Company: KROS
Filing Date: 2025-11-05
Form Type: 10-Q
Source: 0001664710-25-000089
Chunk: 398

Company: Keros Therapeutics, Inc.
Filing Date: 2025-11-05
Form: 10-Q
Item: Item 8
Chunk 398
---
, and it may be difficult to integrate companies into our information technology environment and security program.

We use third parties to operate critical business systems to process sensitive information in a variety of contexts, including, without limitation, cloud-based infrastructure, encryption and authentication technology, employee email and other functions. We also work with third-party service providers to provide other products, services, parts or otherwise to operate our business. Our ability to monitor these third parties’ information security practices is limited, and these third parties may not have adequate information security measures in place. If our third-party service providers experience a security incident or other interruption, we could experience adverse consequences. While we may be entitled to damages if our third-party service providers fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award. In addition, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties’ infrastructure in our supply chain or our third-party partners’ supply chains have not been compromised.

While we have implemented security measures designed to protect against security incidents, there can be no assurance that these measures will be effective. We take steps to detect and remediate vulnerabilities in our information systems, but we have not always been and may not in the future be able to detect and remediate all vulnerabilities on a timely basis because the threats and techniques used to exploit the vulnerability change frequently and are often sophisticated in nature. Therefore, such vulnerabilities could be exploited and result in a security incident, but may not be detected until after the security incident has occurred. Unremediated high risk or critical vulnerabilities pose material risks to our business. Further, we have at times experienced and may in the future experience delays in developing and deploying remedial measures designed to address any such identified vulnerabilities.

Any of the previously identified or similar threats have in the past and may in the future cause a security incident or other interruption that have in the past and may in the future result in unauthorized, unlawful or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of or access to our sensitive information or our information technology systems, or those of the third parties with whom we work. A security incident or other interruption could disrupt our ability (and that of third parties with whom we work) to operate our business. We may expend significant resources or modify our business activities (including our clinical trial activities) to try to protect against security incidents. Certain data privacy and security 

75

obligations have required us to implement