Company: CRVO
Filing Date: 2025-03-17
Form Type: 10-K
Source: 0001437749-25-007829
Chunk: 101

Company: CervoMed Inc.
Filing Date: 2025-03-17
Form: 10-K
Item: Item 1A
Chunk 101
---
, employee theft or misuse, ransomware, social engineering (including phishing attacks), denial-of-service attacks, sophisticated nation-state and nation-state-supported actors, unauthorized access, natural disasters, terrorism, war and telecommunication and electrical failures. As use of digital technologies has increased, cyber incidents, including deliberate attacks and attempts to gain unauthorized access to computer systems and networks, have increased in frequency and sophistication. Additionally, developments in artificial intelligence and machine learning provide threat actors with the capability to use more sophisticated means to attack the Company’s systems and may exacerbate cybersecurity risk. These threats pose a risk to the security of the Company’s IT systems and networks and the confidentiality, availability and integrity of the Company’s data. There can be no assurance that the Company will be successful in detecting or preventing cybersecurity incidents, or successfully mitigating their effects. As a result, the Company may experience cybersecurity incidents that may remain undetected for an extended period.

72

Any such disruption or security incident could cause interruptions to its operations and result in disruption of the Company’s development programs and business operations. For example, the loss of clinical trial data from future clinical trials could result in delays in the Company’s regulatory approval efforts and significantly increase its costs to recover or reproduce the data. A successful cyberattack could also cause misappropriation of confidential business information, including financial information, trade secrets, financial loss and the disclosure of corporate strategic plans. If the Company were to experience a significant cybersecurity incident that impacts its information systems or data, the costs associated with the investigation, remediation, and potential notification of the cybersecurity incident to counterparties, regulatory authorities, and data subjects could be material. In addition, the Company’s remediation efforts may not be successful. Cybersecurity incidents could also lead to significant business disruption, including transaction errors, supply chain or manufacturing interruptions, processing inefficiencies, data loss or the loss of or damage to intellectual property or other proprietary information. In addition, the Company’s recently-increased remote workforce could increase the Company’s cybersecurity risk, create data accessibility concerns, and make the Company more susceptible to communication disruption.

To the extent that any disruption or cybersecurity incident were to result in a loss of, or damage to, the Company’s or its third-party vendors’, collaborators’ or other contractors’ or consultants’ data or applications, or inappropriate disclosure of confidential or proprietary information, the Company could incur liability including litigation exposure, penalties and fines, the Company could become the subject of regulatory actions or investigations, its competitive position could be harmed and the further development and commercialization