Company: KROS
Filing Date: 2025-05-06
Form Type: 10-Q
Source: 0001664710-25-000046
Chunk: 408

Company: Keros Therapeutics, Inc.
Filing Date: 2025-05-06
Form: 10-Q
Item: Item 4
Chunk 408
---
 protect against security incidents, there can be no assurance that these measures will be effective. We take steps to detect and remediate vulnerabilities in our information systems, but we have not always been and may not in the future be able to detect and remediate all vulnerabilities on a timely basis because the threats and techniques used to exploit the vulnerability change frequently and are often sophisticated in nature. Therefore, such vulnerabilities could be exploited and result in a security incident, but may not be detected until after the security incident has occurred. Unremediated high risk or critical vulnerabilities pose material risks to our business. Further, we have at times experienced and may in the future experience delays in developing and deploying remedial measures designed to address any such identified vulnerabilities.

Any of the previously identified or similar threats have in the past and may in the future cause a security incident or other interruption that have in the past and may in the future result in unauthorized, unlawful or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of or access to our sensitive information or our information technology systems, or those of the third parties with whom we work. A security incident or other interruption could disrupt our ability (and that of third parties with whom we work) to operate our business. We may expend significant resources or modify our business activities (including our clinical trial activities) to try to protect against security incidents. Certain data privacy and security obligations have required us to implement and maintain specific security measures or industry-standard or reasonable security measures to protect our information technology systems and sensitive information.

The costs to respond to a security incident and/or to mitigate any security vulnerabilities that we identify could be significant, our efforts to address these problems may not be successful, and these problems could result in unexpected interruptions, delays, cessation of service, negative publicity, and other harm to our business and our competitive position.

If we (or a third party with whom we work) experience a security incident or are perceived to have experienced a security incident, we may experience adverse consequences. Additionally, our sensitive information could be leaked, disclosed, or revealed as a result of or in connection with our employee’s, personnel’s, or vendor’s use of generative AI technologies, resulting in adverse consequences. In each case, these consequences may include: government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting requirements and/or oversight; restrictions on processing sensitive information (including personal data); litigation (including class action claims); indemnification obligations; negative publicity; reputational harm; monetary fund diversions