Company: HROW
Filing Date: 2025-03-27
Form Type: 10-K
Source: 0001641172-25-000925
Chunk: 222

Company: HARROW, INC.
Filing Date: 2025-03-27
Form: 10-K
Item: Item 1A
Chunk 222
---
information technology systems are highly integrated into our business, including our customer service infrastructure, R&D efforts,
clinical and commercial manufacturing processes and product sales and distribution processes. Further, as the large part of our employees
work remotely for some portion of their jobs, our reliance on our third-party information technology systems has increased substantially
and is expected to continue to increase. Remote and hybrid working arrangements can increase cybersecurity risks due to the challenges
associated with managing remote computing assets and security vulnerabilities that are present in many non-corporate and home networks.
The complexity and interconnected nature of software, hardware and our systems make them vulnerable to breakdown or other service interruptions,
and to software errors or defects, misconfiguration and other security vulnerabilities. Upgrades or changes to our systems or the software
that we use have resulted and we expect, in the future, will result in the introduction of new cybersecurity vulnerabilities and risks.
Our systems are also subject to frequent perimeter network reconnaissance and scanning, phishing and other cyberattacks. As the cyber-threat
landscape evolves, these attacks are growing in frequency, sophistication, and intensity, and are becoming increasingly difficult to
detect and increasingly sophisticated in using techniques and tools—including artificial intelligence—that circumvent security
controls, evade detection and remove forensic evidence. Such attacks could include the use of harmful and virulent malware, including
ransomware or other denials of service, which can be deployed through various means, including the software supply chain, e-mail, malicious
websites and/or the use of social engineering/phishing.

We
have experienced attacks against our network, although none that have had a material adverse impact to our business. In November 2024,
we became aware of a cybersecurity incident that involved unauthorized access of an employee’s email account. Through this unauthorized
access the threat actor was able to fraudulently divert Company funds to its bank account. We detected the incident in a timeframe management
believes minimized the financial, operation or reputational risk to the Company, and at no point was our ability to generate revenues
disrupted. However, if future attacks occur, there is no assurance we will be able to detect the incident in a timely manner or at all.

There
can be no assurance that our efforts to guard against the wide and growing variety of potential attack techniques will be successful.
Attacks such as those experienced by government entities (including those that approve and/or regulate our products) and other multi-national
companies, including some of our peers, could leave us unable to utilize key business systems or access or protect