Company: ZLAB
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0001628280-25-008409
Chunk: 177

Company: Zai Lab Ltd
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1A
Chunk 177
---
 If our licensors incur such harm or liability, it may also cause damage to our revenues and reputation which may not be covered by insurance.

Potential cybersecurity threats are changing rapidly and advancing in sophistication. We may not be able to protect our systems and networks, or the confidentiality of our confidential or other information (including personal information), from cyberattacks and other unauthorized access, disclosure, and disruption.

Cybersecurity risks for companies like ours have significantly increased in recent years, in part because of the proliferation of new technologies, the use of the internet and certain technologies to conduct business, and the increased 

-53-

sophistication and activities of organized crime, hackers, terrorists, and other external parties, including foreign state-sponsored actors. 

Like many companies, from time to time we have been, and expect to continue to be, the target of attempted cyberattacks and other cybersecurity incidents. Such incidents may include malware, ransomware, denial-of-service attacks, social engineering, unauthorized access, human error, theft or misconduct, fraud, and phishing, as part of an effort to disrupt operations, potentially test cybersecurity capabilities, or obtain confidential, proprietary, or other information (including personal information). Our cybersecurity risk and exposure depend on various factors, including the evolving nature and increasing frequency, levels of persistence, sophistication, and intensity of these threats, the outsourcing of some of our business operations, and the current global economic and political environment. The increase in remote work environments also may increase our cybersecurity risk if our employees, vendors, service providers, and other third parties with which we interact are working remotely on less secure systems and environments. 

Because we are dependent on third parties for certain elements of our business and operations, we could also be adversely affected if any of them are subject to a successful cyberattack or other cybersecurity incident. Third parties with which we do business may also be sources of cybersecurity or other technology risks. We routinely transmit and receive confidential, proprietary, and other information (including personal information) by electronic means. This information could be subject to interception, misuse, or mishandling. Our exposure to these risks could increase as a result of our migration of core systems and applications to a third-party cloud environment. While we generally perform cybersecurity diligence on our key vendors, because we do not control third parties with whom we do business and our ability to monitor their cybersecurity posture is limited, the cybersecurity measures they take may not be sufficient to protect any information we share with them.

Although we devote significant resources to protect our systems, network, and information, the security measures