Tilray Brands Strengthens Cybersecurity Governance with CIO Reporting Directly to CEO

CIO Role and Direct Executive Access

Tilray Brands has formalized cybersecurity governance by establishing a Chief Information Officer position with direct reporting responsibility to the Chief Executive Officer. This organizational structure places the CIO at a senior level within the company, enabling rapid escalation of material cybersecurity risks and ensuring that information security matters receive executive attention at the highest levels of management. The direct reporting line to the CEO reflects the company's recognition that cybersecurity threats can have material business implications and warrant close coordination with top leadership.

The CIO plays a pivotal role in assessing and managing material risks that stem from cybersecurity threats, according to the disclosure. This responsibility encompasses identifying emerging threat vectors, evaluating the company's vulnerability to cyber attacks, and implementing mitigation strategies. By positioning the CIO with direct access to the CEO, Tilray Brands has created a pathway for rapid communication regarding urgent cybersecurity incidents or strategic risk assessments that may require immediate C-suite intervention or board-level decisions.

Board-Level Oversight of Cybersecurity Strategy

The disclosure states that Tilray Brands' Board of Directors actively oversees cybersecurity risk management and regularly reviews the company's cybersecurity strategy and initiatives. This board-level engagement reflects a governance best practice in which directors maintain fiduciary responsibility for monitoring risks that could materially affect shareholder value. The board's involvement in cybersecurity matters demonstrates that the company's leadership views information security as integral to long-term business continuity and regulatory compliance.

Given that cybersecurity risks can impact various areas of responsibility assigned to different Board committees, oversight of this risk category is distributed across multiple board functions. This cross-committee approach ensures that cybersecurity considerations are integrated into financial audit oversight, operational risk management, compliance reviews, and other governance areas where data security and system integrity are relevant. Such coordination helps prevent cybersecurity matters from falling into governance gaps and ensures holistic risk assessment.

Quarterly and As-Needed Reporting to the Board

The Board receives quarterly updates on cybersecurity matters from the CIO and management team, in addition to as-needed communications when circumstances warrant accelerated reporting. The quarterly cadence establishes a regular rhythm for board engagement on this critical risk area, allowing directors to track progress on security initiatives, review changes in the threat landscape, and assess the company's preparedness over time. This structured reporting schedule enables the board to maintain continuity of knowledge about cybersecurity matters and monitor trends or emerging concerns.

The filing specifies that these board updates cover multiple substantive topics, including threat landscape developments, incident response readiness, and program enhancements. Threat landscape developments allow the board to understand evolving external risks facing the company and the industry. Incident response readiness reporting addresses whether the company's processes, personnel, and systems are adequately prepared to detect, respond to, and remediate security breaches or anomalies. Program enhancement updates inform directors about improvements to the company's cybersecurity controls, new technologies or methodologies being deployed, and other proactive measures designed to strengthen the overall security posture.

External Cybersecurity Consulting and Support

Tilray Brands coordinates with external cybersecurity consultants as part of its risk management program, according to the disclosure. Engagement of specialized external expertise allows the company to access capabilities, industry knowledge, and threat intelligence that may not reside entirely within internal teams. External consultants can provide independent assessments of the company's security posture, recommend best practices drawn from experiences across multiple organizations, and support incident response activities if cyber attacks or breaches occur.

The CIO is described as being primarily responsible for overseeing the company's overall cybersecurity risk management program while coordinating with these external consultants. This arrangement enables the CIO to maintain direct accountability for cybersecurity outcomes while leveraging specialized resources and expertise to enhance the program's effectiveness. The external support model provides scalability and flexibility, allowing Tilray Brands to adjust consultant engagement based on emerging threats, regulatory requirements, or specific project needs without requiring permanent expansion of the internal security team.

Integration of Cybersecurity into Risk Management Processes

The disclosure characterizes cybersecurity as an important part of the company's overall risk management processes and identifies it as an area of focus for the Board, CIO, and management team. This positioning indicates that cybersecurity considerations are not compartmentalized or treated as solely an information technology function but rather are embedded within the company's enterprise-wide risk management framework. Such integration is important because cybersecurity risks can intersect with operational risk, financial risk, regulatory risk, and reputational risk.

By elevating cybersecurity within the risk management hierarchy, Tilray Brands acknowledges that data breaches, system outages, or unauthorized access to proprietary information could disrupt operations, trigger financial losses, invite regulatory sanctions, or damage the company's brand reputation. This holistic approach encourages business units across the organization to consider cybersecurity implications when making decisions about technology adoption, data handling practices, and system design. Management and board-level focus on cybersecurity as a core risk area reinforces the message that security is a business priority, not merely a compliance obligation.

Implications for Cannabis and Beverage Industry Operators

Tilray Brands operates in the cannabis and cannabis-adjacent beverage sectors, industries that face unique cybersecurity challenges stemming from regulatory complexity, product tracking requirements, and evolving state-level legalization frameworks. The company's robust cybersecurity governance framework is relevant to these operational contexts because regulatory compliance systems, supply chain tracking, and financial systems that support cannabis sales must maintain high data integrity and security standards. Breaches affecting regulatory compliance systems could expose the company to enforcement actions or operational disruptions in regulated markets.

Additionally, cannabis retailers and producers handle sensitive customer information, financial transactions, and inventory data that are attractive targets for cyber criminals and may be sought by competitors or regulatory adversaries. The company's formalized cybersecurity governance, with board oversight and executive-level accountability, suggests awareness of these sector-specific risks and commitment to protecting assets and information that are critical to operations across licensed jurisdictions.

Ongoing Program Enhancement and Threat Response

The board reports reference "program enhancements" as a regular topic of discussion, indicating that Tilray Brands maintains an active approach to improving its cybersecurity capabilities over time. Program enhancement encompasses a range of initiatives, which may include deployment of new security tools or technologies, refinement of access control policies, improvements to incident detection and response procedures, employee security awareness training, and updates to incident response plans. The regular cadence of reporting on enhancements suggests the company is not static in its security posture but rather engaged in continuous improvement cycles.

The disclosure also highlights incident response readiness as a focus area for board-level review. This attention to incident response preparedness indicates that Tilray Brands recognizes that some cyber attacks may succeed despite preventive controls and that the company's ability to respond quickly and effectively can minimize damage. Well-developed incident response capabilities depend on clear procedures, trained personnel, established communication protocols, and tested recovery processes. Board oversight of incident response readiness ensures that the company's leadership is confident in the organization's ability to manage cyber incidents when they occur.

Alignment with Evolving Regulatory Expectations

Cybersecurity governance practices disclosed by Tilray Brands align with evolving regulatory expectations regarding board oversight and executive accountability for information security. Securities regulators and governance standard-setters have increasingly emphasized the importance of board-level engagement with cybersecurity risk, partly in response to high-profile breaches affecting publicly traded companies and investor concerns about the adequacy of corporate cybersecurity practices. The company's disclosure of structured board oversight, executive-level accountability through a reporting CIO, and regular updates on threat management and program improvements reflects alignment with these governance expectations.

Regulatory bodies, including the Securities and Exchange Commission and various state attorneys general, have signaled heightened scrutiny of corporate cybersecurity disclosures and the adequacy of governance frameworks. By disclosing its cybersecurity governance structure in an annual report filing, Tilray Brands provides transparency to investors regarding how the company addresses a material risk category. This disclosure allows shareholders to assess whether management and the board are taking cybersecurity seriously and whether governance structures are in place to manage potential impacts from cyber incidents.

Forward-Looking Considerations for Investors

Investors should consider how Tilray Brands' disclosed cybersecurity governance structure positions the company to identify, respond to, and recover from potential cyber incidents. The existence of a dedicated CIO reporting to the CEO, board-level oversight, quarterly reporting, and coordination with external specialists suggests a mature approach to cybersecurity governance. However, the effectiveness of any cybersecurity program depends on ongoing investment in tools, training, and personnel, as well as the organization's ability to adapt to new and emerging threats.

The company's cybersecurity preparedness could influence its operational resilience, regulatory compliance status, and ability to serve customers in licensed jurisdictions where compliance system integrity is essential. Investors may wish to monitor future disclosures for updates on cybersecurity incidents, any material breaches or system compromises, changes to the cybersecurity governance structure, or significant investments in new security technologies or capabilities. Additionally, investors should consider how cybersecurity risk factors disclosed by the company intersect with other operational and regulatory risks inherent in cannabis and beverage businesses.