REACH - non-regulatory announcement*

12 May 2026

Tern Plc

("Tern" or the "Company")

Device Authority Strategic Partnership with Xalient

Tern Plc (AIM:TERN), the investment company specialising in supporting high growth, early-stage, disruptive Internet of Things ("IoT") technology businesses, is pleased to note that Device Authority Limited ("Device Authority"), a company in which Tern currently holds 25.3% of the equity, has announced a new strategic partnership with Xalient, a leading provider of identity‑led cybersecurity services and managed solutions.

Extracts from the Device Authority announcement:

Device Authority, a global leader in identity and access management ("IAM") for IoT and Operational Technology ("OT") devices, today announced a new strategic partnership with Xalient, a leading provider of identity‑led cybersecurity services and managed solutions.

The collaboration will strengthen Xalient's IoT security offering through the integration of Device Authority's KeyScaler platform, enabling scalable, automated protection for connected devices across complex enterprise environments. 

As organizations accelerate digital transformation and expand their use of connected devices, securing IoT and OT ecosystems has become increasingly complex. With billions of devices coming online - many of them unmanaged or operating in production or operational environments - traditional security models struggle to provide the visibility, control, and resilience required.

At the same time, regulatory and policy pressures are increasing on both sides of the Atlantic.

In the EU, requirements such as the Cyber Resilience Act are raising expectations for secure‑by‑design connected products, device visibility, vulnerability management, and compliance reporting. In the U.S., guidance and regulatory activity from bodies such as CISA, NIST, and sector‑specific regulators are driving stronger requirements around asset visibility, secure access, risk governance, and operational resilience.

As a result, enterprises are being challenged to adopt automated, 'Zero Trust'‑aligned approaches that can scale across users, devices, workloads, and machine identities - without adding unnecessary operational friction.

Through this partnership, Xalient will leverage Device Authority's KeyScaler platform to help customers establish and manage strong device identities throughout their lifecycle - from secure onboarding and automated credential provisioning to certificate rotation, decommissioning, and policy‑driven access control. These capabilities are critical in large‑scale and regulated environments, where manual processes introduce risk and do not scale.

Device Authority's KeyScaler platform is purpose-built to address the unique challenges of IoT and OT environments, delivering end-to-end lifecycle automation from device provisioning through to decommissioning. By eliminating the need for human intervention, organisations can reduce operational overhead, minimise risk, and ensure compliance with evolving security frameworks and standards. 

Delivered as part of Xalient's managed "as‑a‑service" security model, the joint offering enables customers not only to automate device identity, but to continuously monitor, analyze, and improve their security posture over time.

This approach is supported by MARTINA, Xalient's AIOps platform, which brings together real‑time telemetry, observability, and analytics across identity, network, security, and user experience. By providing predictive insights and reducing alert fatigue, MARTINA helps Xalient and its customers proactively identify issues, prioritize risk, and maintain visibility as environments and regulatory expectations evolve.

By combining Xalient's expertise in identity‑led security strategy, OT environments, and managed security services with Device Authority's deep specialization in machine identity management, the partnership will help customers move from fragmented point solutions to a more resilient, continuously governed approach to IoT and OT security.

Darron Antill, CEO, Device Authority commented: "Securing IoT and OT environments requires a fundamentally different approach to traditional IT security. Through our partnership with Xalient, we are extending the reach of KeyScaler's automated identity lifecycle management to more organisations, enabling them to establish strong device identities, automate credential management, and enforce Zero Trust policies across even the most complex and distributed environments."

David (DJ) Morimanno, Field CTO at Xalient, added: "IoT and OT environments introduce identity challenges that most organisations are not equipped to solve with traditional tools or manual processes. This partnership brings together Device Authority's purpose‑built machine identity automation with Xalient's experience securing complex, regulated environments. Together, we're helping customers move from fragmented device security to a scalable, Zero Trust‑aligned approach that supports resilience, compliance, and long‑term operational confidence."

This collaboration will initially focus on energy and utilities, manufacturing, healthcare, and critical infrastructure, where the scale, longevity, and criticality of connected device deployments present the greatest security and compliance challenges.

About Device Authority

Device Authority is a global leader in Identity and Access Management ("IAM") for the IoT; focused on the automotive, medical device ("IoMT") and industrial ("IIoT") sectors. Device Authority's KeyScaler™ platform provides zero touch provisioning and complete automated lifecycle management for securing IoT devices and data at scale, with frictionless deployment across device provisioning, authentication, credential management, policy based end-to-end data security/encryption and secure OTA (over the air) and HSM (hardware security module) updates. For more information, visit: https://deviceauthority.com

Enquiries

* About Reach announcements

This is a Reach announcement. Reach is an investor communication service aimed at assisting listed and unlisted (including AIM quoted) companies to distribute media only / non-regulatory news releases into the public domain. Information required to be notified under the AIM Rules for Companies, Market Abuse Regulation or other regulation would be disseminated as an RNS regulatory announcement and not on Reach.