59 While we have developed systems and processes designed to protect the integrity, confid f entiality and security of the sensitive information under our control, we cannot assure you that our security measures or those of the third parties we depend on will be effe f ctive in preventing security incidents. There are many different and rapi a dly evolving cybercrime and hacking techniques, and we may be unabl a e to anticipate attempted security incidents, identify them before our information is exploited, or react in a timely manner. We may be unabl a e to detect vulnerabi a lities in our information technology systems and software because such threats and techniques change frequently, are ofte f n sophisticated in nature, and may not be detected until afte f r a security incident has occurred. Further, we may experience delays in developing and deploying remedial measures designed to address any such identifie f d vulnerabi a lities. We may expend significant resources or modify our business activities (including our clinical trial activities) to try r to protect against security incidents. Certain data privacy and security obligations may require us to implement and maintain specific security measures, industry- r standard or reasonabl a e security measures to protect our information technology systems and sensitive information. Additionally, applicable data protection requirements, including, without limitation, laws, regulations, guidance as well as our internal and external policies and our contractua t l obligations, may require us to notify f relevant stakeholders of security incident, including affe f cted individuals, partners, collaborators, regulators, law enforcement agencies, and others. Such disclosures are costly, and the disclosure or the failure to comply with such requirements could lead to litigation or other liabi a lity, fines, harm to our reputation, significant costs, or other materially adverse effe f cts. Any limitations or exclusions of liabi a lity in our contracts may not be enforceable or adequate or protect us from liabi a lity or damages. Our insurance coverage may not be adequate for cybersecurity liabilities, may not continue to be availabl a e to us on economically reasonabl a e terms, or at all, and insurers could deny coverage as to any future claim. The successful f assertion of one or more large claims against us that exceed availabl a e insurance coverage, or the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductible or co-insurance requirements, could adversely affe f ct our reputation, business, financial condition and results of operations. Busine i ss disr i uptions couldl seriouslyl harm our future revenue and fina i ncial conditio d n and increase our costst and expe x nses. Our operations, and those of our CROs, CMOs, suppl u iers, and other contractors and consultants, could be subj u ect to earthquakes, power shortages, telecommunications failures, water shortages, floods, hurricanes, typhoons, fires, extreme weather conditions, medical epidemics and other natural or man-made disasters or business interrupt u ions, for which we are partly uninsured. In addition, we rely on our third-party research institution collabor a ators for conducting research and development of our product candidates, and they may be affe f cted by government shutdowns or withdrawn funding. The occurrence of any of these business disrupt r ions could seriously harm our operations and financial condition and increase our costs and expenses. For example, in connection to health epidemics, the various quarantines, shelter-in-place and similar government orders, or the perception that such orders, shutdowns or other restrictions on the conduct of business operations could occur, related to infectious diseases, could adversely affe f ct our business, financial condition or results of operations by limiting our ability to manufac f ture product, forcing temporary r closure of facilities that we rely upon or increasing the costs associated with obtaining clinical suppl u ies of our product candidates. The extent to which health epidemics could impact our results will depend on future developments, which are highly uncertain and cannot be accurately predicted, including the severity and the actions to contain or treat such outbr t eaks, epidemics, or pandemics, among others. Our operations are located at facilities in Palo Alto, Califor f nia and Switzerland. Damage or extended periods of interrupt u ion to our corporate, development or research facilities due to fire, natural disaster, power loss, communications failure, unauthorized entry r or other events could cause us to cease or delay development of some or all of our product candidates. Although we maintain property damage and business interrupt u ion insurance coverage on these facilities, our insurance might not cover all losses under such circumstances and our business may be seriously harmed by such delays and interrupt u ion. We implemented a new enterprise resource planning, or ERP, system as well as other systems as part of our on-going technology and process improvements. Our ERP system is critical to our ability to accurately maintain books and records and prepare our financial statements. If we encounter unfor f eseen problems with our ERP system or other systems and infrastructur t e, our business, operations, and financial results could be adversely affe f cted. Our busine i ss is subject to economic,c polit l ic t al,l regu e latory and othe t r risk i s k associated t with i internatio t nal operations. Our business is subj u ect to risks associated with conducting business internationally. Some of our suppl u iers and collabor a ative relationships are located outside the United States. Accordingly, our future results could be harmed by a variety of factors, including: • economic weakness, including inflation or political instability in particular non-U.S. economies and markets; • differing and changing regulatory r requirements, pricing and reimbursement regimes in non-U.S. countries;

Kodiak: 2023 Annual Report - Page 69 Kodiak: 2023 Annual Report Page 68 Page 70