Company: DNLI
Filing Date: 2025-11-06
Form Type: 10-Q
Source: 0001714899-25-000193
Chunk: 376

Company: Denali Therapeutics Inc.
Filing Date: 2025-11-06
Form: 10-Q
Item: Part II, Item 1A
Chunk 376
---
 to anticipate all types of security threats, and we may not be able to implement preventive measures effective against all such security threats. The techniques used by cyber criminals change frequently, may not be recognized until launched, and can originate from a wide variety of sources. Although to our knowledge we have not experienced any such material system failure or security breach or incident to date, if a breakdown, cyberattack or other information security breach or incident were to occur and cause interruptions in our operations, it could result in a material disruption of our development programs and our business operations, whether due to loss or misappropriation of trade secrets or loss of, or unauthorized modification, unavailability, disclosure, or other unauthorized processing of other proprietary information or other similar disruption and we could incur liability and reputational damage. For example, any corruption, loss, or other unavailability of clinical trial data from completed, ongoing or future clinical trials could result in delays in our regulatory approval efforts and significantly increase our costs to recover or reproduce the data. Likewise, we rely on our third-party research institution collaborators for research and development of our product candidates and other third parties for the manufacture of our product candidates and to conduct clinical trials, and similar events relating to their computer systems could also have a material adverse effect on our business.

Cyber-attacks, breaches, interruptions, or other data security incidents could result in legal claims or proceedings by private parties or governmental authorities, liability under federal or state laws that protect the privacy of personal information, regulatory penalties, significant remediation costs, disrupt key business operations, and divert attention of management and key information technology resources. In the United States, notice of breaches must be made to affected individuals, the U.S. Secretary of the Department of Health and Human Services ("HHS"), and for extensive breaches, notice may need to be made to the media or U.S. state attorneys general. Such a notice could harm our reputation and our ability to compete. In addition, U.S. state attorneys general are authorized to bring civil actions seeking either injunctions or damages in response to violations that threaten the privacy of state residents. There can be no assurance that we, our collaborators, CROs, contractors, consultants, and any other business counterparties will be successful in efforts to detect, prevent, protect against, or fully recover systems or data from all break-downs, service interruptions, attacks, or security breaches or incidents. Although we maintain standalone cybersecurity insurance, the costs related to significant security breaches, incidents, or disruptions could be material and exceed the limits of any