To ensure the confidentiality, integrity, and availability of WT information assets, as well as to comply with relevant laws and regulations and mitigate operational risks caused by internal and external threats, an information security policy has been established based on business needs. This policy applies to WT and its subsidiaries that are 100% directly or indirectly owned, controlled, or provide sales and services for the group. It also applies to all personnel within these organizations, including outsourced service providers, interns, and visitors. Information security clauses are incorporated into external contracts accordingly.
 
In accordance with the ISO/IEC 27001:2022 information security management standard, WT has established an internal audit mechanism for its Information Security Management System (ISMS), conducting comprehensive reviews across managerial aspects (policies and procedures, personnel awareness), technical aspects (access control, vulnerability management, log monitoring), and physical aspects (data center environment, information hardware equipment). Audits are performed at least once a year, with ad hoc audits initiated as necessary in response to material changes or cybersecurity incidents. The audit process comprises four stages: planning, on-site review, deficiency reporting, and management review. Identified deficiencies are classified by risk level and required to be remediated within a specified timeframe, with results regularly reported to the Chief Information Security Officer (CISO).
 
In 2025, two comprehensive cybersecurity audits were conducted, covering a total of 147 audit items, with 3 items identified for improvement. These covered areas including insufficient frequency of privileged account reviews, omissions in the asset inventory, and inadequate implementation of backup and recovery verification. All deficiencies were fully remediated by year-end, achieving a 100% completion rate. The audit findings have been incorporated into the following year’s information security improvement plan for continuous tracking.

 
 
Establishing a dedicated department to strengthen information security management

According to the World Economic Forum (WEF) Global Risks Report 2025, “misinformation and disinformation” rank as the number one global risk over the next two years and the fifth over the next ten years. The widespread dissemination of false information makes it difficult for individuals and organizations to make accurate decisions and may increase the cost of verifying information. Meanwhile, “cyber espionage and warfare” rank fifth and ninth over the next two and ten years, respectively. Increasingly complex cyber espionage activities and cybercrime, such as loss of privacy, data fraud, or data theft, pose significant threats. A failure in information security defenses could lead to data breaches and ransomware risks, or in more severe cases, disruptions to core systems that result in major operational losses and reputational damage.

In view of the growing importance of information security and the proliferation of cyber-attacks, WT’s Information Security Department is overseen by a Vice-President-level Chief Information Security Officer (CISO), and is staffed with two dedicated managers and seven full-time specialists. Their responsibilities cover security risk management, incident investigation, vulnerability disclosure, and the assessment and implementation of information security architectures. During 2025, no major information security incidents involving the leakage of sensitive data, personal data infringement, or interruptions to information services occurred, and no financial losses were incurred by customers or suppliers as a result of security events.

 
To continually enhance professional capabilities in information security, the Company uses the acquisition of cybersecurity certifications as an ongoing review mechanism, with a total of three internationally recognized cybersecurity certifications obtained in 2025. The Company is a member of joint-defense organizations including the TWCERT/CSIRT Alliance, the Taiwan Chief Information Security Officer Alliance, and the Information Service Industry Association of the R.O.C., enabling the sharing of cybersecurity trends and threat intelligence and strengthening the joint-defense ecosystem.

 
 


Ongoing enhancement of employee cyber-security awareness
As traditional perimeter defenses lose effectiveness, employee awareness has become pivotal to cybersecurity management. Since 2021, WT has conducted monthly social engineering drills using randomly selected phishing templates. Employees who click on suspicious links undergo retraining and their immediate supervisors are notified, with results regularly tracked to reduce threats arising from insufficient security awareness among employees.
 


Awareness Initiative – 2025 Results

✎

Security-Awareness TrainingIn 2025, a total of 6,952 employees were required to attend the training. Excluding 17 employees who applied for unpaid leave, maternity leave, or resigned during the training period, 6,935 employees completed the course and passed the assessment, achieving a completion rate of 99.7%.

✉

Social-Engineering DrillsApproximately 360,000 social engineering simulation emails were sent to employees. The employee click rate was 1.4%, achieving a phishing simulation failure rate lower than the technology industry average of 4% across the Group.

★

Advanced Professional TrainingCompleted one advanced training session for personnel and supervisors related to core systems.




Strengthening the security framework to build corporate resilience
Guided by ISO 27001 and the NIST Cybersecurity Framework, WT applies defense-in-depth and secure-by-design principles across eight layers: governance, data, endpoints, applications, networks, third-party supply, business continuity & incident response, and threat intelligence & joint defense. Residual risks are continuously monitored. External ISO 27001 audits and red-team exercises validate our controls. WT holds ISO/IEC 27001:2022 and CNS 27001:2023 certificates, valid through 2028. Key 2025 actions mapped to the NIST CSF 2.0 functions are:
 


Govern
Regular security steering meetings (12 times per year) brief CISO on strategic goal attainment, identification of internal and external threats, progress of cybersecurity governance projects, and variance analysis, ensuring alignment between cyber security and business objectives.


Identify
Enhanced governance and policies; strengthened an asset-inventory system and vulnerability scans; evaluated an external risk-management platform for threat identification and analysis.


Protect
Classified information assets into Tiers 1-3 by sensitivity; strengthened physical security, network micro-segmentation, access controls, and endpoint hardening. Extensive access logs are collected for behavioral analysis and continuous monitoring.


Detect
Implemented a new Endpoint Detection and Response (EDR) solution integrated with Security Information and Event Management (SIEM) and User & Entity Behavior Analytics (UEBA); big-data analytics establish behavioral baselines and accelerate anomaly detection.


Respond
According to the incident response plan, suspicious anomalies are analyzed and assessed; once an event is verified as genuine, it is classified and handled based on its scope of impact, and the appropriate notification is issued in line with the assigned severity level. To strengthen the physical security and continuous monitoring of the data center, a digital evidence-collection mechanism has been implemented.


Recover
To reinforce the organization’s cyber-resilience and ensure that product and service delivery are not disrupted by “black-swan” or“grey-rhino” incidents, we are closing the last mile of data protection. In addition to adhering to the 3-2-1 backup principle (three copies, two different media, and one off-site location), we have also adopted an offline-media backup solution to further shorten recovery time in the event of a cybersecurity incident.




Strengthening cyber-security governance and network protection
WT follows a “defense-in-depth” and “security-by-design” approach. Guided by Continuous Threat Exposure Management (CTEM), we proactively identify assets with vulnerable attack paths and apply risk-management controls to reduce both the likelihood and impact of incidents. Our 2025 cyber-security controls include the following:




◎ 

Threat Intelligence / Inspection

· Daily collection and analysis of domestic & international cyber-security news, open-source intelligence (OSINT), and vendor / ISAC advisories.
· Annual third-party penetration tests or red-team exercises.



▣ 

Endpoints

· Deployment of Endpoint Detection & Response (EDR) on PCs and servers with regular updates and real time analytics.
· Activation of behavioral-analysis modules and adoption of Managed Detection & Response (MDR) services.



▤ 

Data

· Encryption of sensitive data in transit and at rest.
· Annual in-house processing of retired information assets to ensure media are unreadable.
· Engagement of external specialists for de-magnetisation and physical destruction of retired assets, followed by disposal at government-accredited recyclers under escorted, fully logged procedures.



⚙ 

Applications

· Weekly vulnerability scanning with risk-based patch prioritisation and scheduled patch management.
· Implementation of Multi-Factor Authentication (MFA) and regular weak-password checks per NIST 800-63B.
· Use of FIDO2 hardware keys for critical cloud services to mitigate credential theft and brute-force attacks.



⬡ 

Network

· Deployment of next-generation firewalls (NGFWs) featuring application awareness, Intrusion Prevention (IPS) and Advanced Threat Protection (ATP).
· Identity-aware segmentation that separates employee and visitor access paths.
· Enhanced email security with advanced threat-protection modules to improve content analysis.







Addressing customers’ cyber-security concerns
 WT’s transac tions throughout the supply chain rely heavily on IT systems and online plat forms. Customers and upstream and downstream suppliers regularly evaluate us through cyber-security self-assessment questionnaires and hold ad-hoc discussions on specific security topics. WT has also established an “Outsourcing Management Procedure” requiring information security clauses to be included in contracts for outsourced projects such as information hardware/software procurement, information system development, operations and maintenance, cloud services, and related technical support, in compliance with the Company’s information security requirements. To meet customer requirements, WT also engages third-party security service providers to perform red team exercises or penetration testing to safeguard supply-chain information security. 


Sources of Cyber-Security Information

Customers
Vendors
Cyber-security information-sharing alliances / ISACs
IT hardware & software vendors
Cyber-security service providers
Cyber-security news outlets or specialist websites
Zero-day exploit intelligence and similar alerts
External risk-management platforms





 
Business continuity and emergency response
24/7 cybersecurity monitoring without interruption

WT has established a dedicated cybersecurity email inbox to receive diverse external threat intelligence, using it to reinforce internal safeguards. The company has also entered into managed-service agreements with third-party providers for Managed Detection and Response (MDR). This always-on, 24×7 mechanism enables continuous, real-time monitoring of cybersecurity threats.


Regular cybersecurity-incident drills to ensure the fastest possible recovery
To strengthen corporate resilience and maintain high availability of information systems, WT carries out at least one test and drill each year under the Cybersecurity Management System’s Business Continuity Plan. The exercise simulates a primary-system failure, switches the main data center to a remote site, records results in detail, and folds lessons learned into continual-improvement tracking.
WT continuously conducts power outage drills for sudden blackout scenarios to ensure that emergency generators can be activated promptly and that all facilities and systems can maintain normal operations. The drills confirmed that the emergency response procedures were appropriate and that all facilities and systems functioned properly.
Establishing cybersecurity reporting tiered management & rapid response
WT has issued a Security-Incident Management Procedure that defines four severity levels and the associated escalation flow. When an incident occurs, the person who discovers it reports the details or security staff perform an incident determination; notifications are then sent in line with the assigned level. If the incident is classified as “major”, it must be reported immediately to the Chief Information Security Officer (CISO), who in turn briefs the General Manager for follow-up emergency-response management.
The IT department must eliminate and resolve cybersecurity incidents within the target resolution time. After closure, it conducts a post-incident review and implements improvement actions to prevent recurrence. If an incident results from an individual employee’s behavior, the root cause and impact are assessed and disciplinary measures are imposed in accordance with work rules.

In 2025, the Company experienced a total of two cybersecurity incidents, both classified as non-material events. One incident involved the leakage of an employee account password; however, through timely detection and prompt response measures, no impact on the Company’s operations occurred. Following review and investigation, none of the incidents involved interruptions to core system services, nor did they result in the leakage of sensitive information or customer privacy data.
 

WT Information Security Incident Flow Chart


Backup measures when the system is under attack



Backup Method
Backup Frequency

Data Restoration Scenario






Local data snapshot


Once every hour


If the hardware is intact, the fastest way to recover compromised data.




Remote replication


Real-time replication to the backup center, plus off-site snapshots


When the primary data center suffers a force-majeure event or a failure that cannot be restored immediately, the COO authorizes switching system services to the backup center.




Off-site storage of backup media


Daily backup; offline media moved off-site weekly


If both the primary data center and the backup center are unable to provide service, data restoration and system rebuild will be carried out from the offline backups.







 

 
 
 
 

2025 WT’s cybersecurity performance

Two roundsof company-wide cybersecurity-awareness training, plus one intensive sessionfor core-system personnel and managers.
Approximately 360,000 phishing simulation emails were sent, with an employee click rate of 1.4%, achieving the target of remaining below the industry average of 4%.
Approximately 1.98 million spam emailswere blocked, and around 680,000 malicious emails were prevented by threat protection mechanisms.
Approximately 50,000 endpoint threat events were blocked.
Approximately 160,000 system and software vulnerabilities were remediated.
Earned three additional international cybersecurity certifications and logged 200+ hoursof professional training.



 
 
 

2026 cybersecurity management plan



Security-Management Mechanisms 01
· Continue to reinforce and improve cybersecurity governance, using scenario-based plans and drills to boost organizational resilience.

· Hold a monthly cybersecurity meeting to review internal and external threats, and convene an annual management-review meeting to track improvements.


Security-Control Measures 02
· Keep strengthening identity management, micro-segmentation, and visibility to build a comprehensive security infrastructure.

· Monitor new technologies for both opportunities & risks, and adjust the architecture and defenses accordingly.

· Further enhance SIEM/UEBA (for visibility) and SOAR (security orchestration, automation, and response); leverage AI to analyze system logs and identify potential risks, using automated responses to minimize impact.


Security Awareness & Training 03
· Provide ad-hoc awareness campaigns and training based on real cases to keep employees vigilant; add content on AI deep-fake scams and emerging frauds, including safe-AI-use tips and cautions about unfamiliar sources.
· Upgrade cybersecurity staff competencies by continually acquiring relevant international certifications, equipping them to counter evolving external attacks and internal requirements.


Joint Defense & Supply-Chain Collaboration 04
· Keep strengthening overall supply-chain security and actively participate in joint-defense forums to obtain the latest threat intelligence.
· Continue to meet customer requirements through security assessments, vulnerability scans, and penetration tests.