Company: SKLZ
Filing Date: 2025-11-06
Form Type: 10-K
Source: 0001801661-25-000050
Chunk: 104

Company: Skillz Inc.
Filing Date: 2025-11-06
Form: 10-K
Item: Item 1C
Chunk 104
---
. Key controls include: (a) Zero trust network architecture for employee privileged and non-privileged application access (b) Mandatory employee security awareness training and phishing simulations, plus follow-up remedial training if necessary,(c)Periodic third-party network and host vulnerability scans and (d) 24/7 Security Operations Center monitoring all corporate endpoints which escalates to senior engineering resources as necessary for incident response and remediation. We also maintain a cyber insurance policy to mitigate financial exposure from any security incidents. Our cybersecurity program in particular focuses on the following key areas: Collaboration Our cybersecurity risks are identified and addressed through a comprehensive, cross-functional approach. Key security, risk, and compliance stakeholders meet periodically to develop strategies designed to preserve the confidentiality, integrity and availability of Company and customer information, identify, prevent and mitigate cybersecurity threats, and to attempt to effectively respond to cybersecurity incidents. We maintain controls and procedures that are designed to ensure prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and the Board in an informed and timely manner. Risk Assessment We conduct a cybersecurity risk assessment at least annually that takes into account information from internal resources (e.g., vulnerability scans, incident reporting), known information security vulnerabilities, and information received from external sources (e.g., reported security incidents that have impacted other companies, industry trends, and evaluations by third parties and consultants). Technical Safeguards We periodically assess and deploy technical safeguards designed to protect our information systems from cybersecurity threats. Such safeguards are periodically evaluated and improved as necessary, based on vulnerability assessments, cybersecurity threat intelligence and incident response experience. Incident Response and Recovery Planning We have established comprehensive incident response (“IR”) and recovery plans and continue to periodically test and evaluate the effectiveness of those plans. Our IR plan provides our team with strategies for how to respond to incidents appropriately. Third-Party Risk Management We have implemented controls designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. Such providers may be subject to security risk assessments at the time of onboarding, contract renewal, or upon detection of an increase in risk profile, according to our vendor security review process. We use a variety of inputs in such risk assessments, including information supplied by providers and third parties.

44

TABLE OF CONTENTS

Education and Awareness Our policies require each of our employees to contribute to our data security efforts. We periodically remind and reinforce with our employees the importance of handling and protecting customer and employee data, including through annual privacy and security training designed to enhance awareness of how to prevent