Annual report [Section 13 and 15(d), not S-K Item 405]

Cybersecurity Risk Management and Strategy Disclosure

v3.26.1
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2025
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]

We recognize the importance of identifying, assessing, and managing material risks associated with cybersecurity threats, which risks include, among other things, operational risks, intellectual property theft, fraud, extortion, harm to employees or participants in our clinical trials, and violation of data privacy or security laws. In the ordinary course of our business, we collect and store certain confidential information such as information about our employees, contractors, vendors, suppliers, and clinical data. We augment the capabilities of our people, processes, and technologies in order to address our cybersecurity risks. Our cybersecurity risks, and the controls designed to mitigate those risks, are integrated into our overall risk management governance and are reviewed regularly by our Audit Committee.

 

Risk Management and Strategy

 

Identifying, assessing, and managing cybersecurity risk is integrated into our overall enterprise risk management systems and processes. Our cybersecurity risk management program has been developed based upon prevailing security standards and the National Institute of Standards and Technology (NIST) framework for evaluating and responding to potential cybersecurity risks, and addressing cybersecurity threats and incidents to the extent they arise. We have designed our business applications to minimize the impact that cybersecurity incidents could have on our business and have identified back-up systems where appropriate. Security events and data incidents are evaluated, ranked by severity, and prioritized for response and remediation when or if they occur. Incidents are evaluated to determine materiality, as well as operational, business and privacy impact. An important component of this program is employee awareness of and vigilance regarding cybersecurity risks. Our employees receive ongoing cybersecurity awareness trainings, including specific topics related to social engineering, phishing and email fraud.

 

Recognizing the complexity and evolving nature of cybersecurity threats, incidents and risks, we engage third-party experts, including managed information technology (IT) service providers and cybersecurity consultants, to evaluate and support our risk management systems, monitor potential vulnerabilities, periodically test our cybersecurity controls and procedures, and respond to cybersecurity incidents affecting us, including prompt escalation and communication of major security incidents to legal counsel, senior management and the Audit Committee of our Board of Directors. We utilize advanced technologies for continuous cybersecurity monitoring across our IT environment which are designed to prevent, detect and minimize cybersecurity attacks, as well as alert management of such attacks.

Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block] Identifying, assessing, and managing cybersecurity risk is integrated into our overall enterprise risk management systems and processes. Our cybersecurity risk management program has been developed based upon prevailing security standards and the National Institute of Standards and Technology (NIST) framework for evaluating and responding to potential cybersecurity risks, and addressing cybersecurity threats and incidents to the extent they arise. We have designed our business applications to minimize the impact that cybersecurity incidents could have on our business and have identified back-up systems where appropriate. Security events and data incidents are evaluated, ranked by severity, and prioritized for response and remediation when or if they occur. Incidents are evaluated to determine materiality, as well as operational, business and privacy impact. An important component of this program is employee awareness of and vigilance regarding cybersecurity risks. Our employees receive ongoing cybersecurity awareness trainings, including specific topics related to social engineering, phishing and email fraud
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Text Block] As of the date of this annual report on Form 10-K, risks from cybersecurity threats including as a result of any previous cybersecurity incidents, have not materially affected, and we do not believe they are reasonably likely to materially affect, us, our business strategy, results of operations, or financial condition. However, cybersecurity threats are constantly evolving, becoming more frequent and more sophisticated and are being made by groups of individuals with a wide range of expertise and motives, which increases the difficulty of detecting and successfully defending against them. While we have implemented measures to safeguard our operational and technology systems, the evolving nature of cybersecurity attacks and vulnerabilities means that these protections may not always be effective.
Cybersecurity Risk Board of Directors Oversight [Text Block]

Governance

 

The Audit Committee of our Board of Directors is responsible for overseeing our cyber security risk management and strategy, including overseeing management’s responsibility to assess, manage and mitigate risks associated with our business and operational activities, to administer our various compliance programs, in each case including cybersecurity concerns, and to oversee our IT systems, processes and data. Our Chief Financial Officer and cybersecurity consultants regularly meet with and provides periodic briefings to our Audit Committee regarding our cybersecurity risks and activities, including any recent cybersecurity incidents, if any, and related responses, and cybersecurity systems testing.

 

 

Management has implemented risk management policies and procedures, and management is responsible for the day-to-day cybersecurity risk management. Our Chief Financial Officer is responsible for the day-to-day assessment and management of our cybersecurity risks.

 

Cybersecurity Threat Disclosure

 

As of the date of this annual report on Form 10-K, risks from cybersecurity threats including as a result of any previous cybersecurity incidents, have not materially affected, and we do not believe they are reasonably likely to materially affect, us, our business strategy, results of operations, or financial condition. However, cybersecurity threats are constantly evolving, becoming more frequent and more sophisticated and are being made by groups of individuals with a wide range of expertise and motives, which increases the difficulty of detecting and successfully defending against them. While we have implemented measures to safeguard our operational and technology systems, the evolving nature of cybersecurity attacks and vulnerabilities means that these protections may not always be effective.

 

For further discussion of cybersecurity risks, please see Item 1A, "Risk Factors".

Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] The Audit Committee of our Board of Directors is responsible for overseeing our cyber security risk management and strategy, including overseeing management’s responsibility to assess, manage and mitigate risks associated with our business and operational activities, to administer our various compliance programs, in each case including cybersecurity concerns, and to oversee our IT systems, processes and data. Our Chief Financial Officer and cybersecurity consultants regularly meet with and provides periodic briefings to our Audit Committee regarding our cybersecurity risks and activities, including any recent cybersecurity incidents, if any, and related responses, and cybersecurity systems testing.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] The Audit Committee of our Board of Directors is responsible for overseeing our cyber security risk management and strategy, including overseeing management’s responsibility to assess, manage and mitigate risks associated with our business and operational activities, to administer our various compliance programs, in each case including cybersecurity concerns, and to oversee our IT systems, processes and data. Our Chief Financial Officer and cybersecurity consultants regularly meet with and provides periodic briefings to our Audit Committee regarding our cybersecurity risks and activities, including any recent cybersecurity incidents, if any, and related responses, and cybersecurity systems testing.
Cybersecurity Risk Role of Management [Text Block] Management has implemented risk management policies and procedures, and management is responsible for the day-to-day cybersecurity risk management. Our Chief Financial Officer is responsible for the day-to-day assessment and management of our cybersecurity risks.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] Management has implemented risk management policies and procedures, and management is responsible for the day-to-day cybersecurity risk management. Our Chief Financial Officer is responsible for the day-to-day assessment and management of our cybersecurity risks.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] Management has implemented risk management policies and procedures, and management is responsible for the day-to-day cybersecurity risk management. Our Chief Financial Officer is responsible for the day-to-day assessment and management of our cybersecurity risks.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] The Audit Committee of our Board of Directors is responsible for overseeing our cyber security risk management and strategy, including overseeing management’s responsibility to assess, manage and mitigate risks associated with our business and operational activities, to administer our various compliance programs, in each case including cybersecurity concerns, and to oversee our IT systems, processes and data. Our Chief Financial Officer and cybersecurity consultants regularly meet with and provides periodic briefings to our Audit Committee regarding our cybersecurity risks and activities, including any recent cybersecurity incidents, if any, and related responses, and cybersecurity systems testing.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true