Company: SION
Filing Date: 2025-01-17
Form Type: S-1
Source: 0001193125-25-008474
Chunk: 105

Company: Sionna Therapeutics, Inc.
Filing Date: 2025-01-17
Form: S-1
Chunk 105
---
-engineering attacks
(including through phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions),
denial-of-service attacks (such as credential stuffing attacks), credential harvesting, personnel misconduct or error, ransomware attacks, supply-chain attacks, software
bugs, server malfunctions, software or hardware failures, loss of data or other information technology assets, adware, electrical and telecommunications failures, earthquakes, fires, floods, and other similar threats. In particular, severe
ransomware attacks are becoming increasingly prevalent and can lead to significant interruptions in our operations, loss of sensitive data and income, reputational harm and diversion of funds.

We have a hybrid in-office/remote work environment, which, like other companies that have incorporated remote
working, has increased risks to our information technology systems and data, as more of our employees utilize network connections, computers and devices outside our premises or network, including working at home, while in transit and in public
locations.

Future business transactions (such as acquisitions or integrations) could expose us to additional cybersecurity risks and
vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities’ systems and technologies. Furthermore, we may discover security issues that were not found during due diligence of such
acquired or integrated entities, and it may be difficult to integrate companies into our information technology environment and security program.

We currently rely on third-party service providers and technologies to operate critical business systems to process sensitive information in a variety
of contexts, including, without limitation, cloud-based infrastructure, employee email, and other functions. We also currently rely on commercially

74

available tools from third-party service providers to process and safeguard our sensitive information and business data. Our ability to monitor these third parties’ information security
practices is limited, and these third parties may not have adequate information security measures in place. If our third-party service providers experience a security incident or other interruption, we could experience adverse consequences. While we
may be entitled to damages if our third-party service providers fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award.

Although, to our knowledge, we have not experienced any material security breach to date, we have experienced and may continue to experience threats or
system failures which could cause a security incident or other interruption that could result in unauthorized, unlawful or accidental acquisition, modification, destruction, loss, alteration,