Company: BLND
Filing Date: 2025-03-13
Form Type: 10-K
Source: 0001855747-25-000017
Chunk: 118

Company: Blend Labs, Inc.
Filing Date: 2025-03-13
Form: 10-K
Item: Item 1C
Chunk 118
---
ITEM 1C. CYBERSECURITY

Risk Management and Strategy

We have established processes and policies for assessing, identifying, and managing material risks arising from cybersecurity threats and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on, or conducted through, our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.We conduct annual risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks. We also utilize threat modeling to evaluate changes to our applications or environments for new threats or risks, and our cybersecurity team monitors the threat landscape regularly using security industry sources and certain threat intelligence information. Blend conducts daily vulnerability assessments, prioritizes remediation, and engages in routine system and application patching as well as other proactive measures, where deemed appropriate, to mitigate reasonably foreseeable risks. Blend maintains an incident response plan that is designed to contain and address any suspected security incident identified by the Company. This plan is tested at least annually. Our security operations team triages issues and invokes the incident response plan when deemed necessary. This plan includes provisions for notifications of internal and external parties, including Blend leadership and the Audit Committee as required.Following these risk assessments, or when we otherwise identify cybersecurity risks through the processes described in this “Risk Management and Strategy” section, we evaluate whether and how to re-design, implement, and maintain reasonable safeguards to minimize identified risks and reasonably address any identified gaps in existing safeguards. We devote significant resources and designate high-level personnel, including our Information Security Officer, who reports to our Head of Finance and Administration, to manage the risk assessment and mitigation process.

55

As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with our human resources and information technology functional groups. Personnel at all levels and departments are made aware of our cybersecurity policies through training. Specific training is required for users of higher-risk systems or individuals associated with specific security processes such as incident response.Our cybersecurity program includes processes for identifying and managing risks from third parties and is integrated into our overall risk management framework. Our program