Company: PAX
Filing Date: 2025-05-15
Form Type: 20-F
Source: 0001628280-25-025640
Chunk: 272

Company: Patria Investments Ltd
Filing Date: 2025-05-15
Form: 20-F
Item: Item 16K
Chunk 272
---
ITEM 16K. CYBERSECURITY

Cybersecurity Risk Management and Strategy

We are committed to maintaining a robust cybersecurity infrastructure to safeguard the integrity, confidentiality and availability of our digital assets, including the data of our investors, employees, portfolio companies, and business partners against potential cyber threats, incidents and vulnerabilities. Our cybersecurity framework is an integral part With respect to third party service providers, our measures also include risk and compliance assessments and contractual obligations in vendor agreements.

To ensure the efficacy of our cybersecurity defenses, we conduct regular assessments through both automated and manual vulnerability scanning techniques. These assessments are critical in identifying and addressing potential security gaps. Our evaluation process also involves an annual review of our cybersecurity framework, benchmarking its performance against industry standards and recognized frameworks, such as those provided by the National Institute of Standards and Technology (NIST).

  Patria Investments Limited      173  

  Table of Contents  

We also engage an independent third-party entity to conduct annual external penetration testing, as well as periodic evaluations of our cybersecurity measures. These assessments are instrumental in validating the effectiveness of our security strategies. Recognizing the importance of human factors in cybersecurity, we actively promote awareness and training among our employees on an ongoing basis. This is achieved through targeted internal communications, videos, and regular phishing awareness campaigns, which simulate real-world threats to enhance employee vigilance and response capabilities.

In addition, we have established a comprehensive Cybersecurity Incident Response (CIR) protocol to manage the escalation and resolution of suspected or confirmed cybersecurity events. The CIR protocol outlines the formation of a dedicated response team, comprising individuals from various technical and managerial departments, to investigate and remediate incidents. This team is also responsible for determining the need for external advisory support, including legal, forensic, and law enforcement assistance. Post-incident, the CIR protocol guides the ongoing monitoring and remediation efforts to prevent recurrence. The effectiveness and relevance of the CIR are reviewed on an annual basis.

Cybersecurity Governance

Our cybersecurity team is led by our CISO, who works closely with our senior management. The CISO reports directly to our Chief Information Officer (“ CIO”). The CISO is responsible for developing and advancing our cybersecurity strategy.

Our cybersecurity program is overseen by a dedicated Cybersecurity Committee that convenes quarterly to review and assess the program's progress. Key performance indicators (KPIs) are used to measure advancements, while potential risks are continuously evaluated to ensure proactive mitigation. This structured approach enhances our ability to adapt to evolving threats and strengthens our overall security posture.

OurBoard