Company: AEHR
Filing Date: 2025-07-28
Form Type: 10-K
Source: 0001654954-25-008553
Chunk: 33

Company: AEHR TEST SYSTEMS
Filing Date: 2025-07-28
Form: 10-K
Item: Item 1
Chunk 33
---
20Table of Contents

Our Security Awareness Program includes training that reinforces our information technology risk and security management policies, standards and practices, as well as the expectation that employees comply with these policies. The Security Awareness Program engages personnel through training on how to identify potential cybersecurity risks and protect the Company’s resources and information. This training is mandatory for all employees on a periodic basis, and it is supplemented by Company-wide testing initiatives. 

Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including our suppliers or who have access to our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence.

While we have not, as of the date of this Report, experienced any material cybersecurity incidents that materially affected us, including our operations, business strategy, results of operations, or financial condition, we face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect our business, financial condition, results of operations. See “Risk Factors – We are exposed to cybersecurity threats or incidents.”

Cybersecurity Governance

One of the key functions of our Board of Directors is informed oversight of our risk management processes, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole, as well as through the Audit Committee of the Board of Directors (the “Audit Committee”). The Audit Committee has primary responsibility for oversight of information security risks, including fraud, vendor, data protection and privacy, business continuity and resilience, and cybersecurity risks, and provides regular updates to the Board of Directors on such matters. The Audit Committee receives regular reports from our Chief Operating Officer on, among other things, the Company’s cyber risks and threats, the status of projects to strengthen the Company’s information security systems, assessments of the Company’s security program and the emerging threat landscape. Information security risk is a significant oversight focus area for the Audit Committee, as well as the entire Board of Directors. Over the course of fiscal year 2024, the Audit Committee received four separate cybersecurity briefings from our Chief Operating Officer.

Our Chief Operating Officer is primarily responsible for assessing and managing our material risks from cybersecurity threats. Our Chief Operating Officer, who leads a