Announcement PDF Annual Report 2026 Contents Acknowledgement of Country Letter to Shareholders 4 Go-to-Market Update 6 Client Showcase 8 Board of Directors and Key Management 10 FY26 Financial Report 12 Director’s Report 13 Auditor’s Independence Declaration  47 Statement of Profit or Loss Income  48 Statement of Financial Position  50 Statement of Changes in Equity  51 Statement of Cash Flows  53 Notes to the Financial Statements  54 Directors’ Declaration  95 Independent Auditor’s Report  96 Shareholder Information 104 Corporate Directory 108 Infotrust acknowledges the Traditional Custodians of Country throughout Australia and their connections to Land, Sea and Community. We pay our respects to Elders past and present and extend that respect to all First Nations Peoples across Australia and the Torres Strait Islands. 2 Infotrust Annual Report 2026 “We put our customers first. By bringing together our people and cyber security capabilities‚ we are helping Australian organisations stay secure and resilient‚ while building a stronger and more focused Infotrust.” Paul Timmins Chief Executive Officer 3 Infotrust Annual Report 2026 Over the year, we simplified the Company around a clear purpose: to build a scaled, trusted Australian sovereign cyber security and digital resilience business. We exited our remaining legacy communications operations, repaid our senior bank debt, expanded our specialist cyber capability and Federal Government presence through the acquisition of Catalyst Cyber, and strengthened the executive leadership team. The Company has also appointed a number of new senior executives including Mr Paul Timmins as CEO and Mr David Clanchy as CFO, bringing decades of experience to the executive team. Cyber security and digital resilience are increasingly inseparable. Organisations need to protect themselves against an expanding range of cyber threats, but they also need the underlying technology environments on which they depend to remain secure, available and recoverable through disruption. Key Milestones In March, we completed the divestment of the Cloud and Communications segment. The transaction was exiting the last of Infotrust’s legacy communications businesses and enabled the Company to repay its senior bank debt in full. Infotrust now operates as a single cyber security and digital resilience business under one brand and with a simpler operating model. In April 2026, we acquired Catalyst Cyber, a Canberra-based cyber security consultancy focused on Federal Government customers. Catalyst expands our customer reach into Federal Government with our sovereign capability and adds specialist expertise across cyber security advisory, security engineering, incident response and assurance services. Together, these transactions completed an important strategic reset. The Company enters FY27 with a clear cyber security and digital resilience capability, substantial financial flexibility and a stronger platform for growth. “Our focus is profitable growth‚ recurring revenue‚ operational leverage‚ and sovereign cyber leadership.” Shan Kanji Chairman 4 Infotrust Annual Report 2026 Letter to Shareholders Shan Kanji Chairman Financial Highlights Revenue from continuing operations increased by 9.8% to $64.1 million in FY26, compared with $58.3 million in FY25. Growth was achieved across the portfolio during a year of significant organisational and transactional change. Underlying EBITDA from continuing operations was $2.7 million, reflecting investment in people and capability ahead of anticipated growth, together with the cost of operating the Company as a standalone cyber security and digital resilience business. In FY27, the Company expects to deliver more than $6 million in underlying EBITDA. The statutory loss attributable to shareholders was $23.1 million, however this included a $19.85 million after-tax net loss on divestment of the Cloud and Communications segment. The loss after tax from continuing operations was $7.83 million. Operating activities generated $4.1 million of cash. Cash and cash equivalents increased to $18.3 million at 30 June 2026, and the Group had no bank borrowings following repayment of the senior bank debt from the Cloud and Communications divestment proceeds. Strategic Vision Our ambition is to be Australia's leading sovereign cyber security company, protecting enterprise, government and regulated clients across the full security lifecycle. Our strategy is focused on growing our specialist cyber security and digital resilience business, increasing recurring revenue and expanding in areas where customer demand is developing rapidly. We will continue to strengthen our managed security, 24x7 Security Operations Centre, digital forensics and incident response capabilities. We also intend to deepen customer relationships by combining advisory expertise, security services and resilient technology solutions within clearer market-facing offerings. At the same time, we are investing in areas where customer demand is developing rapidly. These include Secure AI and AI governance, identity security, data security and privacy, and cloud security. Acquisitions will remain a potential accelerator where they add capability, reach or scale. Our priority is disciplined execution, with acquisitions supporting rather than replacing organic growth. Talent and Leadership During FY26, we invested in the people and specialist capability required to support the next stage of the Company’s development. In May 2026, Paul Timmins was appointed Managing Director and Chief Executive Officer. David Clanchy also joined as Chief Financial Officer in April 2026. Together with the broader leadership team, Paul and David bring experience in scaling technology services businesses, operational improvement and disciplined financial management. The addition of the Catalyst Cyber team further strengthened our capability in government and high-assurance environments. Across Infotrust, our people remain central to the quality of our customer relationships and the successful delivery of our cyber-first strategy. I thank our employees for their professionalism and commitment through a year of substantial change. I also acknowledge the contribution of our customers and technology partners, whose continued support remains important to the Company’s progress. Looking Ahead Infotrust enters FY27 in a substantially different position, with a focused delivery model. The strategic reset is largely complete. We have a focused portfolio and stronger balance sheet. Our focus is to deliver profitable growth, increase recurring revenue, improve operational leverage, extend our sovereign cyber position and allocate capital with discipline. We will also continue integrating Catalyst Cyber and scaling the capabilities in which we have invested. The Company has issued FY27 underlying EBITDA guidance of more than $6.0 million. This guidance remains subject to the assumptions, risks and qualifications contained in the FY26 results presentation, including customer demand, pipeline conversion, delivery capacity, integration outcomes and general market conditions. Strategy and acquisitions don’t create shareholder value, execution does. Thank you for your continued support as we build Infotrust’s future as Australia’s most trusted sovereign cyber security company and digital resilience partner. 5 Infotrust Annual Report 2026 Australian owned‚ operated and ASX listed‚ Infotrust delivers sovereign‚ end-to-end cyber security and digital resilience capabilities across prevention‚ detection‚ response and assurance. Infotrust serves a broad national customer base across corporate‚ mid-enterprise‚ enterprise and government markets. This reach allows the Group to combine scalable offerings for growing organisations with specialist capability for complex and high-assurance environments. 1‚000+ clients Across government‚ large enterprises and growing businesses nationally 6 States and territories with a workforce presence 9.8% FY26 continuing revenue growth 6 High-growth cyber security practices 250+ Cyber security and digital resilience professionals 24x7 Australian-owned and operated Security Operations Centre $64.1 million FY26 revenue from continuing operations $18.3 million Cash at 30 June 2026‚ with no bank debt 6 Infotrust Annual Report 2026 Go-to-Market Update A Unified Cyber Security Business FY26 represented an important stage in Infotrust’s transformation into a focused sovereign cyber security business. The divestment of Nexgen, acquisition of Catalyst Cyber and alignment of the Group’s capabilities under one brand established the foundation for an integrated operating model and a clearer market position. Infotrust has aligned its capabilities under a single customer- facing brand and go-to-market model. This approach brings together cyber security advisory, managed security operations, digital resilience, incident response and recovery capabilities to address customers’ security, operational and regulatory requirements across the technology lifecycle. Market Context Cyber security has become a core governance and operational priority for organisations. Increasing cyber threats, regulatory expectations, technology complexity and reliance on interconnected supply chains require organisations to adopt a coordinated approach to security and resilience. Customers increasingly require trusted partners that can combine specialist cyber security expertise with the capacity to design, implement and operate secure technology environments. Infotrust’s go-to-market strategy responds to this requirement through an integrated service model focused on security, operational continuity and resilience that customers need to support their ongoing growth and transformation. Integrated Service Model Infotrust’s go-to-market approach is organised across three complementary solution pillars, delivered by one team under one brand: 1. Secure Operations and Resilience Secure operations and resilience provides the always-on security services that customers’ own teams cannot staff around the clock. It is anchored by Infotrust’s Australian- owned and operated 24x7 Security Operations Centre (SOC), together with security information and event management (SIEM) and managed security services that monitor, detect and contain threats before they interrupt the business. These services are typically delivered under multi-year agreements and form the Group’s recurring revenue base. Digital Resilience is the evolution of Secure Managed Technology. It is where cyber security meets business continuity: protecting the organisation while ensuring it can keep operating, adapting and growing. 2. Defence and Optimisation Defence and optimisation brings together capabilities that help customers scope, manage and reduce ever evolving cyber risk to ensure their organisations are optimised for ongoing growth and transformation. Services Infotrust provides in this pillar include governance, risk and compliance, cyber security advisory, identity security, data and privacy, endpoint security, secure AI, security engineering and penetration testing. Governance, risk and compliance services align customers to recognised frameworks, including the Australian Signals Directorate’s Essential Eight, CIS Critical Security Controls, ISO/IEC 27001 and the NIST Cybersecurity Framework, matched to their size, maturity and obligations. Advisory is frequently a customer’s first engagement with Infotrust and provides a pathway into ongoing managed services. The pillar also includes the Group’s high-growth practices in secure AI, identity, and data and privacy, where customer demand is developing rapidly. 3. Incident Response and Recovery Incident response and recovery, delivered through Forensic IT, supports organisations in preparing for, responding to and recovering from cyber incidents. The service offering includes threat simulations and recovery planning, through to digital forensics, incident response, insider threat investigations, and associated specialist support. Insights from response engagements strengthen Infotrust’s SOC and advisory practices. Collectively, these pillars provide an integrated customer journey across assessment, protection, detection, response and continuous improvement. Customers can enter through any pillar, and the unified structure supports deeper relationships by enabling Infotrust to address multiple, interconnected and evolving customer requirements through a coordinated service model. Strengthened Market Capability The acquisition of Catalyst Cyber expanded Infotrust’s cyber security capabilities and market reach, including within government and other high-assurance environments. It strengthens the Group’s capacity across specialist advisory, governance and technical security services. The integration of these capabilities supports Infotrust’s objective of operating as one business, with a coordinated, consistent approach to customer engagement and service delivery. It also provides a broader platform from which to develop recurring service relationships and address customers’ cyber security and digital resilience requirements. FY27 Priorities Infotrust enters FY27 with a unified operating model and a clearer market proposition centred on sovereign cyber security and digital resilience. The Group’s priorities are to: „ deliver profitable growth; „ expand recurring revenue; „ strengthen customer relationships through integrated service offerings; „ improve operational leverage; „ maintain a disciplined approach to capital allocation; and „ continue to develop Infotrust’s position in sovereign cyber security. These priorities are intended to support the Group’s long-term objective of delivering sustainable value for customers and shareholders. 7 Infotrust Annual Report 2026 Moray & Agnew is a leading national law firm with more than 850 people, including more than 120 partners, across eight Australian offices. Its scale and operations create complex cyber security, data governance and technology requirements across a nationally distributed organisation. Infotrust supports the client across the cyber security lifecycle, combining CISO Retainer and governance advisory services with Endpoint and Identity protection, penetration testing, secure access, data protection and security-platform optimisation. The relationship has operated for 10 years and has expanded to support Moray & Agnew’s ISO 42001 AI management system, reflecting the growing connection between cyber security, data governance and responsible AI adoption. By bringing these capabilities together, Infotrust provides continuity between risk assessment, strategic advice and technical implementation, helping the client strengthen its security posture without managing multiple disconnected providers. Esri Australia delivers globally used enterprise geospatial technology that helps organisations bring location-based information together, visualise it on maps and turn complex data into practical insights. Governments and businesses use the technology to manage infrastructure and natural resources, plan services, respond to emergencies and make informed operational decisions. Over the past four years, Infotrust has supported Esri Australia through strategic cyber security advisory and assurance services. The relationship includes a CISO retainer, which was expanded during FY26 to provide additional advisory capacity, together with support across information security management system (ISMS) advisory, internal audit activities and reporting. Through this ongoing engagement, Infotrust helps Esri Australia align its security priorities, strengthen governance and continue maturing its information security program, which includes compliance with ISO27001:2022 across multiple regions in Asia Pacific. “Infotrust gives us access to cyber security leadership and specialist technical capability through one coordinated relationship. That combination has helped us strengthen our security foundations while preparing for emerging governance requirements‚ including responsible AI.” Tyler Beard Head of IT Chris McKee Head of Legal & Commercial “The greatest value in our relationship with Infotrust has been the continuity and consistency of its advisory service. Having a lead consultant who understands our processes, operating environment and practical challenges means the advice is grounded in our business and builds on the work already completed. That continuity has created a genuine partnership and helps us turn security priorities into practical and sustainable improvements.” 8 Infotrust Annual Report 2026 Client Showcase McGrath Foundation is one of Australia’s most recognised charities, funding specialist nurses who provide free care and support to people experiencing cancer and their families across Australia. Its national operations connect healthcare delivery, community fundraising and sensitive personal information in support of a mission that has reached more than 186,000 people and their families since 2005. For nearly four years, Infotrust has worked alongside McGrath Foundation to strengthen cyber security and resilience across the organisation. The relationship combines strategic advice, governance and risk expertise, security assurance and practical implementation support, helping translate identified risks into improvements across people, processes and technology. As McGrath Foundation’s needs have evolved, the engagement has expanded into a coordinated program that connects executive priorities with practical delivery. ESSSuper is a Victorian public sector superannuation fund that provides retirement benefits and services to emergency services personnel, State Government employees and other eligible members. Infotrust supports ESSSuper through a growing program of cyber security advisory and implementation initiatives. The engagement spans cloud security policy, application control capabilities and specialist project delivery, bringing together strategic guidance and practical implementation support. As ESSSuper’s requirements have evolved, Infotrust’s role has expanded across complementary security initiatives, providing continuity between advice, solution design and delivery. Yunus Algun Senior Cyber Security Manager Imtiaz Tufail Head of IT Operations & Enterprise Applications “Infotrust’s Governance, Risk and Compliance team delivered exceptional value through governance assessments, cyber maturity reviews and a realistic ransomware simulation exercise. Their practical recommendations, deep expertise and clear roadmap have helped us strengthen cyber governance, improve risk management and increase confidence in our ability to respond to cyber incidents.” “Infotrust has become a valued cyber security partner to ESS Super, supporting us with specialist advice and implementation services across a growing range of security initiatives. The team is highly engaged and responsive, and brings a practical understanding of our requirements that helps us translate security priorities into effective outcomes.” 9 Infotrust Annual Report 2026 Paul Timmins Managing Director and Chief Executive Officer Paul is a technology executive with a proven track record of leading and scaling complex services organisations across Australia and internationally. He brings deep expertise in transformation, operational execution, and customer‑centric growth, with prior CEO roles at Protegic and Davidson Technology, and global leadership experience at DXC Technology. Shan Kanji Chairman Shan has over 20 years’ experience as a senior business leader with a proven track record of running scale diversified and complex industrial and technology businesses in Australia and New Zealand. Mr Kanji also has extensive experience with start-ups in technology, property development, manufacturing and other sectors. Russell Baskerville Deputy Chairman and Lead Independent Director Russell is a corporate leader with 20+ years in Executive and Non-Executive roles across ASX- listed companies. He brings deep expertise in business strategy, technology consulting, mergers and acquisitions, corporate restructuring, and capital markets, consistently guiding organisations through complex transactions and delivering long-term value. Lynn Warneke Non-Executive Director Lynn is an experienced Non- executive Director and Chair, with extensive background and expertise in strategy, digital services and product development, customer experience, emerging technologies, innovation and cyber security. Dane Meah Non-Executive Director Dane has 19 years' experience in the cyber security industry. He co- founded Infotrust in 2014 (acquired by the Group effective 1 April 2024) and is founder and CEO of MyCISO, a global cyber security SaaS company. Dane brings particular expertise in strategy, cyber industry, GTM and commercial management. Simon McKay Executive Director and Chief Revenue Officer Simon is a seasoned leader in the cyber security industry with a track record of success spanning over two decades. Simon is the co-founder of two successful Australian cyber security businesses - Infotrust (acquired by the Group effective 1 April 2024) a cyber consulting practice, and MyCISO, a SaaS management platform. 10 Infotrust Annual Report 2026 Board of Directors and Key Management David Clanchy Chief Financial Officer David brings a strong combination of advisory and operational experience, including hands‑on leadership as a technology company CFO. His background spans technology, engineering, and professional services, with deep expertise in financial strategy, governance, and scalable growth. He is recognised for his disciplined approach to financial management and his ability to support organisations through transformation and expansion. Dan Suto Chief Delivery Officer Dan has over 20 years’ experience in IT infrastructure across DXC and Datacom. Previously, General Manager of Managed Services at DXC Technology and also served as Executive Advisor and NSW State Lead at ValueFlow IT. Dan is known for driving business transformations and growth by translating strategy into execution. Nick Hornstein General Counsel Nick is a seasoned legal professional with over a decade of experience in corporate law, governance, and compliance. At Infotrust, he plays a pivotal role in steering legal strategies, ensuring regulatory compliance, and enhancing corporate governance frameworks. With experience in both in-house and private practice roles, his strategic insights and legal acumen are instrumental in navigating complex legal challenges and driving the company’s growth. Nina Mlinarevic Company Secretary Nina was appointed Company Secretary in January 2026 and brings over 15 years' experience in financial services, with expertise in corporate governance, regulatory compliance, and advising boards and senior management on governance matters. 11 Infotrust Annual Report 2026 Contents Director’s Report 13 Auditor’s Independence Declaration  47 Statement of Profit or Loss Income  48 Statement of Financial Position  50 Statement of Changes in Equity  51 Statement of Cash Flows  53 Notes to the Financial Statements  54 Directors’ Declaration  95 Independent Auditor’s Report  96 Infotrust Annual Report 2026 12 FY26 Financial Report Infotrust Ltd Directors’ report 30 June 2026 3 The Directors present their report, together with the financial statements, on the Consolidated Entity (referred to hereafter as the “Consolidated Entity” or “Group”) consisting of Infotrust Ltd (referred to hereafter as the “Company”, “parent entity” or “Infotrust”) and the entities it controlled at the end of, or during, the financial year ended 30 June 2026 (“FY26”). D Di ir re ec ct to or rs s The following persons were Directors of Infotrust during the whole of the financial year and up to the date of this report, unless otherwise stated: Shan Kanji (Non-Executive Director and appointed Non-Executive Chairman) Russell Baskerville (Deputy Chair, Lead Independent Director and Non-Executive Director) Julian Challingsworth (Managing Director and Chief Executive Officer) (resigned as a Director effective 18 May 2026) Paul Timmins (Managing Director and Chief Executive Officer – appointed 18 May 2026) Lynn Warneke (Non-Executive Director) Simon McKay (Executive Director) Dane Meah (Non-Executive Director) P Pr ri in nc ci ip pa al l a ac ct ti iv vi it ti ie es s During the financial year the principal activities of the Group were:  Cyber Security incorporating Secure Managed Technology (now Digital Resilience); and  Cloud and Communications (discontinued). Infotrust is Australia’s leading sovereign ASX listed provider of cyber security, digital resilience and aligned secure managed technology services. Infotrust provides end to end cyber capabilities for enterprise and mid-size customers across risk, AI tools and advisory offensive security, SOC, managed detection and response, digital forensics and incident response amongst other areas. Infotrust helps organisations identify and manage cyber risk, resilience and assist them in protecting critical systems and data by responding to existing and emerging threats. The Cloud and Communications segment was divested effective 31 March 2026. Refer “Significant changes in the state of affairs” below. Previously Secure Managed Technology and Corporate were reported as separate business segments. Moving forward, the Group will deliver its results as a single Cyber Security segment. For the purposes of this report, references to Digital Resilience are used to describe the operating capabilities and service offerings through which the Cyber Security segment is delivered. Dividends There were no dividends paid, recommended or declared during the current or previous financial year. Infotrust Annual Report 2026 13 Director’s Report Infotrust Ltd Directors' report 30 June 2026 4 Operating and financial review Consolidated Entity’s operations Infotrust is an Australian sovereign cyber security and secure managed technology provider, helping organisations stay secure, compliant and connected through integrated services and resilient technology solutions. The Group provides cyber security and technology services and solutions that enable organisations to strengthen their security posture, improve resilience and compliance, and operate secure, agile and scalable technology environments. Following the divestment of the Cloud and Communications segment during FY26, the Company’s operations are exclusively focused on cyber security, digital resilience and associated technology services under the “Infotrust” brand. Rights to the “Spirit” brand have been retained but is no longer used as the Company’s primary customer-facing brand. The Australian cyber security market continues to benefit from structural demand for cyber security and digital resilience, secure cloud adoption, data protection, identity security, AI governance and regulatory assurance. The market is also becoming more competitive and more consolidated, with customers seeking fewer, deeper technology partners that can provide trusted expertise, local accountability and outcome-based services. Infotrust’s strategy is to grow as a focused, trusted cyber-first technology services provider by deepening customer relationships, expanding cross-sell opportunities across the Company’s existing customer base, packaging services into clearer market-facing offers and investing in high-growth cyber capabilities, including identity, data security, AI security and cloud security. Acquisitions are expected to remain a disciplined accelerator where they strengthen capability, geographic reach or scale, rather than a substitute for organic execution. Review of operations and financial position During FY26, the Company continued its strategic transformation into a focused, cyber security and digital resilience services provider. On 31 March 2026, the Company completed the divestment of its Cloud and Communications segment, comprising 100% of NexGen Investment Group Pty Ltd and its subsidiaries, to Aussie Broadband Limited (ASX: ABB). The divestment represented a significant milestone in Infotrust’s strategic transformation and materially strengthened the Company’s balance sheet to support its cyber security first growth strategy and acquisition pipeline. On 17 April 2026, the Company completed the acquisition of Catalyst Cyber, a Canberra-based cyber security consultancy with a particular focus on Federal Government customers. Catalyst Cyber brings established Commonwealth relationships, security-cleared personnel and specialist capabilities across cyber security advisory, security engineering, incident response and assurance services. The Catalyst Cyber acquisition is complementary to Infotrust’s existing cyber security operations. It expands the Company’s presence in regulated and high-assurance environments, strengthens its sovereign cyber security capability and enhances its ability to service Federal Government and defence-aligned customers. The acquisition also provides opportunities for future revenue growth and margin improvement through expanded service capability, broader customer relationships, cross-sell opportunities and a stronger platform for responding to cyber incidents. These benefits remain subject to successful integration, customer demand and disciplined execution. Director’s Report 14 Infotrust Annual Report 2026 Infotrust Ltd Directors' report 30 June 2026 5 Infotrust works with customers to understand their cyber risk, exposure and maturity, and to recommend appropriate cyber security frameworks and controls suited to their operating environment. These may include foundational, control, program and risk frameworks such as the Essential Eight, CIS Controls, ISO 27001, NIST CSF and ISO 27005, depending on customer si