Company: TVRD
Filing Date: 2025-10-07
Form Type: S-1/A
Source: 0001104659-25-097519
Chunk: 116

Company: Tvardi Therapeutics, Inc.
Filing Date: 2025-10-07
Form: S-1/A
Chunk 116
---
 mitigate, and remediate vulnerabilities in our information systems (such as our hardware and/or software, including that of third parties with whom it works). The Company has not and may not in the future, however, detect and remediate all such vulnerabilities including on a timely basis. Further, the Company has and may in the future experience delays in developing and deploying remedial measures and patches designed to address identified vulnerabilities.

Although the Company develops and maintains systems and controls designed to prevent these events from occurring and the Company has a process to identify and mitigate threats, the development and maintenance of these systems, controls and processes is costly and requires ongoing monitoring and updating as technologies change and efforts to overcome security measures become increasingly sophisticated. It may be difficult and/or costly to detect, investigate, mitigate, contain, and remediate a security incident. Our efforts to do so may not be successful. Actions taken by us or the third parties with whom we work to detect, investigate, mitigate, contain, and remediate a security incident could result in outages, data losses, and disruptions of our business. Threat actors may also gain access to other networks and systems after a compromise of our networks and systems. Moreover, despite the Company’s efforts, the possibility of these events occurring cannot be eliminated entirely. As the Company outsources more of its information systems to vendors, and relies more on cloud-based information systems, the related security risks will increase, and the Company will need to expend additional resources to protect its technology and information systems.

<div align='center'>64</div>

In addition, there can be no assurance that the Company’s internal information technology systems or those of the third-parties with whom it works, or its consultants’ efforts to implement adequate security and control measures, will be sufficient to protect the Company against breakdowns, service disruption, data deterioration or loss in the event of a system malfunction, or prevent data from being stolen or corrupted in the event of a cyberattack, security breach, industrial espionage attacks or insider threat attacks, which could result in financial, legal, business or reputational harm. In addition to experiencing a security incident, third parties may gather, collect, or infer sensitive information about us from public sources, data brokers, or other means that reveal competitively sensitive details about our organization and could be used to undermine our competitive advantage or market position.

Any of the previously identified or similar threats have in the past and may in the future cause a security incident or other interruption that have in the past and may in the future result in unauthorized, unlawful,