1.6.1.7
Risks related to competing product candidates
The Company's competitors also develop new product candidates in the therapeutic areas targeted by the Com-
pany. These competitive product candidates may have a better effectiveness, tolerability or side effect profile and
might also be preferred by the Competent Authorities in the approval process. As a result, the Company's product
candidates may not be approved for the market or may not be sustainably established in the market once approved,
if ever. Please see for further elaboration on risks relating to regulatory approval processes —1.6.1.2 Risks related to
the regulatory environment—Regulatory approval processes above. In addition, the Company may fail to agree on
licensing partnerships for the licensing of its product candidates or the potential cooperation or licensing partner
may fail to further develop, file for market approval or market its relevant product candidate. Consequently, the
Company may not be able to receive revenues or potential milestone payments or licenses fees or revenue participa-
tion out of licensing agreements with pharmaceutical or biotechnical companies in the future which could have ma-
terial adverse effects on its business, prospects, financial condition and results of operations.
1.6.1.8
Risks related to information technology and cyber-attacks
The Company, collaborators or other contractors and consultants, depend on information technology ("IT")
systems, and any failure of these systems could harm the Company’s business. Basically, like all other computer
systems, the Company systems and those of current and any future collaborators, vendors, and other contractors or
consultants are vulnerable to damage from computer viruses, natural disasters, terrorism, war, cybersecurity threats,
unauthorized access and telecommunication and electrical failures. If any such material system failure, accident or
security breach were to occur and cause interruptions in our operations, it could result in a material disruption of our
development programs and our business operations, whether due to a loss of our trade secrets or other proprietary
information or other similar disruptions. IT systems are additionally vulnerable to security breaches from inadvert-
ent or intentional actions by the Company's employees, third-party vendors, contractors, consultants, business part-
ners, and/or other third parties, or from cyber-attacks by malicious third parties (including the deployment of harm-
ful malware, ransomware, denial-of-service attacks, social engineering, and other means to affect service reliability
and threaten the confidentiality, integrity, and availability of information). This risk extends to the third-party ven-
dors and subcontractors the Company uses to manage this sensitive data. The Company has systems and procedures
in place to minimize the likelihood of security breaches but cannot guarantee that third parties will not be able to
gain unauthorized access to or otherwise breach our systems in the future. Any such unauthorized access or breach
could adversely affect the business, results of operations and financial condition.
The Company manages and maintains its applications and data utilizing on-site systems in combination with
cloud computing services to process, transmit and store electronic information in connection with its business activi-
ties. The backup plans include a dedicated secured area in a geo-redundant and managed data center, which is an
essential component of the disaster recovery strategy. The Company utilizes external security and infrastructure ven-
dors to manage its IT systems and data center services according to contracts for the operational support of current
operations, as well as disaster recovery and business continuity plans.
Cyber threats are persistent and constantly evolving. Such threats have increased in frequency, scope, and po-
tential impact in recent years, which increases the difficulty of detecting and successfully defending against them.
The techniques used by cyber criminals change frequently, may not be recognized until launched, and can originate
from a wide variety of sources, including outside groups such as external service providers, organized crime affili-
ates, terrorist organizations, or hostile foreign governments or agencies.
The abovementioned threats pose a risk to the security of the Company's systems and networks, the confidenti-
ality and the availability and integrity of its data and these risks apply both to the Company, and to third parties on
whose systems the Company relies for the conduct of its business.
If the Company's IT systems or the IT systems of its third-party vendors and other contractors and consultants
become subject to disruptions or security breaches, the Company may have insufficient recourse against such third
parties and it may have to expend significant resources to mitigate the impact of such an event, and to develop and
implement protections to prevent future events of this nature from occurring.
Any cyber-attack or destruction or loss of data could have a material adverse effect on the Company's business,
financial condition, results of operations, and prospects. For example, the loss of clinical trial data from one or more
ongoing, completed, or future clinical trials could result in delays in our regulatory efforts and significantly increase
our costs to recover or reproduce the data. Because we are conducting clinical trials in parallel, a breach of our com-
puter systems could result in a loss of data or compromised data integrity across multiple programs and different
stages of development. While no personally identifiable information is stored and processed directly in-house,
CROs and other partner organizations are at risk of loss, which could result in civil fines and penalties, including
29