51 To induce valuable employees to remain at our company, in addition to salary and cash incentives, we have provided restricted stock and stock option grants, including early exercise stock options exercisable for restricted stock that vest over time. The value to employees of these equity grants that vest over time may be significantly affected by movements in our stock price that are beyond our control and may at any time be insufficient to counteract more lucrative offers from other companies. Although we have employment agreements with our key employees, these employment agreements provide for at- will employment, which means that any of our employees could leave our employment at any time, with or without notice. We do not maintain “key man” insurance policies on the lives of all of these individuals or the lives of any of our other employees. If we are unable to attract, incentivize and retain quality personnel on acceptable terms, or at all, it may cause our business and operating results to suffer. We will need to grow the size and capabilities of our organization, and we may experience difficulties in managing this growth. As of December 31, 2025, we had 124 employees. As our development plans and strategies develop, and as we continue operating as a public company, we must add a significant number of additional managerial, operational, financial and other personnel. Future growth will impose significant added responsibilities on members of management, including: • identifying, recruiting, integrating, retaining and motivating additional employees; • managing our internal development efforts effectively, including the clinical and FDA review process for our current and future product candidates, while complying with our contractual obligations to contractors and other third parties; • expanding our operational, financial and management controls, reporting systems and procedures; and • managing increasing operational and managerial complexity. Our future financial performance and our ability to continue to develop and, if approved, commercialize our product candidates will depend, in part, on our ability to effectively manage any future growth. Our management may also have to divert a disproportionate amount of its attention away from day-to-day activities in order to manage these growth activities. We currently rely, and for the foreseeable future will continue to rely, in substantial part on certain independent organizations, advisors and consultants to provide certain services. There can be no assurance that the services of these independent organizations, advisors and consultants will continue to be available to us on a timely basis when needed, or that we can find qualified replacements. In addition, if we are unable to effectively manage our outsourced activities or if the quality or accuracy of the services provided by consultants is compromised for any reason, our clinical trials may be extended, delayed, or terminated, and we may not be able to obtain regulatory approval of our product candidates or otherwise advance our business. There can be no assurance that we will be able to manage our existing consultants or find other competent outside contractors and consultants on economically reasonable terms, if at all. If we are not able to effectively expand our organization by hiring new employees and expanding our groups of consultants and contractors, we may not be able to successfully implement the tasks necessary to further develop our product candidates and, accordingly, may not achieve our research, development, and commercialization goals. If our information technology systems, or those of third parties with whom we work, or our data, were compromised, we could experience adverse consequences resulting from such compromise, including regulatory investigations or actions, significant fines or other liability, interruptions of our development programs, harm to our reputation, and other adverse consequences. Cyberattacks, malicious internet-based activity, online and offline fraud, and other similar activities threaten the confidentiality, integrity, and availability of our sensitive information and information technology systems, and those of our research collaborators, contractors, consultants, and other third parties with whom we work. Such threats are prevalent and continue to rise, are increasingly difficult to detect, and come from a variety of sources, including traditional computer “hackers,” threat actors, “hacktivists,” organized criminal threat actors, personnel (such as through theft or misuse), sophisticated nation-states, and nation-state-supported actors. Some actors now engage and are expected to continue to engage in cyber-attacks, including without limitation nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities. During times of war and other major conflicts, we and the third parties with whom we work are vulnerable to a heightened risk of attacks, including retaliatory cyber-attacks that could materially disrupt our systems and operations and supply chain. We and the third parties with whom we work are subject to a variety of evolving threats, including but not limited to social-engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks (such as credential stuffing), personnel misconduct or error, ransomware attacks, supply-