What changed in this filing

/stocks — the workspaceLOADING

Item 1B. Unresolved Staff Comments

2025-09-17 compared with 2024-09-18 · 55 added, 51 removed, 5 unchanged (95% of the section changed)

3 unchanged sentences

We operate in the biotechnology

field, which is subject to various cybersecurity risks that could adversely affect our business.

We engage in the periodic assessment

and testing of our policies, standards, processes and practices that are designed to address cybersecurity risks.

These efforts include

a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing, and other exercises

focused on evaluating the effectiveness of our cybersecurity measures and planning.

We regularly engage third parties to perform assessments

on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information

security control environment and operating effectiveness.

The results of such assessments, audits and reviews are reported to the Audit

Committee and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided

by these assessments, audits and reviews.

Our Chief Information Officer,

or CIO, is responsible for day-to-day assessment, management of risks from cybersecurity threats our cybersecurity policies, standards,

processes and practices which are based on applicable industry standards.

In general, we seek to address cybersecurity risks through a

comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information

that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity

incidents when they occur.

While we have experienced a cybersecurity incident in the past (see

Risk Factors - “A cybersecurity incident, other technology disruptions or failure to comply with laws and regulations relating to

privacy and the protection of data relating to individuals could negatively impact our business and our reputation.”) and cybersecurity

threats in the past in the normal course of business and expect to continue to experience such threats from time to time, to date, none

have had a material adverse effect on our business, financial condition, results of operations or cash flows.

Even with the approach we

take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse

effect on us.

industry, where the protection of sensitive information and the continuity of our operations are critical.

We are subject to cybersecurity

risks which could adversely affect our business, financial condition, or results of operations.

We maintain a risk-based cybersecurity

program designed to identify, assess, and mitigate cybersecurity threats.

Our program incorporates applicable industry standards and

is managed through a cross-functional approach involving our Information Technology, legal, compliance, and other relevant teams.

is overseen by our Chief Information Officer (“CIO”), who is responsible for the day-to-day management of cybersecurity risks

and the implementation of our information security program and incident response plans.

Our risk management activities

include periodic assessments, vulnerability testing, and tabletop exercises, as well as regular engagement with third-party experts to

perform independent security assessments.

We have expanded employee training and phishing simulations, and we conduct ongoing monitoring

of access to our systems, including oversight of third-party vendors and service providers.

The results of assessments and reviews are

reported to senior management and the Audit Committee, and our policies and controls are updated as necessary.

While we have experienced

a cybersecurity incident in the past and encounter cybersecurity threats from time to time in the ordinary course of business, none to

date have had a material adverse effect on our business, financial condition, results of operations or cash flows.

Despite our proactive

measures, including expanded employee training and enhanced vendor oversight, cybersecurity threats continue to evolve, and no system

can be entirely secure.

A future cybersecurity incident could materially impact our operations, financial results, or reputation.

Risk Management and Strategy

As part of our overall risk

management, our cybersecurity program is focused on a comprehensive approach to identifying, preventing and mitigating cybersecurity threats

and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents

so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.

The Company deploys technical

safeguards that are designed to protect the Company’s information systems from cybersecurity threats, including firewalls, intrusion

prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability

assessments and cybersecurity threat intelligence.

The Company has established

and maintains comprehensive incident response and recovery plans that fully address the Company’s response to a cybersecurity incident,

and such plans are tested and evaluated on a regular basis.

The Company maintains a comprehensive,

risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, CROs, service providers

and other external users of the Company’s systems, as well as the systems of third parties that could adversely impact our business

in the event of a cybersecurity incident affecting those third-party systems.

The Audit Committee oversees

our risk management process, including the management of risks arising from cybersecurity threats.

Our CIO is tasked with reporting any

and all matters relating to cybersecurity to the Audit Committee.

The Audit Committee receives regular presentations and reports on cybersecurity

risks, which including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat

environment, technological trends and information security considerations arising with respect to our peers and third parties.

Committee receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as

well as ongoing updates regarding any such incident until it has been addressed.

As part of our overall

risk management framework, our cybersecurity program takes a comprehensive, layered approach to identifying, preventing and mitigating

cybersecurity threats and incidents.

This includes implementing controls and escalation procedures to ensure that significant incidents

are promptly communicated to management for timely decision-making regarding public disclosure and regulatory reporting.

We deploy multiple

technical safeguards designed to protect our information systems, including firewalls, intrusion prevention and detection systems, anti-malware

tools, access controls, and continuous monitoring.

These safeguards are evaluated and enhanced through regular vulnerability assessments,

penetration testing and ongoing cybersecurity threat intelligence.

We maintain formal

incident response and recovery plans that define our procedures for addressing cybersecurity incidents.

These plans are tested, updated,

and refined on a regular basis to ensure readiness.

We apply a risk-based

approach to managing cybersecurity risks posed by third parties , including vendors, contract research organizations, service providers

and other external users of the our systems.

This also includes assessing and overseeing risks related to third-party systems that, if

compromised, could negatively impact our business operations.

The Audit Committee

of our Board oversees our risk management process, including the management of risks from cybersecurity threats.

Oren Kochavi,

is an accomplished executive with 14 years of experience leading information technology, enterprise systems, information security, and

related technology functions.

Kochavi holds an MBA in Business Administration and multiple professional certifications, and is responsible

for the day-to-day administration of our cybersecurity program and reports to the Audit Committee on cybersecurity matters.

Committee receives periodic reports and presentations addressing cybersecurity risks, recent developments, evolving standards, results

of vulnerability assessments, findings from third-party and independent reviews, current threat intelligence, technological trends, and

relevant developments regarding security considerations arising with respect to our peers and third parties.

According to our procedures,

the Audit Committee is promptly informed of any cybersecurity incident that meets established reporting thresholds and receives ongoing

updates until the matter is fully resolved.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1B. Unresolved Staff Comments