What changed in this filing

/stocks — the workspaceLOADING

Item 1B. Unresolved Staff Comments

2025-03-24 compared with 2024-04-01 · 49 added, 49 removed, 30 unchanged (77% of the section changed)

18 unchanged sentences

based on recognized frameworks established by the National Institute of Standards and Technology.

The Company has established controls and procedures, including an Incident

Response Plan, that provide for the identification, analysis, notification, escalation, communication, and remediation of data security

incidents at appropriate levels so that so that decisions regarding the public disclosure and reporting of such incidents can be made

by management in a timely manner.

In particular, the Company’s Incident Response Plan (i) is designed to identify and detect information

security threats through various mechanisms, such as through security controls and third-party disclosures, and (ii) sets forth a process

to (a) analyze any such threats detected within the Company’s IT environment or within a third-party’s IT environment, (b)

contain cybersecurity threats under various circumstances, and (c) better ensure the Company can recover from cybersecurity incidents

to a normal state of business operations.

The Company has established and maintains other incident response and recovery plans that

address the Company’s response to a cybersecurity incident.

The Company has established controls

and procedures, including an Incident Response Plan, that provide for the identification, analysis, notification, escalation, communication,

and remediation of data security incidents at appropriate levels so that so that decisions regarding the public disclosure and reporting

of such incidents can be made by management in a timely manner.

In particular, the Company’s Incident Response Plan (i) is designed

to identify and detect information security threats through various mechanisms, such as through security controls and third-party disclosures,

and (ii) sets forth a process to (a) analyze any such threats detected within the Company’s IT environment or within a third-party’s

IT environment, (b) contain cybersecurity threats under various circumstances, and (c) better ensure the Company can recover from cybersecurity

incidents to a normal state of business operations.

The Company has established and maintains other incident response and recovery plans

that address the Company’s response to a cybersecurity incident.

part of its cybersecurity program, the Company deploys measures to deter, prevent, detect, respond to and mitigate cybersecurity threats,

1 unchanged sentence

and physical security measures.

The Company periodically assesses and tests the Company’s policies, standards,

processes, and practices that are designed to address cybersecurity threats and incidents, including by assessing current threat intelligence,

conducting tabletop exercises, and vulnerability and security testing,.

The Company has a process to report material

results of such testing and assessments to the board, and periodically adjusts the Company’s cybersecurity program

based on these exercises.

The Company engages third parties to conduct part of such testing The Company identifies and oversees cybersecurity risks presented by third parties and their systems from a risk-based

perspective The Company also conducts cybersecurity

training for employees (including mandatory training programs for system users).

The Company periodically assesses and tests the Company’s policies, standards, processes, and practices

that are designed to address cybersecurity (including artificial intelligence-related) threats and incidents, including by assessing

current threat intelligence, and conducting tabletop exercises and vulnerability and security testing.

The Company has a process to report

material results of such testing and assessments to the board, and periodically adjusts the Company’s cybersecurity program based

on these exercises.

The Company engages third parties to conduct part of such testing, including hiring consultants and third parties

to conduct our threat assessments and supplement the monitoring of such threats by utilizing online data tools .

The Company identifies

and oversees cybersecurity risks presented by third parties and their systems from a risk-based perspective .

The Company also conducts

cybersecurity training for employees (including mandatory training programs for system users).

of the Company’s IT systems operate with a hosted architecture or by third-party service providers, and if these third-party IT

2 unchanged sentences

vendor management process is an important part of our risk mitigation strategy.

In particular, we obtain reports from our vendors handling sensitive data as to their efficacy and efficiency in managing cybersecurity

issues and follow-up with them on any potential or actual issues.

Notwithstanding, if there is a catastrophic event, such as an adverse weather condition, natural disaster, terrorist attack, security

breach, or other extraordinary event, the Company, and our service providers, may be unable to provide our products or services for the

duration of the event and/or a time thereafter.

In particular, we obtain reports from our vendors handling

sensitive data as to their efficacy and efficiency in managing cybersecurity issues and follow-up with them on any potential or actual

Notwithstanding, if there is a catastrophic event, such as an adverse weather condition, natural disaster, terrorist attack,

security breach, or other extraordinary event, the Company, and our service providers, may be unable to provide our products or services

for the duration of the event and/or a time thereafter.

the pervasive and increasing threat from cyberattacks, the board and the audit committee, with input from management, assess the Company’s

2 unchanged sentences

with management regarding ongoing cybersecurity initiatives, and requests management to report to the audit committee or the full board

regularly on their assessment of the Company’s cybersecurity program and risks.

Both the audit committee and the full board will

receive regular reports from its senior management on cybersecurity risks, timely reports regarding any cybersecurity incident that meets

established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.

Our board has risk

management experience.

We hire consultant and third parties to conduct our threat assessments and supplement the monitoring of such threats

by utilizing online data tools.

addition, the Company’s information security and/cybersecurity program is managed by our Chief Technology Officer

(“CTO”) a, whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards,

architecture, and processes.

The CTO provides periodic reports to our audit committee as well as our Co-Chief Executive Officers and

Chief Financial Officer and other members of our senior management as appropriate.

We have also established cross-functional teams

to collaborate and communicate on cybersecurity-related issues.

The reports to management include updates on the Company’s

cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information

security program, and the emerging threat landscape.

Eliran Ben-Zikri served in the one of the most elite computer units of the Israeli Defense Force and has

over 10 years of experience in the cloud technology, previously holding senior positions in leading Israeli technology companies, including

eToro and SimilarWeb.

of the date of this report, the Company is not aware of risks from cybersecurity threats that have materially

affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or

financial condition.

regularly on their assessment of the Company’s cybersecurity program and risks, including artificial intelligence.

Both the audit

committee and the full board receive regular reports from senior management on cybersecurity risks and timely reports regarding any cybersecurity

incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.

Our board has risk management experience.

addition, the Company’s information security and/cybersecurity program is managed by our Chief Technology Officer (“CTO”),

whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes.

provides periodic reports to our audit committee as well as our Co-Chief Executive Officers and Chief Financial Officer and other members

of our senior management as appropriate.

We have also established cross-functional teams to collaborate and communicate on cybersecurity-related

The reports to management include updates on the Company’s cyber risks and threats, the status of projects to strengthen

our information security systems, assessments of the information security program, and the emerging threat landscape.

Ben-Zikri served in the one of the most elite computer units of the Israeli Defense Force and has over 10 years of experience in the

cloud technology, previously holding senior positions in leading Israeli technology companies, including eToro and SimilarWeb .

of the date of this report, the Company has no t identified any cybersecurity threats or incidents that have materially affected or are

reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.

there can be no assurance that the Company, or its third-party business partners or service providers, will not experience a cybersecurity

threat or incident in the future that could materially adversely affect the Company, including its business strategy, results of operations,

or financial condition.

For further discussion of the risks related to cybersecurity, see the risk factors discussed under Item 1A.

Factors” in this report.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1B. Unresolved Staff Comments