52 chain attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other information technology assets, adware, attacks enhanced or facilitated by artificial intelligence, or AI, and other similar threats. Ransomware attacks are becoming increasingly prevalent and severe and can lead to significant interruptions in our operations, loss of data and income, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. It may be difficult and/or costly to detect, investigate, mitigate, contain, and remediate a security incident. Our efforts to do so may not be successful. Actions taken by us or the third parties with whom we work to detect, investigate, mitigate, contain, and remediate a security incident could result in outages, data losses, and disruptions of our business. Threat actors may also gain access to other networks and systems after a compromise of our networks and systems. For example, threat actors may use an initial compromise of one part of our environment to gain access to other parts of our environment, or leverage a compromise of our networks or systems to gain access to the networks or systems of third parties with whom we work, such as through phishing or supply chain attacks. Additionally, remote work increases risks to our information technology systems and data, as our personnel utilize network connections, computer and devices outside of our premises or corporate networks, including working at home, while in transit and in public locations. Future or past business transactions (such as acquisitions or integrations) could expose us to additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities’ systems and technologies. Furthermore, we may discover security issues that were not found during due diligence of such acquired or integrated entities, and it may be difficult to integrate companies into our information technology environment and security program. We rely on third parties to operate critical business systems to process sensitive information in a variety of contexts, including, without limitation, third-party providers of cloud-based infrastructure, encryption and authentication technology, employee email, and other functions. Our ability to monitor these third parties’ information security practices is limited, and these third parties may not have adequate information security measures in place. While we may be entitled to damages if the third parties with whom we work fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award. Similarly, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties’ infrastructure in our supply chain or that of the third parties with whom we work have not been compromised. Likewise, we rely on third-party research institution collaborators, other contractors and consultants for many aspects of our business, including research and development activities and manufacturing of our product candidates, and similar events relating to their information systems could also have a material adverse effect on our business. While we have implemented security measures designed to protect against security incidents, there can be no assurance these measures will be effective. We take steps designed to detect, mitigate, and remediate vulnerabilities in our information systems (such as our hardware and/or software, including that of third parties with whom we work). We have not, and may not in the future, however, detect and remediate all such vulnerabilities including on a timely basis. Further, we have in the past (and may in the future) experienced delays in developing and deploying remedial measures designed to address identified vulnerabilities. Certain of the previously identified or similar threats have in the past and may in the future cause a security incident or other interruption that has in the past and may in the future result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, access to our sensitive information or information technology systems, or those of the third parties with whom we work. For example, we have been the target of unsuccessful phishing attempts in the past, and expect such attempts will continue in the future. Although to our knowledge, we have not experienced a material system failure or security incident to date, if such an event were to occur, it could result in a material disruption of our development programs and our business operations (for example, the loss of clinical trial data from completed, on-going or future clinical trials). We expend resources and may modify our business activities (including our clinical trial activities) to try to protect against security incidents. Certain data privacy and security obligations have required us to implement and maintain specific security measures, industry-standard or reasonable security measures to protect our information technology systems and sensitive information. Additionally, applicable data protection requirements may require us, or we may voluntarily choose, to notify relevant stakeholders of security incidents, including affected individuals, partners, collaborators, regulators, law enforcement agencies, and others, or to take other actions, such as providing credit monitoring and identity theft protection services. Such disclosures and related actions can be costly, and the disclosure or the failure to comply with such applicable requirements could lead to adverse consequences. If we (or a third party with whom we work) experience a security incident or are perceived to have experienced a security incident, we may experience material adverse consequences, such as