Company: ERAS
Filing Date: 2025-03-20
Form Type: 10-K
Source: 0000950170-25-042682
Chunk: 197

Company: Erasca, Inc.
Filing Date: 2025-03-20
Form: 10-K
Item: Item 1A
Chunk 197
---
 are being conducted by sophisticated and organized groups and individuals with a wide range of motives, expertise, techniques and tools – including artificial intelligence – to circumvent security controls, evade detection and remove forensic evidence. Additionally, we currently work in a hybrid working environment, which may cause increased cybersecurity risks due to our reliance on internet technology and the number of our employees (and employees of our vendors, contractors and other organizations with whom we have formed strategic relationships) who are working remotely, which may create additional opportunities for threat actors to exploit vulnerabilities. Furthermore, new techniques may not be identified until they are launched against a target, and we may be unable to anticipate these techniques or detect an incident, assess its severity or impact, react or appropriately respond in a timely manner or implement adequate preventative measures, resulting in potential data loss or other damage to our information technology systems. Given the unpredictability of the timing, nature and scope of information technology disruptions, there can be no assurance that any security procedures and controls that we or our third-party partners and service providers have implemented will be sufficient to prevent cyber-attacks from occurring. The latency of a compromise is often measured in months, but could be years, and we may not be able to detect a compromise in a timely manner. 

We and certain of our service providers and vendors are from time to time subject to cyberattacks and cybersecurity incidents. While we do not believe that we have experienced any significant system failure or other cybersecurity incident to date, if such an event were to occur and cause interruptions in our operations or result in the unauthorized disclosure of, access to or other processing of personal information or individually identifiable health information (potentially violating certain privacy laws), other otherwise adversely affect the confidentiality, integrity and availability of our information systems or any information stored therein, it could result in a material disruption of our development programs and our business operations, whether due to a loss of our trade secrets or other similar disruptions. Some of the federal, state and foreign government requirements include obligations of companies to notify individuals of cybersecurity breaches involving particular personal information, which could result from breaches experienced by us or by our vendors, contractors, or organizations with which we have formed strategic relationships.

Any security breach or other incident, whether actual or perceived, could impact our reputation, cause us to incur significant costs, including legal expenses, harm customer confidence, hurt our expansion into new markets, cause us to incur remediation costs, or cause us to lose existing customers. For example, the loss of clinical trial data from clinical trials could result in delays in our regulatory approval efforts