Ecopetrol S.A. has a dedicated management team specialized in information security issues such as risk analysis, information processing, secure information management practices and classification of critical business information, compliance with control systems, effectiveness of available information security technologies, and third-party management to identify and monitor cybersecurity risks. This is articulated with the ERM system at the enterprise level.

Ecopetrol has established governance mechanisms designed to direct, supervise, and ensure effective information security management across the organization. These mechanisms operate at three levels: (i) oversight by the Board of Directors through two specialized committees (the Technology and Innovation Committee and the Audit and Risk Committee); and (ii) a senior executive role responsible for leading and coordinating the Company’s information security, cybersecurity, and cyber defense strategy in alignment with corporate objectives.

Within this framework, the Board of Directors oversees digital and cybersecurity matters through the Technology and Innovation Committee, which reviews the Group’s digital strategy and the operating model for information security, cybersecurity, cyber defense, privacy, and data recovery. The Audit and Risk Committee, within the scope of its functions, oversees risks associated with cybersecurity and information security threats. In addition, an executive role within the Vice Presidency of Science, Technology, and Innovation is responsible for directing, coordinating, and aligning the cybersecurity and information security strategy with the organization’s objectives.

In accordance with the Internal Regulations of the Technology and Innovation Committee of Ecopetrol S.A., the Board of Directors is informed of cybersecurity risks through the Technology and Innovation Committee. In Chapter 4 – Functions of the Technology, and Innovation Committee, include in Article 10:

The Cybersecurity and Cyber Defense Management is part of the Vice Presidency of Science, Technology and Innovation, reporting to senior management and the Board of Directors of the Company. In addition, as part of Ecopetrol’s cybersecurity management, ongoing training and awareness plans are carried out and implemented with the Board of Directors, senior management, and users in general, as well as specialized training for our cybersecurity team.

Emerging risks at an industrial and global level keep us constantly evolving in our capabilities and improvements in our processes. New technologies and hybrid ways of working expand the cyber threat landscape in critical infrastructures, making this risk necessary for management, monitoring, and improvement.

Ecopetrol S.A. has incorporated cybersecurity risk as one of its main business risks. Currently, there is a Cybersecurity and Defense Management, composed of a highly qualified, certified and high-performance team, which allows Ecopetrol to raise its cybersecurity measures. This team effectively manages and mitigates cybersecurity risks by implementing various activities aimed at identifying and protecting critical digital assets. Through capabilities such as protecting business operations, protecting supply chain, culture, privacy and data, and operational effectiveness in cybersecurity, the team prevents and contains cyber threats, while monitoring and reporting cybersecurity risks globally. In addition, cybersecurity risks and strategy are overseen by the committees of the board of directors, namely the technology and innovation committee and the audit and risk committee.

The cybersecurity team continues to integrate practices aimed at improving risk awareness and adjusting current information security capabilities in response to evolving cyber threats. As a result of this process, we continuously integrate elements related to cybersecurity threat management. These elements cover several aspects, including the proper configuration of storage devices, comprehensive information security controls, development of policies and procedures for information security, specialized monitoring and cyber threat services, vulnerability management, cyber incident response management, deployment of protection tools, monitoring and response to malicious activities, threat hunting, threat intelligence, security by design, and cybersecurity insurance coverage, among others.

Ecopetrol S.A. has a Security Operations Center (SOC) service, to improve the organization’s ability to identify trends in attacks on both its information technology infrastructure and its Operation Technology, while monitoring its online reputation. Throughout 2025, SOC capabilities remained operational, with a scope of services covering Operation Technology (OT) digital assets. Cybersecurity risk assessments and advanced security testing exercises (RedTeam) carried out on the IT/OT infrastructure of Ecopetrol and its subsidiaries were included, which allowed identifying gaps to improve the overall cybersecurity posture. In addition, specialized monitoring capabilities such as user behavior analysis remain. Although cyberattacks occurred during 2025, all reported events were successfully controlled, with no material effects on processes, equipment, products, services, customer or supplier relationships, competitive conditions, or critical information.

We updated our cybersecurity policies and cyber incident response procedures, by developing wargames that cover several of the business segments and their subordinates. These exercises document how to manage the activation of the cyber insurance policy, the unified command post and the operating model for cyber incident response with Ecopetrol’s internal teams. The action protocol for business crisis scenarios is also regularly reviewed, establishing timely notifications and communication processes with internal and external entities, as well as the roadmap to define and analyze the materiality of a cybersecurity incident. The cyber incident management guide includes the roles, responsibilities, and activities of those involved in responding to a cybersecurity event or alert.

In addition, during 2025, the internal audit department carried out audits of cybersecurity processes to follow up on previous improvement plans. Consequently, action plans were developed to address the identified findings.

Ecopetrol S.A. remains committed to the NGO-C2M2 framework (Cybersecurity Oil and Gas Capability Maturity Model) to manage its maturity and maintain its cybersecurity management system. This involves implementing practices and focusing our capabilities on domains such as information protection, cyber incident response, third-party cybersecurity management, and architecture.

Ecopetrol S.A. has also strengthened its cybersecurity capabilities in 2025 by continuing to incorporate fundamental “Zero Trust” practices and critical information protection controls to mitigate cyber risks in its business units. Another significant initiative throughout 2025 was the cultural awareness campaign focused on three management pillars: (i) training, which consists of the development of new skills, (ii) mobilization, which consists of the promotion and appropriation of change, and (iii) communication, which consists of the promotion of understanding and conviction of behaviors). In addition, the information life cycle was executed to identify, evaluate and manage cybersecurity risks associated with critical information assets and the Ecopetrol Group CSIRT (Cyber Incident Response Center) was inaugurated, which strengthens coordination with public and private entities in the management of cybersecurity incidents. This initiative made it possible to evolve the cybersecurity model leveraged on threat profiling and reduce the detection times of cybersecurity events and incident response times using emerging technologies such as machine learning and artificial intelligence.

The integrated cybersecurity and cyber defense plan defined for the period 2025 to 2040, which applies to a quantitative cyber risk model, was updated and aligned with the integrated plan for Science, Technology and Innovation, as well as with the Ecopetrol Group’s 2040 strategy. The integrated cybersecurity and cyber defense plan includes the following four pillars:

​

Ecopetrol has an analytics and artificial intelligence policy that establishes the ethical principles the Company follows: transparency, fairness, risk management, privacy, the role of humans, and accountability for AI systems. The policy also identifies key technical risk groups to mitigate when implementing AI projects, such as: risks from poor quality, biased, unrepresentative, or inappropriate data that can impact model accuracy; issues in algorithm development and training; lack of expertise leading to bias or degraded predictions; exposure of models to malicious actors or spurious patterns; risks associated with sharing personal information or data with analytics and AI models; non-compliance with regulations due to limited knowledge among development teams; overlooking variables and perspectives, which may result in adverse organizational decisions through model bias; and risks to confidentiality from using unclassified data and lacking security measures.

The Board of Directors oversees matters related to the adoption and responsible use of artificial intelligence through the Technology and Innovation Committee, which serves as a permanent supporting body. Specifically, the Board receives and evaluates, with prior analysis and recommendations from the Committee, strategic issues concerning technology and innovation, including the use of emerging technologies, digital strategy, and operating models associated with information management, cybersecurity, privacy, and data protection. In this way, the Board of Directors guides and ensures that the adoption of new technologies—such as AI—is carried out in alignment with the corporate strategy, under principles of corporate governance, risk management, and regulatory compliance, guaranteeing responsible and secure use consistent with the interests of the Company and the Ecopetrol Group.

At Ecopetrol, the management of artificial intelligence within the field of Cybersecurity is structured on a comprehensive approach that combines risk analysis, strengthening of technical capacities and development of human talent. For the period 2025–2026, the organization has established a set of actions to ensure the responsible, safe and resilient use of AI-based technologies.

First, an analysis of emerging risks associated with AI is carried out, which includes the identification of vulnerabilities in AI systems, as well as the evaluation of the operational and strategic risks that these technologies can introduce into the corporate environment.

At the same time, the adoption of technologies, tools, and new AI-based approaches aimed at strengthening cybersecurity and information security is being promoted, with the purpose of increasing the capacity for defense, monitoring, and protection of the digital ecosystem.

Likewise, cybersecurity controls aligned with Artificial Intelligence Secure Threat Risk (AISTR) are implemented, which strengthen the capabilities of identification, detection, protection, response and recovery against threats related to AI systems, guaranteeing a safe and resilient operation.

Finally, the strategy contemplates people’s awareness, promoting, safe use and consumption of services based on artificial intelligence. This human component is essential to ensure the mature adoption of AI and prevent risks arising from the lack of knowledge or inappropriate use of these technologies.

The integrated cybersecurity and cyber defense plan defined for the period 2025 to 2040, which applies to a quantitative cyber risk model, was updated and aligned with the integrated plan for Science, Technology and Innovation, as well as with the Ecopetrol Group’s 2040 strategy. The integrated cybersecurity and cyber defense plan includes the following four pillars:

​

In accordance with the Internal Regulations of the Technology and Innovation Committee of Ecopetrol S.A., the Board of Directors is informed of cybersecurity risks through the Technology and Innovation Committee. In Chapter 4 – Functions of the Technology, and Innovation Committee, include in Article 10:

The Board of Directors oversees matters related to the adoption and responsible use of artificial intelligence through the Technology and Innovation Committee, which serves as a permanent supporting body. Specifically, the Board receives and evaluates, with prior analysis and recommendations from the Committee, strategic issues concerning technology and innovation, including the use of emerging technologies, digital strategy, and operating models associated with information management, cybersecurity, privacy, and data protection. In this way, the Board of Directors guides and ensures that the adoption of new technologies—such as AI—is carried out in alignment with the corporate strategy, under principles of corporate governance, risk management, and regulatory compliance, guaranteeing responsible and secure use consistent with the interests of the Company and the Ecopetrol Group.

The Cybersecurity and Cyber Defense Management is part of the Vice Presidency of Science, Technology and Innovation, reporting to senior management and the Board of Directors of the Company. In addition, as part of Ecopetrol’s cybersecurity management, ongoing training and awareness plans are carried out and implemented with the Board of Directors, senior management, and users in general, as well as specialized training for our cybersecurity team.