END-USER LICENSE, SOFTWARE, UPDATES, SECURITY INTELLIGENCE & SUPPORT AGREEMENT

Effective Date: 06-Sep-2026

This End-User License, Software, Updates, Security Intelligence & Support Agreement (“Agreement”) is entered into between SECITICS LLC (“SECITICS,” “Licensor,” “we,” or “us”) and the entity or individual identified in the applicable Order or License Certificate (“Customer,” “you,” or “your”).

By purchasing, downloading, installing, or using the Software or Security Intelligence Feed, Customer agrees to be bound by this Agreement.

1. DEFINITIONS

• 1.1 Software: The SECITICS proprietary desktop/on-premise cybersecurity software programs in compiled executable/object-code format, associated user documentation, and local utility components provided under an applicable License Certificate.

• 1.2 Security Intelligence Feed ("Feed"): The SECITICS compiled, normalized, and structured dataset containing vulnerability advisories, threat indicators, asset and firmware profiles, product correlations, and operational security information supplied for integrated use with the Software.

• 1.3 Feed Version: A specific compiled release of the Security Intelligence Feed delivered or made available to Customer under an active subscription.

• 1.4 Updates: Subsequent Software revisions, binary releases, bug fixes, or newly compiled Security Intelligence Feed releases provided by SECITICS on an as-available basis.

• 1.5 IT IP: A unique IP address assigned to a host operating on a standard general-purpose operating system (including standard desktop, server, or workstation distributions of Microsoft Windows, Linux or macOS) within Customer's licensed assessment scope.

• 1.6 ICS/OT IP: A unique IP address assigned to an Industrial Control System (ICS) or Operational Technology (OT) asset operating on an embedded, real-time, or proprietary operating system or firmware (including OEM-proprietary PLC, RTU, IED, or controller firmware), or an embedded Linux distribution purpose-built for industrial control hardware.

• 1.7 License Certificate: The formal document, Order Confirmation, or invoice issued by SECITICS specifying the Software, licensed capacity (IP counts), fees, and subscription term.

2. PRODUCT STRUCTURE

SECITICS delivers two integrated commercial components:

1. Perpetual Software License: A one-time purchase granting a perpetual right to install and execute the specific Software version in object-code form, subject to this Agreement.

2. Annual Security Intelligence & Maintenance Subscription: A recurring, unified annual subscription providing access to Software Updates, Security Intelligence Feeds, and standard break-fix technical support.

The Annual Subscription provides access to future Software Updates, future Security Intelligence Feed Versions, and standard product support during the applicable subscription period. It does not affect the perpetual rights associated with previously delivered Software, Updates or Feed Versions.

3. Local Software; No SaaS: The Software is provided as downloadable, locally executed desktop/on-premise software. Customer operates the Software within Customer's own authorized environment. The Software is not provided as a hosted software-as-a-service (SaaS) offering, and Customer does not receive hosted or remote access to SECITICS's computing infrastructure as part of the Software license. The electronic delivery of Software Updates, Security Intelligence Feed Versions, or other Updates does not constitute hosted SaaS access or a transfer of the Software into a SaaS service.

3. PERPETUAL SOFTWARE LICENSE

• 3.1 Grant of Perpetual License: Subject to payment of the applicable one-time license fee, SECITICS grants Customer a perpetual, non-exclusive, non-transferable, non-sublicensable license to install and execute the Software version lawfully acquired for Customer's internal security operations within the capacity specified in the License Certificate.

• 3.2 Licensed Capacity: The license fee is determined by capacity tiers based on:

o Number of IT IPs; and/or
o Number of ICS/OT IPs.
o Number of Active Directory Domains 

In the event an asset's operating system cannot be automatically fingerprinted or classified, the IP address shall default to the ICS/ OT IP capacity tier.

Customer shall not execute assessments or process target environments exceeding the licensed capacity counts.

• 3.3 Capacity Verification & True-Up: The Software may include license keys or embedded capacity controls that validate active assessment counts. SECITICS reserves the right to request a system-generated license usage log once per calendar year. If assessments exceed the licensed capacity, Customer agrees to purchase required additional capacity at SECITICS’s then-current list price within thirty (30) days.

4. PERPETUAL FEED RIGHTS & RETENTION

• 4.1 Delivered Feed Retention: Each Feed Version lawfully obtained or downloaded during an active subscription period may be retained and used by Customer indefinitely for internal security operations solely with the Software.

• 4.2 Backup Scope & Hosting Limitations: Customer is solely responsible for maintaining local backups of lawfully received Feed Versions. Upon subscription expiration, SECITICS has no obligation to host, re-deliver, re-issue, or preserve backwards compatibility for legacy Feed Versions.

• 4.3 Integrated Usage Only: Security Intelligence Feeds are supplied exclusively for integrated operational execution within the Software and may not be extracted, exported, or used as a standalone database, competing commercial product, or independent information service.

5. ANNUAL SECURITY INTELLIGENCE & MAINTENANCE SUBSCRIPTION

• 5.1 Unified Subscription Scope: Subject to payment of the annual subscription fee, Customer receives access during the subscription term to:

1. Software Updates and executable binary patches;
2. Security Intelligence Feed updates as published; and
3. Standard product technical support.

• 5.2 As-Available Intelligence Delivery: Security Intelligence Feeds are compiled dynamically based on emerging threat research and third-party vendor advisories. SECITICS provides Feeds on an as-available basis and does not guarantee fixed publishing schedules, daily minimum update volumes, or constant ratios of threat-to-vulnerability entries.

• 5.3 Continuation of Legacy Binary Use: Upon expiration or non-renewal of the Annual Subscription, Customer's access to future Software Updates, future Feed Versions, and subscription support will cease, but expiration or non-renewal of the Annual Subscription does not disable or terminate Customer’s right to continue executing the legacy Software binary, updates and Feed Versions obtained prior to expiration.

• 5.4 Renewal Pricing: Subscriptions renew at SECITICS’s then-current list price at the time of renewal.

• 5.5 Lapsed Subscriptions & Re-instatement: If an Annual Subscription lapses, access to updates, feeds and support stops. Customer may reinstate access at any time by choosing to either: (a) pay the accrued back-maintenance fees for the lapsed period plus the upcoming annual subscription fee; or (b) purchase a new Perpetual Software License under then-current pricing and terms.

6. RESTRICTIONS & MANAGED SERVICES

• 6.1 Standard Restrictions: Customer shall not:

1. Decompile, disassemble, or reverse engineer the Software executables;
2. Sublicense, rent, lease, resell, or distribute the Software or Feeds to third parties;
3. Remove or alter proprietary, trademark, or copyright notices; or
4. Circumvent license keys or capacity restrictions.

• 6.2 Managed Services & MSSP Restrictions: Unless explicitly authorized under a dedicated "Consultant / MSSP License Certificate," the Software and Feeds are licensed solely for Customer’s internal operations. Customer shall not use the Software or Feeds to deliver commercial managed security services (MSSP), fee-for-service assessments, or third-party audits to external entities without:

• (i) Paying the applicable commercial/MSSP additional license fees; and
• (ii) Completing SECITICS’s mandatory license verification and commercial activation protocol.

7. AUTHORIZED ENVIRONMENT & INDEMNIFICATION

• 7.1 Customer Authorization: Customer represents and warrants that it possesses explicit, lawful ownership or formal written authorization (Rules of Engagement) to audit, review, and assess all target IT and ICS/OT IP addresses processed using the Software.

• 7.2 Customer Indemnification: Customer agrees to defend, indemnify, and hold harmless SECITICS, its officers, and developers from and against any third-party claims, damages, liabilities, or regulatory fines arising out of Customer's unauthorized usage, execution, probing, or testing of systems, networks, or infrastructure.

8. DELIVERY & LOCAL ENVIRONMENT

• 8.1 Electronic Delivery: Software, License Keys, and Feed Versions are delivered electronically via digital download or secure file transfer.

• 8.2 Local Customer Control: The Software executes within Customer's self-managed local or air-gapped environment. Except for information expressly submitted by Customer for support or license administration, SECITICS does not ordinarily collect, receive, or store Customer's operational network topology, vulnerability assessment data, or assessment results.

9. SUPPORT AND MAINTENANCE

• 9.1 Standard Support Scope: Active subscriptions include electronic ticketing support during standard business hours for core Software bug reports and operational break-fix issues.

• 9.2 Exclusions: Standard support excludes network architecture design, custom automation scripts, environmental troubleshooting, consultancy or audit. Such assistance requires a separate Professional Services agreement.

10. INTELLECTUAL PROPERTY & COMPILATION

• 10.1 SECITICS Ownership: SECITICS and its licensors retain all ownership and intellectual property rights in and to the Software, including its source code, object code, documentation, proprietary technology, and related intellectual property. SECITICS also retains all rights in its proprietary compilation, structure, organization, normalization, correlation, enrichment, classifications, mappings, methodologies, and other proprietary elements of the Security Intelligence Feed.

• Customer does not acquire ownership of the underlying Software or proprietary intellectual property and receives no right to reproduce, modify, distribute, sublicense, resell, publicly perform, publicly display, or create derivative works from the Software or Security Intelligence Feed. Subject to this Agreement, Customer nevertheless receives the perpetual right to retain and use each specific Software version, Update, and Security Intelligence Feed Version delivered to Customer for Customer's authorized internal security operations.

• 10.2 Third-Party Data: SECITICS retains all rights it owns in the original compilation, selection, arrangement, normalization, correlation, enrichment, structure, mappings, classifications, and other proprietary elements of the Feed. Third-party information and factual information remain subject to the rights and terms applicable to their respective sources.

11. FEES AND TAXES

• 11.1 Net Fees: All fees are net amounts payable in full to SECITICS.

• 11.2 Taxes: Fees are exclusive of applicable sales, use, VAT, GST, withholding, and other transaction taxes. Customer shall be responsible for taxes imposed on Customer's purchase or use of the Software, Feed, or services, except to the extent SECITICS is required by applicable law to collect or remit such taxes. Nothing in this Agreement constitutes a representation or guarantee by SECITICS regarding the tax characterization of any payment.

12. TERMINATION

• 12.1 Term: The perpetual Software license remains in effect indefinitely unless terminated for breach.

• 12.2 Termination for Breach: SECITICS may terminate this Agreement if Customer fails to cure a material breach within thirty (30) days of written notice. Any breach of Section 3.2 (Capacity), Section 6 (Restrictions), or Section 7.1 (Authorization) shall entitle SECITICS to terminate this Agreement immediately without a cure period.

• 12.3 Effect of Termination: Upon termination for material breach, Customer must cease all use of the Software and Feeds and destroy all copies of the Software and Feeds in its possession.

13. WARRANTIES AND DISCLAIMERS

• 13.1 Limited Warranty: SECITICS warrants that the Software will perform substantially in accordance with its standard documentation for thirty (30) days from initial delivery.

• 13.2 Disclaimer: EXCEPT AS EXPRESSLY STATED, THE SOFTWARE AND SECURITY INTELLIGENCE FEEDS ARE PROVIDED “AS IS” AND "AS AVAILABLE." SECITICS DOES NOT WARRANT THAT THE SOFTWARE IS ERROR-FREE OR THAT THE FEEDS WILL IDENTIFY EVERY VULNERABILITY, EXPLOIT, OR THREAT CONDITION IN CUSTOMER'S ENVIRONMENT.

14. LIMITATION OF LIABILITY

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, SECITICS SHALL NOT BE LIABLE FOR INDIRECT, CONSEQUENTIAL, INCIDENTAL, SPECIAL, OR PUNITIVE DAMAGES, LOSS OF PROFITS, DATA LOSS, OR BUSINESS INTERRUPTION ARISING FROM THE USE OF THE SOFTWARE OR FEEDS. SECITICS'S AGGREGATE LIABILITY UNDER THIS AGREEMENT SHALL NOT EXCEED THE TOTAL FEES ACTUALLY PAID BY CUSTOMER TO SECITICS IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM.

15. GENERAL

• 15.1 Export Compliance: Customer shall comply with all applicable U.S. and international export control laws, sanctions, and regulations regarding software binaries and technology transfers.

• 15.2 Entire Agreement: This Agreement, along with the applicable License Certificate, constitutes the entire agreement between the parties and supersedes all prior negotiations or purchase orders.

• 15.3 Governing Law & Jurisdiction: This Agreement shall be governed by and construed in accordance with the laws of the State of Wyoming, United States, without regard to conflict of law principles. Any legal dispute shall be resolved exclusively in the state or federal courts located in Wyoming, USA, or via binding arbitration under the Commercial Rules of the American Arbitration Association (AAA). The UN Convention on Contracts for the International Sale of Goods (CISG) is explicitly excluded.