesterreichischen Sparkassen AG ("Erste Bank" for short) as security for all receivables and other claims of Erste Bank arising from credits and loans already granted or to be granted in the future to cyan Security Group GmbH. There was no advance payment of the receivable to cyan by Erste Bank. The receivables were not derecognized, as essentially all risks and opportunities, primarily the default risk, remained with cyan due to a right of recourse. The third-party debtors were informed of the assignment in writing. In accordance with the agreement with the bank, the customers settled their liabilities by payment to an account specially set up for this purpose at the bank, whereby cyan retained the right to dispose of the funds paid. The receivables were held in a business model to collect cash flows, which is consistent with the amortized recognition of the receivables. As the secured loan was repaid in 2023, the collateral assignment has also expired.

[18] Means of payment

The following table contains information on the means of payment:

in EUR thousand	31/12/2024	31/12/2023
Cash on hand	0	0
Deposits with credit institutions	816	2,872
Cash and cash equivalents	816	2,872

Bank balances include fixed-term deposit accounts in the amount of kEUR 220.8, which cannot be accessed on a daily basis.

[19] Equity

The share capital amounted to EUR 20,189,486.00 as at December 31, 2024 (December 31, 2023: EUR 20,189,486.00) and is fully paid in. Changes in share capital and capital reserves are shown in the statement of changes in equity.

As at the reporting date, there were 20,189,486 shares in circulation (12/31/2023: 20,189,486 shares), with a nominal value of EUR 1.00 per share (12/31/2023: EUR 1.00). Details on the share are explained in the "cyan share" section.

The following tables explain the weighting of the shares for the calculation of earning per share, which is calculated on the basis of earnings after tax. The weighted number of shares is identical for diluted and undiluted earnings per share in the financial year.

Calculation of weighting of shares 2024:

Transaction date	Shares outstanding	Treasury shares	Total shares	Weighting (days)	Weight. avg. of shares outstanding
31/12/2023	21,689,486	-	21,689,486	-	21,678,206
31/12/2023	21,689,486	-	21,689,486	-	21,678,206

Shares outstanding	Treasury shares	Total shares	Weighting (days)	Weight. avg. of shares outstanding
17,016,800	-	17,016,800	365	17,016,800



20,189,486	-	20,189,486	-	18,888,585
1,500,000	-	1,500,000	-	-
21,689,486	-	21,689,486	-	18,888,585

Calculation of weighting of shares 2023:

aThe convertible bonds in the amount of EUR 1.5 million were converted in 2024.

The capital reserves result from payments by shareholders and convertible bonds. The other reserves include IAS 19 reserves, currency translation reserves, which relate to exchange rate differences from the translation of the annual financial statements of foreign subsidiaries, and IAS 8 corrections. The reserves in accordance with IAS 19 result from changes in actuarial assumptions regarding a provision for severance payments; the resulting effects were recognized in other comprehensive income and derecognized with the sale of the business operations in 2024.

In December 2023, cyan AG (issuer) resolved to issue a new convertible bond. The nominal value amounts to EUR 1.5 million and is divided into EUR 1.5 million partial debentures with equal rights (nominal amount per partial debenture EUR 1.00). The partial debentures are securitized for the entire term by a global bearer certificate without an interest coupon. Each partial debenture bears interest at 1% p.a. on its nominal amount from January 1, 2024 until maturity (December 31, 2024), unless they are repaid or converted earlier. Neither the bond debtor nor the bondholders have a right to ordinary termination. In the event of insolvency, the opening of insolvency proceedings or liquidation of the issuer, the bondholders have an extraordinary right of termination. Each bondholder has the irrevocable right to convert one partial bond without additional payment into one no-par value share (notional interest in the share capital EUR 1.00) (conversion ratio 1:1). The partial exercise of the conversion right of partial debentures is excluded. However, the bond debtor is entitled to determine a mandatory conversion of the convertible bond (conversion ratio 1:1) in the last two months before maturity. In 2024, convertible bonds in the amount of around EUR 1.5 million were converted, which will be recognized in the capital reserves until entry in the commercial register.

The adjustment in accordance with IAS 8 relates to the correction of errors from previous periods and was made retrospectively in accordance with the requirements of the standard. No error corrections in accordance with IAS 8 were made in the consolidated financial statements for the 2024 financial year.

[20] Financial liabilities

Non-current financial liabilities mainly comprise lease liabilities and loans taken out. The lease liabilities have been discounted to the respective contract term using the respective incremental borrowing rate. The loans were discounted at a fixed interest rate of 2.00% and 0.75% respectively.

[21] Trade payables and other liabilities

Other liabilities are broken down by maturity as follows:

in EUR thousand	31/12/2024	31/12/2023
Advance payments received	64	3,105
Trade payables	492	243
Trade accounts payable	556	3,348
Liabilities to employees	213	-
Social security contributions	91	275
Accruals and deferred income	11	15
Other	1,116	1,073
Other current liabilities	1,431	1,364
Trade accounts payable and other current liabilities	1,986	4,712
Non-current liabilities	84	207
Trade accounts payable and other liabilities	2,071	4,919

[22] Provisions

Provisions include the following items:

Personnel expenses	Consulting expenses	Other	Total

-	4	18	21
-	-	12	12
-	112	1	112


-	116	6	121
-	- 28	- 6	- 33



-	88	-	88
-	88	-	88
-	-	-	-

-	-	-	-

in EUR thousand	31/12/2024	31/12/2023
Present value of the severance payment obligation as
of 01/01	-	11
Service cost for the period	-	2
Interest expense	-	1
Severance payments	-	-
Revaluations from experience adjustments	-	- 4
Revaluations from changes in demographic assumptions	-	-
Revaluation from changes in financial assumptions	-	-
Actuarial assumptions	-	0
Currency difference	-	1
Present value of severance payment obligations as of
31/12 after IFRS 5 Reclassification	-	11
IFRS 5 Reclassification	-	11
Present value of severance payment obligations as of
31/12	-	-

The non-current provisions relate to the following provision for severance payments:

The provision for severance payments was calculated actuarially, whereby assumptions were made with regard to discount rates, future salary increases and mortality. No further information is provided on actuarial assumptions due to the immateriality of the provision. Future deviations from the assumptions made may lead to changes in the value of the provision. As this would only have an extremely minor effect due to the amount of the provision, no sensitivity analysis was carried out.

Notes to the consolidated cash flow statement

The cash flow statement was prepared using the indirect method. It shows the changes in cash and cash equivalents resulting from the inflow and outflow of funds during the reporting period and distinguishes between cash flows from operating, investing and financing activities. The funds reported in the cash flow statement are cash and cash equivalents.

[23] Cash flow from operating activities

Cash flow from operating activities shows the cash flows from the provision and acceptance of services during the reporting period and includes changes in current assets.

[24] Cash flow from investing activities

Cash flow from investing activities mainly comprises cash outflows for the purchase of property, plant and equipment and intangible assets.

[25] Cash flow from financing activities

Cash flow from financing activities consists of the capital increase and the repayment of loans. It also includes cash outflows for leases.

The following table shows the changes in liabilities from financing activities:

in EUR thousand	01/01/2024	Cash flows	Foreign exchange difference	New leasing contracts	Other	31/12/2024
Short-term interest
bearing loans	0	- 0	-	-	-	-
Long-term interest
bearing loans	748	36	-	-	-	784
Leasing liabilities	1,426	- 295	5	131	3	1,270
Financial liabilities	2,174	- 259	5	131	3	2,054

in EUR thousand	01/01/ 2023	Cash flows	Foreign exchange difference	New leasing contracts	Other	31/12/ 2023	IFRS 5 Reclassific ation	31/12/ 2023 after IFRS 5 Reclassific ation
Short-term
interest
bearing loans	2	- 2	-	-	-	0	0	0
Long-term
interest
bearing
loans	3,705	89	-	-	- 3,046	748	-	748
Leasing
liabilities	2,952	- 1,010	- 2	909	- 516	2,333	908	1,426
Financial
liabilities	6,659	- 923	- 2	909	- 3,561	3,082	908	2,174

Financial instruments and risk management

General information

The main financial instruments used by cyan include deposits, trade receivables, lease liabilities, financial liabilities and trade payables.

cyan does not use derivative financial instruments.

The risks that cyan has to take into account are as follows:

Liquidity risk
Credit/creditworthiness risk
Currency risk
Interest rate risk

Liquidity risk

Liquidity risk refers to the risk of not being able to meet payment obligations because the company does not have sufficient liquid funds. Prudent liquidity risk management means having sufficient cash and cash equivalents and an appropriate amount of committed credit lines available to meet due obligations and close out market positions.

cyan uses rolling financial and liquidity planning to determine liquidity requirements. Care is taken to ensure that sufficient liquid funds are available at all times to settle liabilities due in the companies and that these are held at banks with a very high credit rating.

At the end of the reporting period, cyan held immediately available bank balances and cash balances of EUR 816 thousand (31/12/2023: EUR 3,779 thousand - EUR 2,872 thousand after IFRS 5 reclassification), which mitigate the liquidity risk. The future liquidity situation at cyan depends to a large extent on customer payments and thus the development of sales. Due to the acquisition of new customers, the Management Board assumes a stable future liquidity situation, whereby cyan is also dependent on marketing by its partners. Based on the steady subscriber growth among existing customers in the cybersecurity segment and new customer projects in the 2024 financial year, the Management Board assumes that revenue will most likely increase as shown in the forecast and that the cash and cash equivalents generated will be sufficient to cover ongoing financial requirements. Nevertheless, project delays could occur, for example, as a result of which individual projects may only generate revenue with a delay and thus generate cash flows at a later date, existing customers may default entirely or the planned revenue growth may not materialize due to lower subscriber numbers. Consequently, there is a residual risk that cash flows will not occur as planned. The option of a short-term financing facility is planned as a means of bridging potential liquidity bottlenecks. In the event of further financing requirements, e.g. to implement strategic projects or in the event of the aforementioned adverse economic developments, the company would be reliant on external financing in the forecast period. The Management Board assumes that the Group and its companies will be able to meet their payment obligations and continue their business activities, in particular due to the positive developments in cyan's core business that have already occurred up to the preparation of these financial statements, the conservative planning assumptions and the available financing framework.

A maturity analysis of all liabilities existing on the balance sheet date is as follows and also shows cyan's liquidity risk:

in EUR thousand	Up to 1 year	2-5 years	5 years
31/12/2024
Loans	258	526	-
Trade payables	1,986	-	-
Leasing liabilities	267	810	193
31/12/2023
Loans	0	-	-
Trade payables	-	688	60
Leasing liabilities	4,712	-	-
Other financial liabilities	257	986	182

Credit/creditworthiness risk

Credit risk refers to financial losses resulting from the non-fulfilment of contractual obligations by business partners.

Cash and cash equivalents are mainly held with banks with good credit ratings. The holdings are invested in short-term bank accounts. The credit risk is therefore low.

Receivables are classified as financial assets with impaired creditworthiness if there are specific indications of impairment (in particular significant financial difficulties on the part of the debtor, default or late payment, increased insolvency risk). If a financial asset is significantly overdue by more than 180 days, a specific valuation allowance is considered. A write-down (derecognition) is made if insolvency is established or if the receivable is deemed uncollectible for other reasons. If the reasons for the impairment no longer apply, the impairment loss is reversed up to the amortized cost.

The maximum theoretical default risk corresponds to the receivables recognized in the balance sheet.

As the defaults varied greatly from country to country, a group analysis was not carried out. The following table contains information on the default risk and the recognized expected credit losses for financial instruments broken down by geographical region:

in EUR thousand	Loss rate	Gross book value (closing rate)	Impairment (average rate)
2024
Not overdue	0.00%	1,026	-
1 - 30 days overdue	0.00%	56	-
31 - 60 days overdue	0.00%	44	-
61 - 90 days overdue	0.00%	10	-
More than 90 days overdue	0.00%	-	-

2023
Not overdue	0.00%	588	-
1 - 30 days overdue	0.00%	304	-
31 - 60 days overdue	0.00%	20	-
61 - 90 days overdue	0.00%	2	-
More than 90 days overdue	0.00%	28	-

in EUR thousand	Loss rate	Gross book value (closing rate)	Impairment (average rate)
2023
Not overdue	40.61%	23	9
1 - 30 days overdue	45.17%	-	-
31 - 60 days overdue	51.44%	-	-
61 - 90 days overdue	68.37%	-	-
More than 90 days overdue	74.87%	44	32

Future-oriented aspects (such as macroeconomic changes) are taken into account in the loss rates with a percentage mark-up. The Mexican company was deconsolidated on January 1, 2024, which is why the impairment losses on trade receivables were no longer calculated for the company for 2024.

Impairment

The following table shows the impairment losses on trade receivables, contract assets and lease receivables as well as the loss from the derecognition of financial assets measured at amortized cost by segment:

in EUR thousand	2024	2023
Impairment IFRS 9	-	- 31
Currency difference	-	-
Other specific valuation allowances	-	9,543
Loss from derecognition of financial assets measured at
amortized cost	-	577
Write-down of receivables	17	85
Total	17	10,174

IFRS 5 reclassification	-	9,597
Total in accordance with IFRS 5 Reclassification	17	577

Impairment losses in accordance with IFRS 9 developed as follows in the 2024 and 2023 balance sheets

in EUR thousand	2023
Impairment 01.01.2023	68
Allocation	-
Reversal	- 32
Currency difference	-
FW valuation	7
Impairment losses 12/31/2023	42
IFRS 5 Reclassification	42
Impairments 12/31/2023 in accordance with IFRS 5
Reclassification	-

The IFRS 9 impairment was derecognized with the sale of the business and there were no impairments in accordance with IFRS 9 in 2024.

The contract assets developed as follows in 2024 and 2023

in EUR thousands	2023
Contract assets 01/01/2023	14,933
Allocation	822
Dissolution	- 4,688
Contract assets 12/31/2023	11,067
IFRS 5 Impairment	- 9,543
Subtotal	1,524
IFRS 5 Reclassification	- 1,035
Contract assets 12/31/2023 in accordance with IFRS 5
Reclassification	489
in EUR thousands	2024
Contract assets 01/01/2024	489
Allocation	215
Dissolution	-
Contract assets 12/31/2024	704

Currency risk

Currency risk is the potential loss due to fluctuating exchange rates. Cyan is exposed to certain currency risks due to its underlying international business. The company's finance department constantly monitors these risks and in particular the foreign currency exchange rates in order to be able to react appropriately. Should a significant currency risk arise in the short term, this could have a negative impact on cyan's net assets, financial position and results of operations.

Insofar as expenses and investments are not made in euros, exchange rate fluctuations can affect cyan's solvency and have a negative impact on cyan's results and earnings situation. In summary, this risk can be classified as very low due to the low level of expenses in currencies other than the euro and is therefore not quantified.

Interest rate risk

Interest rate risk refers to the risk that interest expenses or interest income may change adversely. All loans have fixed interest rates, which is why the interest rate risk is classified as low and no sensitivity analysis was carried out.

Capital management

Information on cyan's earnings, financial and asset situation (capital management) is included in the Group management report. With an equity ratio of 86 % (previous year: 73 %), cyan relies primarily on the financing of its shareholders.

Other explanations

Related companies and persons

As all subsidiaries are fully consolidated and transactions are therefore eliminated, there are no transactions with related parties. With regard to persons subject to reporting requirements - such as members of the Management Board - please refer to the section "Information on the remuneration of the Management Board and Supervisory Board"

Information on the remuneration of the Management Board and Supervisory Board members

Remuneration of the Management Board

The Management Board of cyan AG consisted of the following members as at December 31, 2024

Thomas Kicker (from 01.01.2024)
Markus Cserna
Frank von Seth (until 31.08.2023)

The remuneration of the members of the cyan AG Management Board is made up as follows.

in EUR thousand	Current remuneration 2023				Current remuneration 2022
	fisec	variable	Total	fisec	variable	Total
Total	179	170	349	134	9	143

The remuneration of the Management Board consists of fixed salaries and one-off bonuses. A bonus arrangement has been or will be agreed with the members of the Management Board. An agreement was also concluded with the members of the Management Board regarding a phantom share program. Details can be found under the heading "Share-based payments".

The members of the Management Board also receive remuneration from a subsidiary, which is not included in the above information. The remuneration of the members of the Management Board of cyan AG, which comes from a subsidiary, is made up as follows.

in EUR thousand	Current remuneration 2023					Current remuneration 2022
	fisec	variable	Total	fisec	variable	Total
Total	507	70	577	425	-	425

In addition to the current fixed remuneration, benefits in kind total EUR 3 thousand (2023: EUR 15 thousand) and cash expenses total EUR -15 thousand (2023: EUR -8 thousand).

Remuneration of the Supervisory Board members

The following are members of the Supervisory Board of cyan AG:

Lucas Prunbauer, Deputy Chairman
Markus Messerer (since 31.03.2023)
Alexander Singer (since 10.07.2023), Chairman
Stefan Schütze (until 10.07.2023)
Alexandra Reich (until 31.03.2023)

The members of the Supervisory Board of cyan AG receive the following remuneration:

in EUR thousand	2024	2023
Total	123	132

Share-based payments

The Management Board is granted cash-settled, share-based payments within the meaning of IFRS 2 in the form of a phantom stock program. A distinction is made between a basic allocation, which only applies to one member of the Management Board, and bonus allocations for the Management Board as a whole.

The prerequisite for the staggered allocation of phantom shares from the basic allocation is the uninterrupted term of office of the Management Board from 01.01.2024. The basic allocation is divided into 3 periods. The full receipt of the phantom stock is linked to an uninterrupted term of office of 36 months. If the Management Board member resigns prematurely or is dismissed for good cause before December 31, 2026, the phantom stock already granted from the basic allocation is forfeited in full. In all other cases of termination of the employment relationship before December 31, 2026, the Management Board member may retain the phantom stock previously allocated to him from the basic allocation.

The program also provides for 3 bonus allocations, which are defined with respective performance targets. If the defined targets are met, the phantom stocks earmarked for this purpose are allocated to the Management Board. If the Management Board member resigns prematurely or is dismissed for good cause before December 31, 2026, he or she is entitled to 50% of the allocated phantom stock from the bonus allocation.

Once the Management Board service contract has been fulfilled in full, the stock market price of cyan AG shares on the home stock exchange (Frankfurt) as at December 30, 2026 is used to calculate the gross payout value of phantom stocks achieved from all allocations, whereby the respective closing stock market price is multiplied by the number of phantom stocks. If the employment relationship ends before December 30, 2026 and the Management Board is entitled to phantom stocks, the stock market price on the day the employment relationship ends is to be used. From today's perspective, the Management Board assumes that only the basic allocation will be allocated. The valuation of the basic allocation as at December 31, 2024 was based on the share price as at December 31, 2024.

The total expense recognized for the share-based payments from the base allocation, which was expensed immediately in 2024, and the total carrying amount of the liabilities from share-based payments as at 31.12.2024 amount to EUR 186,481.92.

Contingent liabilities

Contingent liabilities comprise guarantees for rental deposits and credit cards and amounted to EUR 221 thousand as at the reporting date (31.12.2023: EUR 670 thousand). No utilization is currently expected.

Audit fee

The expenses for the Group auditor attributable to the financial year are broken down as follows:

in EUR thousand	2024	2023
Expenses for audit services	127	157
thereof from previous years	24	20
Expenses for other certification services	-	-

Significant events after the balance sheet date

The date of approval of the consolidated financial statements by the Management Board in accordance with IAS 10.17 is April 25, 2025. These consolidated financial statements are subject to approval by the Supervisory Board (Section 171 (2) AktG).

On February 24, 2025, the issue of around EUR 1.5 million subscription shares in connection with the convertible bonds was entered in the commercial register, whereupon they were reclassified from capital reserves to share capital.

During the period of preparation of the consolidated financial statements, a former customer of Cyan Digital Security GmbH, which was transferred to the buyer with all rights and obligations as part of the sale of the BSS/OSS business segment on January 1, 2024, also made doubtful claims against cyan and the buyer. As all risks in connection with this customer relationship are borne in full by the buyer, no impact on cyan's net assets, financial position and results of operations is expected.

No other significant events occurred between the balance sheet date on December 31, 2024 and the release for publication.

Munich, April 25, 2025

Thomas Kicker CEO

Markus Cserna CTO

Independent Auditor's Report

This auditor's report is a convenience translation of the German original and is solely issued on the German original annual report.

Please find the German original under the following link: ir.cyansecurity.com

To cyan AG, Munich

Audit assessments

We have audited the consolidated financial statements of cyan AG, Munich, and its subsidiaries (the Group), which comprise the consolidated statement of financial position as at December 31, 2024, the consolidated statement of comprehensive income, the consolidated statement of changes in equity and the consolidated statement of cash flows for the financial year from January 1, 2024 to December 31, 2024, and notes to the consolidated financial statements, including a summary of significant accounting policies. In addition, we have audited the group management report of cyan AG, Munich, for the financial year from January 1, 2024 to December 31, 2024.

In our opinion, based on the findings of our audit:

the accompanying consolidated financial statements comply, in all material respects, with the IFRS Accounting Standards issued by the International Accounting Standards Board (hereinafter referred to as "IFRS Accounting Standards") as adopted by the EU and the additional requirements of German commercial law pursuant to Section 31 Se para. 1 HGB and, in compliance with these requirements, give a true and fair view of the assets, liabilities and financial position of the Group as at December 31, 2024 and of its financial performance for the financial year from January 1, 2024 to December 31, 2024, and
the accompanying Group management report as a whole provides a suitable view of the Group's position. In all material respects, this Group management report is consistent with the consolidated financial statements, complies with German legal requirements and appropriately presents the opportunities and risks of future development

Pursuant to § 322 Abs. 3 Satz 1 HGB, we declare that our audit has not led to any reservations relating to the legal compliance of the consolidated financial statements and of the group management report.

Basis for the audit opinions

We conducted our audit of the consolidated financial statements and of the group management report in accordance with § 317 HGB and German generally accepted standards for the audit of financial statements promulgated by the Institut der Wirtschaftsprüfer [Institute of Public Auditors in Germany] (IDW). Our responsibilities under those requirements and principles are further described in the "Auditor's Responsibilities for the Audit of the Consolidated Financial Statements and of the Group Management Report" section of our auditor's report. We are independent of the Group companies in accordance with the requirements of German commercial and professional law, and we have fulfilled our other German professional responsibilities in accordance with these requirements. We believe that the audit evidence we have obtained is sufficient and appropriate to provide a basis for our audit opinions on the consolidated financial statements and on the group management report.

Other information

The legal representatives or the Supervisory Board are responsible for the other information obtained as of the date of this auditor's report. This other information comprises

the report of the Supervisory Board, and
the remaining parts of the annual report,
but not the consolidated financial statements, not the group management report and not our auditor's report thereon.

The Supervisory Board is responsible for the report of the Supervisory Board. Otherwise, the legal representatives are responsible for the other information.

Our opinions on the consolidated financial statements and on the group management report do not cover the other information, and consequently we do not express an opinion or any other form of assurance conclusion thereon.

In connection with our audit of the consolidated financial statements, our responsibility is to read the other information referred to above and, in doing so, consider whether the other information

are materially inconsistent with the consolidated financial statements, with the group management report or our knowledge obtained in the audit, or
otherwise appear to be materially misstated.

If, based on the work we have performed on the other information obtained prior to the date of this auditor's report, we conclude that there is a material misstatement of this other information, we are required to report that fact. We have nothing to report in this context.

Responsibility of the legal representatives and the Supervisory Board for the consolidated financial statements and the Group management report

Management is responsible for the preparation of the consolidated financial statements that comply, in all material respects, with IFRSs as adopted by the EU and the additional requirements of German commercial law pursuant to Section 31 Se (1) HGB and that the consolidated financial statements, in compliance with these requirements, give a true and fair view of the assets, liabilities, financial position and financial performance of the Group. In addition, management is responsible for such internal control as they have determined necessary to enable the preparation of consolidated financial statements that are free from material misstatement, whether due to fraud (i.e. accounting fraud or error) or error.

In preparing the consolidated financial statements, the legal representatives are responsible for assessing the Group's ability to continue as a going concern. Furthermore, they are responsible for disclosing, as applicable, matters related to going concern. In addition, they are responsible for financial reporting based on the going concern basis of accounting unless there is an intention to liquidate the Group or to cease operations, or there is no realistic alternative but to do so.

Furthermore, management is responsible for the preparation of the group management report that, as a whole, provides an appropriate view of the Group's position and is, in all material respects, consistent with the consolidated financial statements, complies with German legal requirements, and appropriately presents the opportunities and risks of future development. In addition, management is responsible for such arrangements and measures (systems) as they have considered necessary to enable the preparation of a group management report that is in accordance with the applicable German legal requirements, and to be able to provide sufficient appropriate evidence for the assertions in the group management report.

The Supervisory Board is responsible for overseeing the Group's financial reporting process for the preparation of the consolidated financial statements and the Group management report.

Auditor's responsibilities for the audit of the consolidated financial statements and of the group management report

Our objectives are to obtain reasonable assurance about whether the consolidated financial statements as a whole are free from material misstatement, whether due to fraud or error, and whether the group management report as a whole provides an appropriate view of the Group's position and, in all material respects, is consistent with the consolidated financial statements and the knowledge obtained in the audit, complies with the German legal requirements and appropriately presents the opportunities and risks of future development, as well as to issue an auditor's report that includes our opinions on the consolidated financial statements and on the group management report.

Reasonable assurance is a high level of assurance, but is not a guarantee that an audit conducted in accordance with Section 317 HGB and German generally accepted standards for the audit of financial statements promulgated by the Institut der Wirtschaftsprüfer (IDW) will always detect a material misstatement. Misstatements can arise from fraud or error and are considered material if, individually or in the aggregate, they could reasonably be expected to influence the economic decisions of users taken on the basis of these consolidated financial statements and the Group management report.

We exercise professional judgment and maintain professional skepticism throughout the audit. In addition

Identify and assess the risks of material misstatement of the consolidated financial statements and of the group management report, whether due to fraud or error, design and perform audit procedures responsive to those risks, and obtain audit evidence that is sufficient and appropriate to provide a basis for our opinions. The risk of not detecting a material misstatement resulting from fraud is higher than the risk of not detecting a material misstatement resulting from error, as fraud may involve collusion, forgery, intentional omissions, misrepresentations, or the override of internal control.
Obtain an understanding of internal control relevant to the audit of the consolidated financial statements and of arrangements and measures relevant to the audit of the group management report in order to design audit procedures that are appropriate in the circumstances, but not for the purpose of expressing an opinion on the effectiveness of the Group's internal control or on the effectiveness of these arrangements and measures.
Evaluate the appropriateness of accounting policies used by the executive directors and the reasonableness of accounting estimates and related disclosures made by the executive directors.
Conclude on the appropriateness of management's use of the going concern basis of accounting and, based on the audit evidence obtained, whether a material uncertainty exists related to events or conditions that may cast significant doubt on

the Group's ability to continue as a going concern. If we conclude that a material uncertainty exists, we are required to draw attention in the auditor's report to the related disclosures in the consolidated financial statements and in the group management report or, if such disclosures are inadequate, to modify our respective opinions. We draw our conclusions on the basis of the audit evidence obtained up to the date of our auditor's report. However, future events or conditions may cause the Group to cease to be able to continue as a going concern.

Evaluate the overall presentation, structure and content of the consolidated financial statements, including the disclosures, and whether the consolidated financial statements present the underlying transactions and events in a manner that the consolidated financial statements give a true and fair view of the assets, liabilities, financial position and financial performance of the Group in compliance with IFRSs as adopted by the EU and the additional requirements of German commercial law pursuant to Section 31 Se (1) HGB.
Obtain sufficient appropriate audit evidence regarding the financial information of the entities or business activities within the Group to express opinions on the consolidated financial statements and on the group management report. We are responsible for the direction, supervision and performance of the audit of the consolidated financial statements. We are solely responsible for our audit opinions.
Evaluate the consistency of the group management report with the consolidated financial statements, its conformity with German law, and the view of the Group's position it provides.
Perform audit procedures on the prospective information presented by the legal representatives in the group management report. On the basis of sufficient appropriate audit evidence we evaluate, in particular, the significant assumptions used by management as a basis for the prospective information, and evaluate the proper derivation of the prospective information from these assumptions. We do not express a separate opinion on the forward-looking statements or on the underlying assumptions. There is a significant unavoidable risk that future events will differ materially from the forward-looking statements.

We communicate with those charged with governance regarding, among other matters, the planned scope and timing of the audit and significant audit findings, including any significant deficiencies in internal control that we identify during our audit.

Munich, April 25, 2025

Rödl & Partner GmbH Wirtschaftsprüfungsgesellschaft

Haendl Appelt Auditor Auditor

Further Information

Disclaimer

Forward-looking statements

This report contains forward-looking statements that are based on current estimates of the Management Board regarding future developments. Such statements are based on current expectations and certain assumptions and estimates made by management. They are subject to risks, uncertainties and other factors that could cause the actual circumstances, including the net assets, financial position and results of operations of cyan, to differ materially from or be more negative than those expressly or implicitly assumed or described in these statements.

cyan's business activities are subject to a number of risks and uncertainties that could cause a forward-looking statement, estimate or prediction to be inaccurate. Forwardlooking statements are not to be understood as guarantees or assurances of the future developments or events mentioned therein.

Rounding note

The figures in this report have been commercially rounded. Rounding differences may therefore occur. The addition of the individual figures shown may therefore deviate from the exact total stated.

Gender-neutral wording

In the interests of readability, gender-differentiating formulations have been avoided throughout. The corresponding terms apply to all genders in the interests of equality. The abbreviated form of language is for editorial reasons only and does not represent any judgment on the part of cyan.

English translation

This English version has been translated based on the German original report. In case of deviations, the German version prevails. The reports are available for download in both languages in the IR section of the website.

ir.cyansecurity.com

Imprint

Publisher

cyan AG Josephspitalstrasse 15 80331 Munich Germany

UID: DE315591576 HR Munich: HRB 232764

cyansecurity.com ir.cyansecurity.com

Investor contact

cyan AG Investor Relations [email protected]

ir.cyansecurity.com

Graphic realization

cyan AG in-house with firesys

firesys.de

Focus on what matters most to you. We focus on keeping you safe online.

cyan AG Josephspitalstrasse 15 80331 Munich www.cyansecurity.com

AI Terminal

cyan AG

5379_rns_2025-06-05_493c6b9f-b101-4357-af09-e48387c8d4fe.pdf

2024

Annual Report

Network Security Going beyond connection

Endpoint Security

Contents

Letter to the Shareholders

Encouraging business figures and operational progress

Acquiring new customers, opening up new markets

Capital market rewards potential with strong share price performance

Further growth planned in 2025

Successful together - our thanks to all partners

Dear shareholders

Meetings and resolutions

Annual and consolidated financial statements

Rödl & Partner GmbH Wirtschaftsprüfungsgesellschaft, Munich

Thanks to

cyan-Share

Share price performance

Relative share price performancea January 1, 2024 - December 31, 2024 (rebased)b

Characteristics

Analyst coverage

Investor relations activities

Financial calendar

Group fundamentals

OnNet Security

Endpoint/SDK Security

Child Protection

Group structure

Financial performance indicators

Research and development

Personnel development

Economic report

Economic framework conditions

Industry-related framework conditions

Telecommunications sector

Cybersecurity

Business performance of the Group

Results of operations, net assets and financial position of the Group

Earnings situation

Revenue and costs

EBITDA

EBIT and annual result

Financial position

Financial position

Capital structure

Cash flow

Overall statement

Opportunity and risk report

Risks

Operational risk (low risk)

Competition risk (moderate risk)

Technological risk (low risk)

Reputation and brand risk (low risk)

Market concentration on the customer side (low risk)

Financial risks

Default and credit risk (low risk)

Liquidity risk (moderate risk)

Interest rate risk (low risk)

Currency risks (low risk)

Opportunities

Opportunities due to technological change

Opportunities through new markets

Opportunities due to increasing awareness of cybersecurity issues

Opportunities through new sales strategies

Opportunities and risk profile

Forecast

Financial Statements

Statement of comprehensive income

Income statement

Other comprehensive income (OCI)

Earnings per share from continuing operations

Earnings per share from discontinued operations

Earnings per share from continuing and discontinued operations

Balance sheet

Assets

Liabilities

Cash flow statement