Company: KROS
Filing Date: 2025-05-06
Form Type: 10-Q
Source: 0001664710-25-000046
Chunk: 407

Company: Keros Therapeutics, Inc.
Filing Date: 2025-05-06
Form: 10-Q
Item: Item 4
Chunk 407
---
 efforts to do so may not be successful. Actions taken by us or the third parties with whom we work to detect, investigate, mitigate, contain and remediate a security incident could result in outages, data losses and disruptions of our business. Threat actors may also gain access to other networks and systems after a compromise of our networks and systems. In particular, severe ransomware attacks are becoming increasingly prevalent and can lead to significant interruptions in our operations, ability to provide products and services, loss of sensitive data and income, reputational harm, and diversion of funds. Extortion 

71

payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments.

We are increasingly dependent upon information technology systems, infrastructure and data to operate our business, particularly due to our hybrid-work policies. Hybrid work has become more common and has increased risks to our information technology systems and data, as more of our employees utilize network connections, computers and devices outside our premises or network, including working at home, while in transit and in public locations. Future or past business transactions (such as acquisitions or integrations) could expose us to additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities’ systems and technologies. Furthermore, we may discover security issues that were not found during due diligence of such acquired or integrated entities, and it may be difficult to integrate companies into our information technology environment and security program.

We use third parties to operate critical business systems to process sensitive information in a variety of contexts, including, without limitation, cloud-based infrastructure, encryption and authentication technology, employee email and other functions. We also work with third-party service providers to provide other products, services, parts or otherwise to operate our business. Our ability to monitor these third parties’ information security practices is limited, and these third parties may not have adequate information security measures in place. If our third-party service providers experience a security incident or other interruption, we could experience adverse consequences. While we may be entitled to damages if our third-party service providers fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award. In addition, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties’ infrastructure in our supply chain or our third-party partners’ supply chains have not been compromised.

While we have implemented security measures designed to