5 November 2025

Corero Network Security plc

("Corero" or the "Company")

Key Customer Renewal and Expansion Order

Product Enhancements Support H2 2025 Sales Momentum

Strong Q3 2025 order intake and key customer renewal and expansion order in early Q4 2025

Corero (AIM: CNS) (OTCQX: DDOSF), the distributed denial of service ("DDoS") protection specialists and champion of adaptive, real-time service availability, is pleased to announce good sales traction across Q3 2025, driven by a number of new customer wins and  product enhancement launches, as well as a key customer renewal and expansion order in October delivering a strong start to Q4 2025.

Corero delivered a strong Q3 2025, with order intake¹ of $7.4 million (Q3 2024: $6.0 million) and new contract wins secured across the US, UK, Europe, Brazil and Singapore. Two additional CORE² customer wins were secured in Q3 2025, following the first two CORE contracts secured in Q2 2025.

Corero secured a renewal and significant expansion order with a key customer, a leading US cloud computing provider in October 2025. The renewed and expanded contract, providing DDoS protection solutions to the customer's current and planned data centre portfolio, has a total contract value of $6.8 million, $0.8 million of which was included in the Q3 2025 order intake value noted above. The $6.8 million contract consists of a $3.1 million renewal (of all existing contracts) and $3.7 million expansion, which will be delivered and recognised on a subscription basis over the three-year contract term.

In addition to good customer traction in H2 2025 to date, Corero has also recently announced a number of key platform enhancements to serve customer demand requirements:

·    Layer 7 TLS³ Protection blocks high volume application-layer attacks in real time at the network edge with no additional latency, no false positives and no additional hardware.

·    Zero Trust Admission Control uses behavioural analytics to detect and block anomalies at login portals, reducing risk from credential abuse and bot-driven attacks.

·    Extended WAF⁴ and Application Security for Service Providers which protects web applications and APIs using adaptive analytics, threat modelling and anti-bot capabilities, enabling service providers to offer high-value application-layer security as a managed service.

·    Bare Metal and Commercial Off-the-Shelf Deployment Options which extend the use cases for Corero's software-led, hardware agnostic capabilities to customers who desire to run Corero's solution on hardware of their choosing.

Management reaffirms the guidance for the year ending 31 December 2025 as announced on 16 July 2025 of revenue between $24.0 million and $25.5 million (FY 2024: $24.6 million) and EBITDA between $1.5 million loss and $0 million (FY 2024: $2.5 million profit).

¹ Order intake is defined as orders received from customers in the period

² The new Corero Observability & Resiliency Ecosystem ('CORE') solution

³ Transport Layer Security, an encryption protocol that secures data transferred over the internet, such as website traffic and emails

⁴ Web Application Firewall

Carl Herberger, Chief Executive Officer at Corero, commented:

"I am delighted to extend our partnership with a key Corero customer and to continue to support their growing business and DDoS protection requirements. This expanded contract demonstrates Corero's technical leadership and the confidence customers, including those managing critical infrastructures, have in our SmartWall ONE platform.

I am encouraged by the sales growth in Q3 2025 and the strong start to Q4 2025. Our success in winning new customers and expanding our global presence, combined with Corero's strategic focus on product innovation, continues to sit at the heart of our customer proposition.

The H2 2025 sales momentum not only reflects our strengthening market presence but highlights the ongoing and urgent shift towards performance-driven, flexible and scalable DDoS protection to mitigate cybersecurity attacks."

Enquiries:

About Corero Network Security

Corero Network Security is a leading provider of DDoS protection solutions, specialising in automatic detection and protection solutions with network visibility, analytics, and reporting tools. Corero's technology protects against external and internal DDoS threats in complex edge and subscriber environments, ensuring internet service availability. With operational centres in Marlborough, Massachusetts, USA, and Edinburgh, UK, Corero is headquartered in London and listed on the London Stock Exchange's AIM market (ticker: CNS) and the US OTCQX Market (OTCQX: DDOSF).

For more information, visit www.corero.com, and follow us on LinkedIn and X.