In the ordinary course of business, we collect, store, transmit and otherwise process large amounts of data including, without limitation, proprietary business information and personal information. Despite the implementation of security measures, our information technology systems (including infrastructure) and those of our current and any future CROs and other contractors, consultants, third-party service providers, vendors and collaborators are vulnerable to numerous and evolving cybersecurity risks, including from diverse threat actors such as state-sponsored organizations, opportunistic hackers and hacktivists, as well as through diverse attack vectors (such as denial-of-service attacks, malware, ransomware, supply chain attacks, computer viruses, cyber-attacks or cyber-intrusions over the Internet, hacking, phishing and other social engineering attacks), and as a result of malicious code, misconfigurations, 'bugs' or other vulnerabilities in software that is integrated into our (or our suppliers' or service providers') IT systems, products or services, alongside damage from natural disasters, terrorism, war and telecommunication and electrical failures. Our systems are also subject to compromise from internal threats, such as theft, misuse, unauthorized access or other improper or accidental actions by employees, vendors and other third parties with otherwise legitimate access to our systems. Third parties may also attempt to fraudulently induce our employees and contractors into disclosing sensitive information such as usernames, passwords or other information, or otherwise compromise the security of our electronic systems, networks, and/or physical facilities in order to gain access to our data. Attacks upon information technology systems are increasing in their frequency, levels of persistence, sophistication and intensity, and are being conducted by sophisticated and organized groups and individuals with a wide range of motives, expertise, techniques and tools – including artificial intelligence – to circumvent security controls, evade detection and remove forensic evidence. Additionally, we currently work in a hybrid working environment, which may cause increased cybersecurity risks due to our reliance on internet technology and the number of our employees (and employees of our vendors, contractors and other organizations with whom we have formed strategic relationships) who are working remotely, which may create additional opportunities for threat actors to exploit vulnerabilities. Furthermore, new techniques may not be identified until they are launched against a target, and we may be unable to anticipate these techniques or detect an incident, assess its severity or impact, react or appropriately respond in a timely manner or implement adequate preventative measures, resulting in potential data loss or other damage to our information technology systems. Given the unpredictability of the timing, nature and scope of information technology disruptions, there can be no assurance that any security procedures and controls that we or our third-party partners and service providers have implemented will be sufficient to prevent cyber-attacks from occurring. The latency of a compromise is often measured in months, but could be years, and we may not be able to detect a compromise in a timely manner.
We and certain of our service providers and vendors are from time to time subject to cyberattacks and cybersecurity incidents. While we do not believe that we have experienced any significant system failure or other cybersecurity incident to date, if such an event were to occur and cause interruptions in our operations or result in the unauthorized disclosure of, access to or other processing of personal information or individually identifiable health information (potentially violating certain privacy laws), other otherwise adversely affect the confidentiality, integrity and availability of our information systems or any information stored therein, it could result in a material disruption of our development programs and our business operations, whether due to a loss of our trade secrets or other similar disruptions. Some of the federal, state and foreign government requirements include obligations of companies to notify individuals of cybersecurity breaches involving particular personal information, which could result from breaches experienced by us or by our vendors, contractors, or organizations with which we have formed strategic relationships.
Any security breach or other incident, whether actual or perceived, could impact our reputation, cause us to incur significant costs, including legal expenses, harm customer confidence, hurt our expansion into new markets, cause us to incur remediation costs, or cause us to lose existing customers. For example, the loss of clinical trial data from clinical trials could result in delays in our regulatory approval efforts and significantly increase our costs to recover or reproduce the data. We also rely on third parties to manufacture our product candidates, and similar events relating to their computer systems could also have a material adverse effect on our business. We have also outsourced elements of our information technology infrastructure, and as a result a number of third-party vendors may or could have access to our confidential information. There can no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our information systems and personal or confidential Information. To the extent that any actual or perceived disruption or cybersecurity incident were to jeopardize the confidentiality, integrity, or availability of our systems (or those of our third-party collaborators, service providers, vendors, contractors or consultants) or were to result in a loss of or accidental, unlawful or unauthorized access to, use of, release of, or other processing of personal confidential or proprietary information, or damage to, our data or applications, we could incur liability, the further development and commercialization of our product candidates could be delayed, and we could be subject to significant fines, penalties or liabilities for any noncompliance with certain privacy and cybersecurity laws. Further, our insurance coverage may not be sufficient to cover the financial, legal, business or reputational losses that may result from an interruption or breach of our systems, or that applicable insurance will be available to us in the future on economically reasonable terms or at all.