Ovid Therapeutics (OVID) Risk Analysis

We are increasingly dependent on information technology systems and infrastructure, including mobile technologies, to operate our business. In the ordinary course of our business, we receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit and share (collectively, process) large amounts of sensitive data, and, as a result, we and the third parties with whom we work face a variety of continuously evolving threats that have caused and could cause future security incidents. Cyberattacks, malicious internet-based activity, online and offline fraud, and other similar activities are increasing in their frequency, levels of persistence, sophistication and intensity, and are also being conducted by sophisticated and organized groups and individuals with a wide range of motives (including, but not limited to, industrial espionage) and expertise, including organized criminal groups, "hacktivists," nation states and others. Such attacks could include the deployment of harmful malware (including as a result of advanced persistent threat intrusions), ransomware attacks, denial-of-service attacks, credential stuffing and/or harvesting, social engineering (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss of sensitive data or other information technology assets, adware, attacks enhanced or facilitated by AI, telecommunications failures, earthquakes, fires, floods and other means to affect service reliability and threaten the confidentiality, integrity and availability of our information systems and sensitive data. In particular, severe ransomware attacks are becoming increasingly prevalent and can lead to significant interruptions in our operations, ability to provide our products or services, loss of sensitive data and income, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. In addition, many of those third parties in turn subcontract or outsource some of their responsibilities to other third parties. While all information technology operations are inherently vulnerable to inadvertent or intentional security breaches, incidents, attacks and exposures, the accessibility and distributed nature of our information technology systems, and the sensitive data stored on those systems, make such systems vulnerable to unintentional or malicious, internal and external attacks on our technology environment. We have also outsourced elements of our operations (including elements of our information technology infrastructure) to third parties, and as a result, certain third parties with whom we work have access to our computer networks and/or our sensitive data. In addition, many of those third parties in turn subcontract or outsource some of their responsibilities to other third parties. Our ability to monitor the third parties' information security practices is limited, and these third parties may not have adequate information security measures in place. When the third parties with whom we work experience a security incident or other interruption, which has occurred in the past, we could experience adverse consequences. For example, in the third quarter of 2024, we were notified of a business email compromise impacting a development collaborator, which resulted in our payment being misdirected to a fraudulent account. The funds were fully recovered in January 2025. In the absence of recovery of funds or other remuneration, we may be entitled to damages if our third-party service providers fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award. In addition, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties' infrastructure in our supply chain or our third-party partners' supply chains have not been compromised. Increasing geopolitical tensions and wars are likely to increase the frequency of cybersecurity attacks. In addition, hybrid work has increased risks to our information technology systems and data as our employees utilize network connections, computer and devices outside our premises or network, including working at home, while in transit and in public locations. Additionally, future or past business transactions (such as acquisitions or integrations) could expose us to additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities' systems and technologies. Furthermore, we may discover security issues that were not identified during due diligence of such acquired or integrated entities, and it may be difficult to integrate companies into our information technology environment and security program. We take steps designed to detect, mitigate, and remediate vulnerabilities in our information systems (such as our hardware and/or software, including that of third parties upon which we rely); however, we may not detect and remediate all such vulnerabilities on a timely basis. Further, we may and have experienced delays in deploying remedial measures and patches designed to address identified vulnerabilities. For example, we have had situations in which a vulnerability has been identified, but the remediating patch download and installation was delayed due to the user being offline or the computer not being rebooted in a timely manner to finalize the installation. Non-remediated vulnerabilities could be exploited and result in a security incident. Significant disruptions of our, our third-party vendors' and/or business partners' information technology systems or other similar data security incidents could adversely affect our business operations and/or result in the loss, misappropriation, and/or unauthorized access, use or disclosure of, or the prevention of access to, sensitive data, which could result in financial, legal, regulatory, business and reputational harm to us. In addition, information technology system disruptions, whether from attacks on our technology environment or from computer viruses, natural disasters, terrorism, war and telecommunication and electrical failures, could result in a material disruption of our development programs and our business operations. For example, the loss of clinical trial data from completed or future clinical trials could result in delays in our regulatory approval efforts and significantly increase our costs to recover or reproduce the data. It may be difficult and/or costly to detect, investigate, mitigate, contain and remediate a security incident. Our efforts to do so may not be successful. Actions taken by us or the third parties with whom we work to detect, investigate, mitigate, contain and remediate a security incident could result in outages, data losses and disruptions of our business. For example, we utilize a phishing reporting feature that allows our IT function to analyze and assess whether suspicious emails are phishing attempts. This system is reliant on AI and employee awareness and diligence, both of which may be exploited or not always successful. Actions taken by us or the third parties with whom we work to detect, investigate, mitigate, contain and remediate a security incident could result in outages, data losses, and disruptions of our business. Threat actors may also gain access to other networks and systems after a compromise of our networks and systems. For example, threat actors may use an initial compromise of one part of our environment to gain access to other parts of our environment, or leverage a compromise of our networks or systems to gain access to the networks or systems of third parties with whom we work, such as through phishing or supply chain attacks. We have in the past and will in the future expend significant resources or modify our business activities to try to protect against current and constantly evolving security incidents. Additionally, certain data privacy and security obligations will require us to implement and maintain specific security measures or industry-standard or reasonable security measures to protect our information technology systems and sensitive data. Applicable data privacy and security obligations may require us to notify relevant stakeholders, including affected individuals, customers, regulators, and investors, of security incidents. Such disclosures are costly, and the disclosure or the failure to comply with such requirements could lead to adverse consequences. If we (or a third party with whom we work) experience a security incident or are perceived to have experienced a security incident, including but not limited to a security incident involving personal information regarding our patients or employees, we may experience adverse consequences, such as disruptions to our business, harm to our reputation, government enforcement actions (for example, investigations, fines, penalties, audits, and inspections), additional reporting requirements, and/or oversight, or we may otherwise be subject to liability under laws, regulations and contractual obligations, including those that protect the privacy and security of personal information. This could result in increased costs to us, and result in significant legal and financial exposure and/or reputational harm. In addition, any failure or perceived failure by us or our vendors or business partners to comply with our privacy, confidentiality or data security-related legal or other obligations to third parties, or any further security incidents or other inappropriate access events that result in the unauthorized access, release or transfer of sensitive data, may result in governmental investigations, enforcement actions, regulatory fines, litigation, or public statements against us by advocacy groups or others, and could cause third parties, including clinical sites, regulators or current and potential partners, to lose trust in us or we could be subject to claims by third parties that we have breached our privacy- or confidentiality-related obligations, which could materially and adversely affect our business and prospects. Moreover, data security incidents and other inappropriate access can be difficult to detect, and any delay in identifying them may lead to increased harm of the type described above. While we have implemented security measures intended to protect our information technology systems and infrastructure, there can be no assurance that such measures will be effective. Our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages, or claims related to our data privacy and security obligations. While we are seeking cybersecurity insurance coverage to cover certain aspects of the cyber risks described above, there is no guarantee that we will obtain cybersecurity insurance coverage sufficient to cover the risks described here. Furthermore, any losses suffered by the company may not be adequately covered by insurance or other contractual rights available to us. The successful assertion of one or more large claims against us that exceed or are not covered by our insurance coverage or changes in our insurance policies, including premium increases or the imposition of large deductible or co-insurance requirements, could make us unable to acquire such insurance and may have an adverse effect on our business, financial condition, and results of operations. In addition to experiencing a security incident, third parties may gather, collect or infer sensitive information about us from public sources, data brokers or other means that reveal competitively sensitive details about our organization and could be used to undermine our competitive advantage or market position. Additionally, sensitive company information could be leaked, disclosed or revealed as a result of or in connection with our employees', personnel's, or vendors' use of generative AI technologies.