Company: XTIA
Filing Date: 2025-04-15
Form Type: 10-K
Source: 0001213900-25-032213
Chunk: 72

Company: XTI Aerospace, Inc.
Filing Date: 2025-04-15
Form: 10-K
Item: Item 1
Chunk 72
---
, critical service
providers, and other third-parties that may lead to a service disruption or an adverse cybersecurity incident. This includes a third-party
risk management policy which outlines required risk management processes, including assessment of vendors during the selection/onboarding
process, review of SOC 1 reports on an annual basis, and a regular review of vendor contracts and compliance with service level agreements.

The
Audit Committee of the Board of Directors oversees XTI Aerospace’s cybersecurity risk exposures and the steps taken by management
to monitor and mitigate cybersecurity risks. The cybersecurity stakeholders, including member(s) of management assigned with cybersecurity
oversight responsibility and/or third-party consultants providing cyber risk services brief the Audit Committee on cyber vulnerabilities
identified through the risk management process, the effectiveness of XTI Aerospace’s cyber risk management program, and the emerging
threat landscape and new cyber risks on at least an annual basis. This includes updates on XTI Aerospace’s processes to prevent,
detect, and mitigate cybersecurity incidents. In addition, cybersecurity risks are reviewed by XTI Aerospace’s Board of Directors
at least annually, as part of the Company’s corporate risk oversight processes.

XTI
Aerospace faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results
of operations, cash flows or reputation. XTI Aerospace acknowledges that the risk of cyber incidents is prevalent in the current threat
landscape and that a future cyber incident may occur in the normal course of its business. However, prior cybersecurity incidents have
not had a material adverse effect on XTI Aerospace’s business, financial condition, results of operations, or cash flows. The
Company proactively seeks to detect and investigate unauthorized attempts and attacks against IT assets, data, and services, and
to prevent their occurrence and recurrence where practicable through changes or updates to internal processes and tools and changes or
updates to service delivery; however, potential vulnerabilities to known or unknown threats will remain. Further, there is increasing
regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders,
which could subject the Company to additional liability and reputational harm. In response to such risks, the Company has implemented
initiatives such as implementation of the cybersecurity risk assessment process and development of an incident response plan. See Item
1A. “Risk Factors” for more information on cybersecurity risks.

37

ITEM
2: PROPERTIES

We
lease office space in several locations in the United States, including Palo Alto,