We collect and maintain information in digital form that is necessary to conduct our business, and we are increasingly dependent on information technology systems and infrastructure to operate our business. In the ordinary course of our business, we collect, store, and transmit large amounts of confidential information, including intellectual property, proprietary business information, personal, financial, and health information of patients and personal and financial information of our employees and contractors. It is critical that we do so in a secure manner to maintain the confidentiality and integrity of such confidential information.
Despite the implementation of security and back-up measures, our information technology systems as well as those of our third-party collaborators, consultants, contractors, suppliers, and service providers, may be vulnerable to attack, damage, or interruption from physical or electronic break-ins, computer viruses, malware, malicious code, ransomware, denial or degradation of service, hacking, phishing attacks, and other cyber-attacks, natural disasters, terrorism, war, telecommunication and electrical failures, instructions and attacks from sophisticated nation-state and nation-state-supported actors (including advanced persistent threat intrusions), or other disruptive incidents that could result in unauthorized access to, use or disclosure of, corruption of, or loss of sensitive, and/ or proprietary data, including personal information, protected health information, and other sensitive information, and could subject us to significant liabilities and regulatory and enforcement actions, and reputational damage. The risk of a cybersecurity incident or disruption, particularly through cyberattacks or cyber intrusion, including by computer hackers, foreign governments, and cyber terrorists, has generally increased as the number, intensity and sophistication of attempted attacks and intrusions from around the world have increased and evolved. If we or our third-party vendors were to experience a significant cybersecurity incident affecting our or their information technology systems or data, the costs associated with the investigation, remediation, and potential notification of the incident to counterparties and data subjects could be material, in addition to any money required to resolve a ransomware attack. For example, laws in the European Economic Area ("EEA"), the United Kingdom, and all 50 U.S. states may require businesses to notify regulators within specific timeframes that an incident affecting personal information has occurred and/or to provide notice to individuals whose personal information has been impacted as a result of such incident. As part of our growth strategy, we have expanded into multiple jurisdictions outside of the United States, including the United Kingdom and Israel, and intend to continue expansions in 2025 and beyond. This growth will subject us to additional regulatory regimes and increase the amount of cybersecurity requirements for compliance in multiple geographies. Complying with such numerous and complex regulations in the event of a cybersecurity breach would be expensive and difficult, and failure to comply could subject us to regulatory scrutiny and additional liability. In addition, our remediation efforts may not be successful. Data protection laws and regulations often require appropriate, reasonable or adequate technical and organizational security measures, and the interpretation and application of those laws and regulations are often uncertain and evolving. There can be no assurance that our security measures will be deemed adequate, appropriate or reasonable by a regulator or court. Moreover, even security measures that are deemed appropriate, reasonable, or otherwise in accordance with applicable legal requirements may not be able to protect the information we maintain.
In connection with the Restructuring Plan, we have made reductions to the number of employees and amount of resources dedicated to these matters, and to our information technology efforts more broadly, and there may be further reductions to resources in the future. In addition to the number of employees allocated to these matters, if we fail to identify and retain qualified key personnel in these areas or fail to appropriately allocate responsibilities across remaining personnel, the quality of our cybersecurity efforts may be compromised. Even if we do allocate and effectively manage the resources necessary to build and sustain the proper technology and cybersecurity infrastructure, we could nevertheless suffer significant business disruption, including transaction errors, supply chain or manufacturing interruptions, processing inefficiencies, data loss, or the loss of or damage to intellectual property or other confidential or proprietary information.
As a part of our cybersecurity program, we conduct a number of internal evaluations and independent third-party audits and reviews. For example, as part of our overall public company preparedness efforts in connection with the Spin-Off in 2024, we underwent third-party reviews of our cybersecurity program against the NIST CSF 2.0 and NIST Privacy Framework, along with our ordinary course annual reviews under ISO 27001, SOC2 Type 2, PCI DSS, and other standards, in order to identify capabilities, gaps, and recommendations for improvement, and to compare our cybersecurity program to applicable requirements. These assessments generate numerous findings and opportunities that we intend to utilize in order to improve and mature our cybersecurity practices and promote continuous improvement in our cybersecurity and privacy programs. However, these improvements and maturation efforts may take a number of months or years to fully realize. Should these improvement and maturation efforts fail to improve or maintain our level of effectiveness in a timely manner or at all, or correct any observed gaps, we may be at risk of regulatory findings, cybersecurity attacks or data breaches, which would amplify the risks otherwise described.
We, along with companies with whom we engage in data sharing, including our service providers, are from time to time subject to cyberattacks and other cybersecurity incidents. While we do not believe that we have experienced any significant system failure, or cybersecurity incident to date, we may nonetheless be a target of such an attack, and if such an event were to occur and cause interruptions in our operations, or any of our third-party collaborators' operations, it could result in a material disruption of our development programs, reputation, and business operations whether due to a loss, corruption, or unauthorized disclosure of our trade secrets, personal information, financial information, health information, or other proprietary or sensitive information, or other similar disruptions. For example, the loss of clinical study data from completed or ongoing clinical studies could result in delays in any regulatory clearance, approval, or certification efforts and significantly increase our costs to recover or reproduce the data, and subsequently commercialize our products. If we or our third-party collaborators, consultants, contractors, suppliers, or service providers were to suffer a cybersecurity incident or attack, for example, that resulted in the unauthorized access to or use or disclosure of personal or health information, we may have to notify physicians, patients, partners, collaborators, government authorities, and the media, and may be subject to investigations, civil penalties, administrative and enforcement actions, and litigation, any of which could harm our business and reputation. Likewise, we rely on our third-party research institution collaborators and other third parties to conduct clinical studies, and similar events relating to their computer systems could also have a material adverse effect on our business. It could also expose us to risks, including an inability to provide our services and fulfill contractual demands, and could cause management distraction and the obligation to devote significant financial and other resources to mitigate such problems, which would increase our future information security costs, including through organizational changes, deploying additional personnel, reinforcing administrative, physical, and technical safeguards, further training of employees, changing third-party vendor control practices, and engaging third-party subject matter experts and consultants and reduce the demand for our technology and services. To the extent that any disruption or cybersecurity incident were to result in a loss of, or damage to, our data or systems, or inappropriate or unauthorized access to or disclosure or use of confidential, proprietary, or other sensitive, personal, or health information, we could incur liability, we could be exposed to the risk of litigation, our market position could be harmed, we could suffer reputational harm, and the development and commercialization of our products could be delayed. Furthermore, federal, state, and international laws and regulations can expose us to enforcement actions and investigations by regulatory authorities, and potentially result in regulatory penalties, fines, and significant legal liability, if our information technology security efforts fail or if there are material findings regarding data security or data integrity deficiencies by us or our critical partners, vendors, or suppliers. While we may be entitled to damages if our third-party partners, vendors, or suppliers fail to satisfy their security-related obligations, any award may be insufficient to cover our damages, or we may be unable to recover such award.
Attacks on information technology systems are increasing in their frequency, levels of persistence, sophistication, and intensity, and are being conducted by sophisticated and organized groups and individuals with a wide range of motives and expertise. Furthermore, because the techniques used to obtain unauthorized access to, or to sabotage, systems change frequently and often are not recognized until launched against a target, we may be unable to anticipate these techniques or implement adequate preventative measures. In particular, developments in artificial intelligence tools and computing power, are likely to increase the frequency and effectiveness of attacks. We may also experience cybersecurity incidents that may remain undetected for an extended period. Even if identified, we may be unable to adequately investigate or remediate cybersecurity incidents due to attackers increasingly using tools and techniques that are designed to circumvent controls, to avoid detection, and to remove or obfuscate forensic evidence.
While we maintain cybersecurity insurance, our insurance policies may not be adequate to compensate us for the potential losses arising from such disruptions, failure, or cybersecurity incident. In addition, such insurance may not be available to us in the future on economically reasonable terms, or at all. Further, our insurance may not cover all claims made against us and defending a suit, regardless of its merit, could be costly, divert management attention, and harm our reputation.