ANAPTYSBIO, INC 10-K

Item 1B. Unresolved Staff Comments None. Item 1C. Cybers ecurity We recognize the critical importance of maintaining the trust and confidence of all of our stakeholders. Our business depends on the efficient and uninterrupted operation of our information technology systems and those of our third party CROs, CMOs, or other vendors, contractors or consultants. Risk Management and Strategy The Company’s cybersecurity program is focused on the following key areas : Governance: The Board of Directors’ oversight of cybersecurity risk management is supported by the Audit Committee of the Board of Directors (the “Audit Committee”), which regularly interacts with our Head of IT and our executive management team. Collaborative Approach: We have implemented a cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. Incident Response and Recovery Planning: We have established and maintain incident response and recovery plans to address our response to a cybersecurity incident. We use a manage, detection, and response (MDR) partner to provide threat detection and response capabilities. We also utilize security consultants including a vCISO to assess and continuously improve our cybersecurity program. Third Party Risk Management: We strive to proactively manage third party risks to minimize any adverse effects on our business that may arise due to a cybersecurity incident affecting third party systems and vendors. Although we rely on third party vendors to manage and maintain their own cybersecurity defense programs, we continue to improve on our vendor risk management program to assess our exposure to these external cybersecurity risks, including the use of external security rating services and by evaluating vendor responses to our cybersecurity questionnaire. Education and Awareness: We provide mandatory training and resources for personnel regarding cybersecurity threats as a means to equip our employees with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices. We engage in the periodic assessment and testing of our cybersecurity program. These efforts include a wide range of activities, including audits, assessments, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. These activities may be performed by external cybersecurity and application security professionals. 58 Governance The Board of Directors, in coordination with the Audit Committee, oversees our risk management process. The Board of Directors and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On a quarterly basis, the Audit Committee discuss our approach to cybersecurity risk management with the Head of IT. Our Head of IT , in coordination with our executive management team, works collaboratively across the company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. Through ongoing communications with our entire employee base and appropriate third-party contractors, the Head of IT and the executive management team monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Audit Committee when appropriate. Our Head of IT has over 20 years of IT experience in the pharmaceutical industry and oversees the cybersecurity program at AnaptysBio. He has experience developing and leading cybersecurity programs for pharmaceutical companies, including experience in evaluating and implementing tools and technologies that enable defense and response capabilities and developing critical cybersecurity procedures and training and awareness programs. Although we are subject to ongoing and evolving cybersecurity threats, we are not aware of any material cybersecurity threats, that have materially affected or are reasonably likely to affect us, including our business strategy, results of operations or financial condition. For more information on our cybersecurity risks , see Item 1A “Risk Factors.” Item 2. Prope rties Our principal executive office is located at 10770 Wateridge Circle in San Diego, California, and consists of approximately 45,000 square feet of leased office and laboratory space under a lease for a term of 124 months, beginning on April 5, 2021. The terms of the Lease Agreement provide us with an option to extend the term of the lease for an additional five years, as well as a one-time option to terminate the lease after seven years with the payment of a termination fee. We use these facilities for our administrative, research and development and other activities. Item 3. Legal P roceedings On November 20, 2025, we filed a Verified Complaint in Delaware Chancery Court, requesting a court declaration that TESARO, Inc. (“Tesaro”) has materially breached the parties’ Collaboration and Exclusive License Agreement (“Collaboration Agreement”) and that GSK, Tesaro’s corporate parent, has tortiously interfered with the Collaboration Agreement. We have requested that the court declare that we are entitled to all rights and remedies under the Collaboration Agreement. While we had approached Tesaro to engage in good faith discussions to potentially resolve these claims, on November 20, 2025, Tesaro, without notice, initiated a lawsuit against us. Tesaro’s complaint includes a request for a declaration that it has not breached the Collaboration Agreement and for an injunction prohibiting AnaptysBio from terminating the Collaboration Agreement. Tesaro also alleges that AnaptysBio has materially breached the agreement, entitling Tesaro to exercise certain rights and remedies under the agreement. Tesaro’s claim for breach is predicated on an allegation that AnaptysBio improperly alleged that Tesaro had breached the Collaboration Agreement, which allegedly caused an anticipatory breach of contract. Through that claim, we believe that Tesaro seeks to improperly punish us for and restrain us from exercising our legal rights under the Collaboration Agreement in violation of Delaware’s anti-SLAPP statute. We believe that Tesaro’s claims are entirely without merit and have moved to dismiss the anticipatory breach claim. Item 4. Mine S afety Disclosures Not applicable. 59 PART II