EXOZYMES INC. 10-K

Item 1B. Unresolved Staff Comments We are a smaller reporting company as defined by Rule 12b-2 of the Exchange Act, and therefore we are not required to provide information under this item. Item 1C. Cybersecurity We have not had any reportable cybersecurity breaches or espionage, including what we may perceive or recognize as cybersecurity incidents, espionage or credible threats during the fiscal year ended December 31, 2025. To date, as a result, there has not been any material adverse effect on our business operations or financial condition. If there is a cybersecurity attack, espionage and/or an infiltration of our files, data, customer data and the like, there would be a material adverse effect on our business, our reputation, our operations and financial condition. For example, our reputation would be damaged in the event of cybersecurity infiltration. If there were cybersecurity infiltration, we could lose access to our data which would disrupt our operations, and we even may not be able to operate. Such a loss of access might be temporary or permanent, and it might be localized or general. The level of disruption will depend on our backup systems. Our clients’ financial and other data could be taken and used against us to damage our reputation or cause harm to our clients in different ways. In the latter instance, we may be liable for monetary damages to our clients. We may be held for cyber ransom, which would be a loss to our financial resources. Our inability to operate, payment of damages, payment of ransom, and the costs of reparation of our systems, consultants, and tangential expenses will all result in damage to our business and our financial resources. 28 We believe that we have implemented a comprehensive cybersecurity program aimed at identifying, monitoring, and mitigating cybersecurity risks to the best of our ability. Our security program encompasses information security responsibilities, incident response, and is diligently managed by our information technology consultants. Cybersecurity is integrated into our overall risk management framework, with consultation from our subject matter experts to assess and address potential cyber risks and their impacts. Management is committed to providing the Audit Committee with regular cybersecurity updates, at least annually or more often as needed, based on emerging threats or specific incidents. These updates cover risk assessments, the current threat landscape, and any recent cybersecurity incidents . The Company has retained outside consultants to assist with information technology activities and has put in place governance measures for information security with a focus on continuous improvement of its systems. This includes control requirements for change management, patching processes, the implementation of multifactor authentication, comprehensive data backup strategies, and continuous security monitoring. Additionally, management continues to enhance our security controls, with any significant issues promptly reported to the Audit Committee.