57 Certain of the previously identified or similar threats have in the past and may in the future cause a security incident or other interruption that could result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, access to our sensitive information, or interruptions or stoppages in our business operations (including our clinical trials). For example, we have been the target of unsuccessful phishing attempts in the past, and expect such attempts will continue in the future. Although to our knowledge, we have not experienced a material system failure or security incident to date, if such an event were to occur, it could result in a material disruption of our development programs and our business operations, whether due to a loss of trade secrets or other proprietary information or other similar disruptions. For example, the loss of clinical trial data from completed, on-going or future clinical trials could result in delays in our regulatory approval efforts and significantly increase our costs to recover or reproduce the data. Likewise, we rely on third parties for many aspects of our business, including research and development activities and manufacturing of our product candidates, and similar events relating to their computer systems could also have a material adverse effect on our business. Additionally, applicable data protection requirements may require us, or we may voluntarily choose, to notify relevant stakeholders of security incidents, including affected individuals, partners, collaborators, regulators, law enforcement agencies, and others, or to take other actions, such as providing credit monitoring and identity theft protection services. Such disclosures and related actions can be costly, and the disclosure or the failure to comply with such applicable requirements could lead to litigation or other liability, fines, harm to our reputation, significant costs, or other materially adverse effects. Some of our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations or exclusions of liability in our contracts may not be enforceable or adequate or protect us from liability or damages. Our insurance coverage may not be adequate for cybersecurity liabilities, may not continue to be available to us on economically reasonable terms, or at all, and insurers could deny coverage as to any future claim. The successful assertion of one or more large claims against us that exceed available insurance coverage, or the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductible or co-insurance requirements, could materially and adversely affect our reputation, business, financial condition and results of operations. Business disruptions could seriously harm our future revenue and financial condition and increase our costs and expenses. Our operations, and those of our third party vendors, suppliers, and other contractors and consultants, could be subject to earthquakes, power shortages, telecommunications failures, water shortages, floods, hurricanes, typhoons, fires, extreme weather conditions, medical epidemics and other natural or man-made disasters or business interruptions, for which we are partly uninsured. In addition, we rely on our third-party research institution collaborators for conducting research and development of our product candidates, and they may be affected by government shutdowns or withdrawn funding. The occurrence of any of these business disruptions could seriously harm our operations and financial condition and increase our costs and expenses. For example, in connection to health epidemics, the various quarantines, shelter-in-place and similar government orders, or the perception that such orders, shutdowns or other restrictions on the conduct of business operations could occur, related to infectious diseases, could adversely affect our business, financial condition or results of operations by limiting our ability to manufacture product, forcing temporary closure of facilities that we rely upon or increasing the costs associated with obtaining clinical supplies of our product candidates. The extent to which health epidemics could impact our results will depend on future developments, which are highly uncertain and cannot be accurately predicted, including the severity and the actions to contain or treat such outbreaks, epidemics, or pandemics, among others. Our operations are located at facilities in Palo Alto, California and Switzerland. Damage or extended periods of interruption to our corporate, development or research facilities due to fire, natural disaster, power loss, communications failure, unauthorized entry or other events could cause us to cease or delay development of some or all of our product candidates. Although we maintain property damage and business interruption insurance coverage on these facilities, our insurance might not cover all losses under such circumstances and our business may be seriously harmed by such delays and interruption. We implemented a new enterprise resource planning, or ERP, system as well as other systems as part of our on-going technology and process improvements. Our ERP system is critical to our ability to accurately maintain books and records and prepare our financial statements. If we encounter unforeseen problems with our ERP system or other systems and infrastructure, our business, operations, and financial results could be adversely affected. Our business is subject to economic, political, regulatory and other risks associated with international operations. Our business is subject to risks associated with conducting business internationally. Some of our suppliers and collaborative relationships are located outside the United States. Accordingly, our future results could be harmed by a variety of factors, including: • economic weakness, including inflation or political instability in particular non-U.S. economies and markets;
Kodiak Sciences 2024 Annual Report Page 68 Page 70