We collect and maintain information in digital form that is necessary to conduct our business, and we are increasingly dependent on information technology systems and infrastructure to operate our business. In the ordinary course of our business, we collect, store, and transmit large amounts of confidential information, including intellectual property, proprietary business information, preclinical and clinical trial data, and personal information (collectively, Confidential Information). It is critical that we do so in a secure manner to maintain the confidentiality and integrity of such Confidential Information.
Our information technology systems and infrastructure, and those of our current and any future service providers, strategic partners, and other collaborators, contractors, and consultants, are vulnerable to attack, damage, and interruption from computer viruses and malware (e.g., ransomware), misconfigurations, "bugs" or other vulnerabilities, malicious code, natural disasters, terrorism, war, telecommunication and electrical failures, hacking, cyber-attacks or cyber intrusions over the Internet, phishing attacks and other social engineering schemes, employee theft or misuse, human error, fraud, denial or degradation of service attacks, and sophisticated nation-state and nation-state-supported actors. While our controls and procedures help enable us to protect from or respond to cybersecurity threats, there can be no assurance that these controls and procedures will be adequate to protect us from any cyber incident. The threats are always evolving, will become more advanced with the use of AI, and may become increasingly difficult or impossible to detect and prevent. In the future, our existing controls and procedures may become inadequate and may require significant additional resources to enhance systems and controls or to investigate and remediate any security vulnerabilities.
The risk of a security breach or disruption, particularly through cyber-attacks or cyber intrusions, including by computer hackers, foreign governments, and cyber terrorists, has generally increased as the number, intensity, and sophistication of attempted attacks and intrusions from around the world have increased. Bad actors use increasingly sophisticated methods, including the use of AI, to engage in illegal activities involving the theft and misuse of personal information, Confidential Information, and intellectual property. If we or our third-party vendors were to experience a significant cybersecurity breach of our or their information systems or data, the costs associated with the investigation, remediation, and potential notification of the breach to counterparties and data subjects could be material. In addition, our remediation efforts may not be successful. If we do not allocate and effectively manage the resources necessary to build and sustain the proper technology and cybersecurity infrastructure, we could suffer significant business disruption, including transaction errors, supply chain or manufacturing interruptions, processing inefficiencies, data loss or the loss of or damage to intellectual property or other proprietary information. There can also be no assurance that our and our third-party service providers', strategic partners', contractors', consultants', CROs' and collaborators' cybersecurity risk management program and processes, including policies, controls, or procedures, will be fully implemented, complied with or effective in protecting our systems, networks, and Confidential Information. Additionally, if we, our third-party vendors or partners experience an actual or perceived breach or data privacy or security incident, we may lose valuable intellectual property and Confidential Information, and our reputation and the public perception of the effectiveness of our security measures could be harmed.
We and certain of our service providers are from time to time subject to cyber-attacks and security incidents. While we do not believe that we have experienced any significant system failure, accident or security breach to date, if such an event were to occur and cause interruptions in our operations, it could result in a material disruption of our development programs and our business operations, whether due to a loss, corruption or unauthorized disclosure of our trade secrets, personal information or other proprietary or sensitive information or other similar disruptions. It could also expose us to risks, including an inability to provide our services and fulfill contractual demands, and could cause management distraction and the obligation to devote significant financial and other resources to mitigate such problems, which would increase our future information security costs, including through organizational changes, deploying additional personnel, reinforcing administrative, physical and technical safeguards, further training of employees, changing third-party vendor control practices and engaging third-party subject matter experts and consultants and reduce the demand for our technology and services.
Attacks upon information technology systems are increasing in their frequency, levels of persistence, sophistication and intensity, and are being conducted. In addition, the prevalent use of mobile devices and employees and contractors working from home and/or remote locations that access Confidential Information increases the risk of data security breaches, which could lead to the loss of Confidential Information or other intellectual property. Furthermore, because the techniques used to obtain unauthorized access to, or to sabotage, systems change frequently and often are not recognized until launched against a target, we may be unable to anticipate these techniques or implement adequate preventative measures. We may also experience security breaches that may remain undetected for an extended period. Even if identified, we may be unable to adequately investigate or remediate incidents or breaches due to attackers increasingly using tools and techniques that are designed to circumvent controls, to avoid detection, and to remove or obfuscate forensic evidence. The costs to us to mitigate network security problems, bugs, viruses, worms, malicious software programs, and security vulnerabilities could be significant and are likely to increase in the future. These costs include, but are not limited to, retaining the services of cybersecurity providers; compliance costs arising out of existing and future cybersecurity, data protection and privacy laws and regulations; and costs related to maintaining redundant networks, data backups and other damage-mitigation measures.
While we have implemented security measures to protect our data security and information technology systems, our efforts to address these problems may not be successful, and these problems could result in unexpected interruptions, delays, cessation of service, and other harm to our business and our competitive position. Any security compromise affecting us, our service providers, strategic partners, other contractors, consultants, or our industry, whether real or perceived, could harm our reputation, erode confidence in the effectiveness of our security measures and lead to regulatory scrutiny. If such an event were to occur, it could result in a material disruption of our product development programs and commercial operations. For example, the loss of clinical trial data from completed or ongoing or planned clinical trials could result in delays in our regulatory approval efforts and significantly increase our costs to recover or reproduce the data. Moreover, if a computer security breach affects our systems or results in the unauthorized release of confidential, proprietary, or personal information, our reputation could be materially damaged. In addition, such a breach may require notification to governmental agencies, supervisory bodies, the media or individuals pursuant to various federal and state privacy and security laws, if applicable. Any adverse impact to the availability, integrity or confidentiality of our or third-party systems or Confidential Information can result in legal claims or proceedings (such as class actions), regulatory investigations and enforcement actions, fines and penalties, negative reputational impacts that cause us to lose existing or future customers, and/or significant incident response, system restoration or remediation and future compliance costs. We would also be exposed to a risk of loss or litigation and potential liability, which could materially adversely affect our business, results of operations, and financial condition. Further, our existing insurance policies may not cover, or may cover only a portion of, any potential claims related to security breaches to which we are exposed or may not be adequate to indemnify us for all or any portion of liabilities that may be imposed.