4 unchanged sentences
We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our clinical trials and products (Information Systems and Data).
−Removed: Our information security function, our Chief Information Officer (CIO), and our Chief Compliance Officer (CCO) help identify, assess and manage the Company’s cybersecurity threats and risks.
−Removed: This group works to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company’s risk profile using various methods in certain contexts, including, for example, manual tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threat actors, conducting scans of certain environments, evaluating certain threats reported to us, conducting threat and vulnerability assessments, using external intelligence feeds, and using third parties to conduct tabletop incident response exercises and other tests.
+Added: Our information security function, led by our Chief Information and Data Officer (CIDO), with our legal and compliance teams, help identify, assess and manage the Company’s cybersecurity threats and risks.
+Added: This group works to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company’s risk profile using various methods in certain contexts, including, for example, manual tools, automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threat actors, conducting scans of certain environments, evaluating our industry’s risk profile, evaluating certain threats reported to us, coordinating with law enforcement concerning threats, internal and/or external audits, conducting threat and vulnerability assessments, using external intelligence feeds, using third parties to conduct tabletop incident response exercises and other tests, and participating in the Health Information Sharing and Analytics Center (H-ISAC).
Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example:
−Removed: incident detection and response policies, disaster recovery/business continuity policies, a vulnerability management policy, a vendor risk management program, risk assessments, encryption of certain data, network security controls and data segmentation for certain systems, access controls, physical security, asset management and tracking, systems monitoring, employee training, penetration testing, cybersecurity insurance, and dedicated cybersecurity staff.
+Added: incident detection and response policies, disaster recovery/business
+Added: continuity policies, a vulnerability management policy, artificial intelligence policy, digital policy, a vendor risk management program, risk assessments, implementation of security standards/certifications, encryption of certain data, network security controls and data segregation for certain systems, access controls, physical security, asset management, tracking, and disposal, systems monitoring, employee training, penetration testing, cybersecurity insurance, and dedicated cybersecurity staff.
Our assessment and management of material risks from cybersecurity threats are integrated into the Company’s overall risk management processes.
5 unchanged sentences
We have vendor management processes designed to help manage cybersecurity risks associated with our use of certain of these providers.
−Removed: For certain vendors, these processes include vendor risk assessments, security questionnaires, review of vendors’ written security program, and imposition of contractual obligations related to information security on certain vendors.
+Added: For certain vendors, these processes include vendor risk assessments, security questionnaires, review of vendors’ written security program, vulnerability scans related to the vendor, security assessment calls with the vendor’s security personnel, and imposition of contractual obligations on certain vendors.
For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1.
11 unchanged sentences
The audit committee of the board of directors is responsible for overseeing the Company’s cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.
−Removed: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Director of Information Security , who has managed the Security Operations Center for a Fortune 500 company, and led cybersecurity efforts as the Director of IT at another organization.
−Removed: T he Director of Information Security, along with management, including the CIO and CCO, is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company’s overall risk management strategy, and communicating key priorities to relevant personnel.
+Added: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our CIDO, who joined the Company in August 2025, and Senior Director of Information Security , who has led cybersecurity functions at the Company for over a decade, managed the Security Operations Center for a Fortune 500 company, and led cybersecurity efforts as the Director of IT at another organization.
+Added: T he CIDO, along with management, is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company’s overall risk management strategy, and communicating key priorities to relevant personnel.
Management is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.
−Removed: Our incident response policy is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our CIO, Senior Vice President of Finance, CCO, Senior Vice President of People and Performance, and Director of Information Security.
+Added: Our incident response policy is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our CIDO, Chief Legal Officer, Senior Vice President of Finance, Chief Compliance Officer, Senior Vice President of People and Performance, and Senior Director of Information Security.
This team works with the Company’s incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified.
1 unchanged sentence
The audit committee receives periodic reports from senior management concerning the Company’s significant cybersecurity threats and risks and the processes the Company has implemented to address them.
−Removed: As of December 31, 2024, our primary facility consists of approximately 67,000 square feet of office space in San Diego, California.
−Removed: We also lease a facility in Princeton, New Jersey that covers approximately 25,000 square feet of office space, which is leased through January 2026.
+Added: As of December 31, 2025, our primary facility consists of approximately 67,000 square feet of office space in San Diego, California, pursuant to a lease that expires in May 2031.
+Added: We also lease a facility in Princeton, New Jersey that covers approximately 25,000 square feet of office space, which is leased on a month-to-month basis after it expired in January 2026.
+Added: In addition, we lease a new facility in Princeton, New Jersey that covers approximately 53,000 square feet of office space, which is expected to commence in the second quarter of 2026.
We believe that our existing facilities are adequate to meet our current needs, and that suitable additional alternative spaces will be available in the future on commercially reasonable terms.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.