58 If our security i measures,s or those maintained on our behalf by CROs, service provider d sr or othe t r third parties, are compromised now, or in the future,e or the security i ,y confid f en d tiality,y integr e ity or availa i bility i of our or othe t rs' info n rmatio t n technology o ,y soft o wa t re,e services,s networks r ,s communications or datat is compromise i d, limited t or fails, l this couldl result in sign i ific f ant fine i s or othe t r liability i ,y interrupt our developm o ent programs, harm our repu e tation, or othe t rwise adverse r ly affe f ct our busine i ss. In the ordinary course of our business, we and others upon which we rely process personal data and other sensitive information, including proprietary and confid f ential business data, trade secrets, intellectua t l property, data collected about trial participants in connection with clinical trials, and sensitive third-party data. We rely upon third-party service providers and technologies to operate critical business systems to process sensitive information in a variety of contexts, including, without limitation, third-party providers of cloud-based infrastructur t e, encrypt r ion and authentication technology, employee email, and other functions. Our ability to monitor these third parties’ information security practices is limited, and these third parties may not have adequate information security measures in place. Cyberattacks, malicious internet-based activity, and online and offl f ine fraud are prevalent and continue to increase. These threats are becoming increasingly difficult to detect. The information and data processed and stored in our technology systems, and those of our research collabor a ators, CROs, contractors, consultants, and other third parties on which we depend to operate our business, may be vulnerabl a e to these threats. These threats come from a variety of sources, including traditional computer “hackers,” threat actors, personnel (such as through theftf or misuse), sophisticated nation-states, and nation-state- suppor u ted actors. During times of war and other majo a r conflic f ts, we and the third parties upon which we rely may be vulnerabl a e to a heightened risk of attacks, including cyber-attacks that could materially disrupt r our systems and operations and suppl u y chain. We and the third parties upon which we rely may be subj u ect to a variety of evolving threats, including but not limited to social-engineering attacks (including through deep fakes and phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrus r ions), denial-of-service attacks (such as credential stuf t fi f ng), personnel misconduct or error, ransomware attacks, suppl u y-chain attacks, software bugs, server malfunc f tions, software or hardware failures, loss of data or other information technology assets, adware, attacks enhanced or facilitated by artific f ial intelligence (AI), and other similar threats. Ransomware attacks, including by organized criminal threat actors, nation-states, and nation-state-suppor u ted actors, are becoming increasingly prevalent and severe and can lead to significant interrupt u ions in our operations, loss of data and income, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unabl a e to make such payments due to, for example, applicable laws or regulations prohibiting such payments. Similarly, suppl u y-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties and infrastructur t e in our suppl u y chain or our third-party partners’ suppl u y chains have not been compromised or that they do not contain exploitabl a e defects or bugs that could result in a breach of or disrupt r ion to our information technology systems or the third-party information technology systems that suppor u t us. Additionally, certain personnel may remain in a remote work environment and outside of our corporate network security protection boundaries, which imposes additional risks to our business, including increased risk of industrial espionage, phishing and other cybersecurity attacks, and unauthorized dissemination of proprietary or confid f ential information, any of which could have a material adverse effe f ct on our business. Any of the previously identifie f d or similar threats could cause a security incident or other interrupt u ion. A security incident or other interrupt u ion could result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encrypt r ion, disclosure of,f access to our sensitive information, or interrupt u ions or stoppages in our business operations (including our clinical trials). Although to our knowledge, we have not experienced a material system failure or security incident to date, if such an event were to occur, it could result in a material disrupt r ion of our development programs and our business operations, whether due to a loss of trade secrets or other proprietary information or other similar disrupt r ions. For example, the loss of clinical trial data from completed, on-going or future clinical trials could result in delays in our regulatory r approval effo f rts and significantly increase our costs to recover or reproduce the data. Likewise, we rely on third- party research institution collabor a ators, CROs, other contractors and consultants for many aspects of our business, including research and development activities and manufac f turing of our product candidates, and similar events relating to their computer systems could also have a material adverse effe f ct on our business.

Kodiak: 2023 Annual Report - Page 68 Kodiak: 2023 Annual Report Page 67 Page 69