Item 9A. Controls and Procedures

(a) Evaluation of Disclosure Controls and Procedures

The SEC defines the term “disclosure controls and procedures” to mean a company’s controls and other procedures that are designed to ensure that information required to be disclosed in the reports that it files or submits under the Exchange Act is recorded, processed, summarized, and reported, within the time periods specified in the SEC’s rules and forms. “Disclosure controls and procedures” include, without limitation, controls and procedures designed to ensure that information required to be disclosed by an issuer in the reports that it files or submits under the Exchange Act is accumulated and communicated to the issuer’s management, including its principal executive and principal financial officers, or persons performing similar functions, as appropriate to allow timely decisions regarding required disclosure. Our disclosure controls and procedures are designed to provide reasonable assurance that such information is accumulated and communicated to our management. Our management (with the participation of our Chief Executive Officer and Chief Financial Officer) has conducted an evaluation of the effectiveness of the design and operation of our disclosure controls and procedures (as defined in Rules 13a-15(e) and 15d-15(e) of the Exchange Act) as of the end of the period covered by this report.

Based on such evaluation, our Chief Executive Officer and our Chief Financial Officer have concluded that our disclosure controls and procedures were effective at the reasonable assurance level as of the end of the period covered by this Annual Report on Form 10-K.

(b) Management’s Report on Internal Control over Financial Reporting

Our management is responsible for establishing and maintaining adequate internal control over financial reporting (as defined in Rules 13a-15(f) and 15d-15(f) of the Exchange Act) for Gen Digital. Our internal control over financial reporting is a process designed under the supervision of our CEO and CFO to provide reasonable assurance regarding the preparation and reliability of financial reporting and preparation of our financial statements for external purposes in accordance with accounting principles generally accepted in the U.S.

Our management, with the participation of our Chief Executive Officer and our Chief Financial Officer, has conducted an evaluation of the effectiveness of our internal control over financial reporting as of April 3, 2026, based on criteria established in Internal Control - Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).

We completed the acquisition of MoneyLion in April 2025. Management has excluded MoneyLion from its assessment of the effectiveness of Gen’s internal control over financial reporting as of April 3, 2026. Total assets (excluding goodwill and intangibles) and total revenues of MoneyLion represent approximately 2%, or $354 million and 16%, or $823 million, respectively, of the Consolidated Financial Statement amounts as of, and for the fiscal year ended, April 3, 2026. This exclusion is in accordance with the SEC staff’s general guidance that an assessment of an acquired business may be omitted from the scope of management’s assessment of the effectiveness of internal control over financial reporting during the first year after completion of an acquisition while integrating the acquired company.

Our management has concluded that, as of April 3, 2026, our internal control over financial reporting was effective at the reasonable assurance level based on these criteria.

The effectiveness of our internal control over financial reporting, as of April 3, 2026, has been audited by KPMG LLP, an independent registered public accounting firm, as stated in their report, which is included in Part IV, Item 15 of this Annual Report on Form 10-K.

(c) Changes in Internal Control over Financial Reporting

There were no changes in our internal control over financial reporting identified in connection with the evaluation required by Rule 13a-15(d) and 15d-15(d) of the Exchange Act that occurred during the fiscal quarter ended April 3, 2026 that has materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.

On April 17, 2025, we completed our acquisition of MoneyLion and are currently integrating MoneyLion into our operations and internal control processes. Our initial assessment of MoneyLion’s internal control over financial reporting is ongoing. We have designed and implemented new controls as needed.

MoneyLion Material Weakness

A material weakness is a deficiency or a combination of deficiencies in internal control over financial reporting such that there is a reasonable possibility that a material misstatement of a registrant’s financial statement will not be prevented or detected on a timely basis.

Prior to the acquisition by Gen, MoneyLion reported an identified material weakness in its internal control over financial reporting. As a result, MoneyLion concluded that, as of December 31, 2024, its disclosure controls and procedures were not

effective in providing reasonable assurance that information required to be disclosed in reports filed or submitted under the Exchange Act was recorded, processed, summarized and reported within the time periods specified by SEC rules and forms. The material weakness identified relates to MoneyLion’s Credit Builder Loan product, involving certain cash disbursements made to customer escrow accounts that were not in accordance with the product’s terms. While the related transactions were properly reflected in the financial statements and no misstatements were identified, the control deficiency could have resulted in unauthorized disbursements of cash. Accordingly, this deficiency was determined to constitute a material weakness. MoneyLion has undertaken steps to remediate the material weakness and we are evaluating the steps that have been taken under Gen’s control framework.

(d) Limitations on Effectiveness of Controls

Our management, including our Chief Executive Officer and Chief Financial Officer, does not expect that our disclosure controls and procedures or our internal controls will prevent all errors and all fraud. A control system, no matter how well conceived and operated, can provide only reasonable, not absolute, assurance that the objectives of the control system are met. Further, the design of a control system must reflect the fact that there are resource constraints, and the benefits of controls must be considered relative to their costs. The design of a control system also is based in part upon assumptions and judgments made by management about the likelihood of future events, and there can be no assurance that a given control will be effective under all potential future conditions. Because of the inherent limitations in all control systems, no evaluation of controls can provide absolute assurance that all control issues and instances of fraud, if any, within our company have been detected.