CDA.SECURITY, LLC AI & AUTOMATION DISCLOSURE

Version 1.0

Effective Date: 2026-01-01

This AI & Automation Disclosure is incorporated by reference into the CDA.Security, LLC Master Services Agreement (the “Agreement”). It describes how CDA.Security uses artificial intelligence (AI) and automation technologies in the delivery of its Services. Capitalized terms used but not defined herein have the meanings given in the Agreement.

1. OPERATING MODEL: HUMAN-LED, SYSTEM-AUGMENTED. CDA.Security’s operating model is human-led and system-augmented. Our security professionals are the ultimate decision-makers and operators in all service delivery. We use AI and automation as tools to enhance the speed, scale, and accuracy of our human experts, not to replace them.

2. PERMITTED USES OF AI & AUTOMATION. In the course of providing the Services, CDA.Security may use AI and automation for the following purposes:

2.1. Data Analysis and Correlation. To process, correlate, and identify patterns in large volumes of technical data (e.g., logs, network traffic, configuration files) collected during a Mission. This assists our analysts in identifying potential areas of interest for manual investigation.

2.2. Tooling and Scripting. To automate repetitive tasks, orchestrate security tools, and execute predefined analysis workflows.

2.3. Threat Intelligence Processing. To analyze and enrich threat intelligence feeds and integrate them into our operational context.

3. PROHIBITED USES & COMMITMENTS. CDA.Security is committed to the safe and responsible use of technology. We explicitly prohibit the following and warrant that our use of AI and automation in the delivery of Services will adhere to these commitments:

3.1. No Autonomous Decision-Making. No AI or automated system will make final, autonomous determinations about vulnerabilities, risks, or remediation actions. All findings and recommendations in Deliverables are reviewed and validated by qualified CDA.Security personnel.

3.2. No Unsupervised Actions. No AI or automated system will take unsupervised or autonomous actions within a Customer’s environment. Any action taken within a Customer’s systems or networks is initiated and supervised by a human operator.

3.3. No Training on Customer Data. CDA.Security will not use any Customer Data, Customer Confidential Information, or Deliverables to train or fine-tune any publicly available or third-party AI models. Any internal models used for analysis are trained exclusively on CDA.Security’s proprietary data or publicly available security data, and are logically and physically isolated from Customer Data.

4. TRANSPARENCY. This disclosure serves as notice to the Customer of our use of these technologies. The specific tools and methods used are considered CDA.Security’s proprietary intellectual property and will not be disclosed in further detail. CDA.Security may update the specific AI platforms or vendors used in its internal workflows without notice, provided that such use remains subject to the commitments set forth in this Disclosure.