Company: SWKH
Filing Date: 2025-04-29
Form Type: ARS
Source: 0001628280-25-020753
Chunk: 32

Company: SWK Holdings Corp
Filing Date: 2025-04-29
Form: ARS
Chunk 32
---
such as credential stuffing), ransomware attacks, supply-chain attacks, and software bugs as well as cybersecurity failures resulting from human error, catastrophic events (such as fires, floods, hurricanes and tornadoes), loss of data or other information technology assets, and technological errors. We expend resources trying to protect against cybersecurity threats to our information technology systems. Additionally, certain data privacy and security laws, as well as industry best practice standards, may require us to implement and maintain additional cybersecurity measures.

<div align='center'>15</div>

Cybersecurity threat actors and their techniques change frequently, are often sophisticated in nature, and may not be detected until after a cybersecurity incident has occurred. While we have implemented cybersecurity measures designed to protect our information technology systems as well as the confidential and sensitive data in our possession, there can be no assurance that these measures will be adequate to detect, prevent, or adequately address any cybersecurity incident or data breach that we may face. Additionally, the third-parties with whom we do business may be sources or targets of cybersecurity attacks or other technological risks. While we engage in actions to reduce our exposure to third-party risks, we cannot control the cybersecurity plans and systems put in place by these third parties and ongoing threats may result in unauthorized access, loss, exposure or destruction or misuse of data, or other cybersecurity incidents, with increased costs and other consequences, including those described above.

We and certain of our service providers have in the past and may in the future experience cybersecurity threats and incidents, including incidents related to social engineering, business compromise, and wire fraud. For example, in January 2025, an employee’s business email account was compromised by an unauthorized third party, and a borrower payment was fraudulently re-directed. If we, or a third party upon whom we rely, experience a cybersecurity incident or are perceived to have experienced a cybersecurity incident, we may experience adverse consequences. These consequences may affect our business strategy, results of operations, or financial condition and can include: government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting requirements and/or oversight; restrictions on processing sensitive data (including personal data); litigation (including class claims); indemnification obligations; negative publicity; reputational harm; monetary fund diversions; interruptions in our operations (including availability of data); financial loss; and other similar harms. To the extent that any disruption or cybersecurity incident were to result in a loss of, or damage to, a counterparties’ data or applications, or inappropriate disclosure or misuse of confidential or