Cyclerion Therapeutics (CYCN) Risk Factors

In the ordinary course of our business, we and our third-party service providers may process proprietary, confidential, and sensitive data, including personal data (such as health-related data and data related to our clinical trials), intellectual property, and trade secrets (collectively, sensitive information). Cyberattacks, malicious internet-based activity, and online and offline fraud are prevalent and continue to increase. These threats are becoming increasingly difficult to detect. These threats come from a variety of sources, including traditional computer "hackers," threat actors, personnel (such as through theft or misuse), "hacktivists", organized criminal threat actors, sophisticated nation-states, and nation-state-supported actors. Some actors now engage and are expected to continue to engage in cyberattacks, including without limitation nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities. During times of war and other major conflicts, we and the third parties upon which we rely may be vulnerable to a heightened risk of these attacks, including retaliatory cyberattacks that could materially disrupt our systems and operations, supply chain, and ability to produce, sell and distribute our products. We and the third parties upon which we rely may be subject to a variety of other evolving threats, including, but not limited to, social-engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks, credential stuffing, credential harvesting, personnel misconduct or error, ransomware attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other information technology assets, adware, telecommunications failures, attacks enhanced or facilitated by artificial intelligence, and other similar threats. In particular, ransomware attacks, including those from organized criminal threat actors, nation-states and nation-state supported actors, are becoming increasingly prevalent and severe and can lead to significant interruptions, delays, or outages in our operations, ability to provide our products, disruption of clinical trials, loss of data (including data related to clinical trials), loss of income, significant extra expenses to restore data or systems, reputational loss and the diversion of funds. To alleviate the financial, operational and reputational impact of a ransomware attack, it may be preferable to make extortion payments, but we may be unwilling or unable to do so (including, for example, if applicable laws prohibit such payments). Additionally, hybrid and remote work has become more common and has increased risks to our information technology systems and data, as more of our employees utilize network connections, computers, and devices outside our premises or network, including working at home, while in transit, and in public locations. Future or past business transactions (such as acquisitions or integrations) could also expose us to additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities' systems and technologies. Furthermore, we may discover security issues that were not found during due diligence of such acquired or integrated entities, and it may be difficult to integrate companies into our information technology environment and security program. We rely upon third parties and technologies to operate critical business systems to process sensitive information in a variety of contexts, including, without limitation, third-party providers of cloud-based infrastructure, encryption and authentication technology, employee email, and other functions. We also rely on third parties to provide certain products, including active pharmaceutical ingredients, to operate our business. Our ability to monitor these third parties' information security practices is limited, and these third parties may not have adequate information security measures in place. While we may be entitled to damages if the third parties upon which we rely fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award. In addition, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties' infrastructure in our supply chain or our third-party partners' supply chains have not been compromised. We may share or receive sensitive information with or from third parties. While we have implemented security measures designed to protect against security incidents, there can be no assurance that these measures will be effective. We take steps designed to detect, mitigate and remediate vulnerabilities in our information security systems (such as our hardware and/or software, including that of third parties upon which we rely), but we may not be able to detect, mitigate, and remediate all such vulnerabilities including on a timely basis. Further, we may experience delays in developing and deploying remedial measures and patches designed to address identified vulnerabilities. Vulnerabilities could be exploited and result in a security incident. Any of the previously identified or similar threats could cause a security incident or other interruption that could result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to our sensitive information or our information technology systems, or those of the third parties upon whom we rely. A security incident or other interruption could disrupt our ability (and that of third parties upon whom we rely) to provide our products. We may expend significant resources or modify our business activities (including our clinical trial activities) to try to protect against security incidents. Certain data privacy and security obligations require us to implement and maintain specific security measures, industry-standard or reasonable security measures to protect our information technology systems and sensitive information. Applicable data security and public company disclosure obligations may require us to notify relevant stakeholders of certain security incidents, including affected individuals, customers, regulators and investors. Such disclosures are costly, and the disclosures or the failure to comply with such requirements could lead to adverse consequences. If we (or a third party upon whom we rely) experience a security incident or are perceived to have experienced a security incident, we may experience adverse consequences. These consequences may include: government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting requirements and/or oversight; restrictions on processing sensitive information (including personal data); litigation (including class claims); indemnification obligations; negative publicity; reputational harm; monetary fund diversions; diversion of management attention; interruptions in our operations (including availability of data); financial loss and other similar harms. For example, the loss of clinical trial data from completed or ongoing clinical trials for any of our product candidates could result in delays in our regulatory approval efforts and significantly increase our costs to recover or reproduce the data. Whether a cybersecurity incident is reportable to our investors may not be straightforward, may take considerable time to determine, and may be subject to change as the investigation of the incident progresses, including changes that may significantly alter any initial disclosure that we provide. Moreover, experiencing a material cybersecurity incident and any mandatory disclosures could lead to negative publicity, loss of customer, investor or partner confidence in the effectiveness of our cybersecurity measures, diversion of management's attention, governmental investigations, lawsuits, and the expenditure of significant capital and other resources. Our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages, or claims related to our data privacy and security obligations. In addition, our insurance coverage may not be adequate or sufficient to protect us from or to mitigate liabilities arising out of our privacy and security practices or that such coverage will continue to be available on commercially reasonable terms or at all, or that such coverage will pay future claims. In addition to experiencing a security incident, third parties may gather, collect, or infer sensitive information about us from public sources, data brokers, or other means that reveals competitively sensitive details about our organization and could be used to undermine our competitive advantage or market position. Sensitive information of us or our customers could also be leaked, disclosed, or revealed as a result of or in connection with our employee's, personnel's, or vendor's use of generative AI technologies.

The use of our current and any potential future product candidates in clinical studies and any sale thereof, if approved, exposes us to the risk of product liability claims. Product liability claims might be brought against us by patients, healthcare providers or others selling or otherwise coming into contact with our product candidates. For example, we may be sued if any such product candidate we develop allegedly causes injury or is found to be otherwise unsuitable during product testing, manufacturing, marketing or sale. Any such product liability claims may include allegations of defects in manufacturing, defects in design, a failure to warn of dangers inherent in the product, including as a result of interactions with alcohol or other drugs, negligence, strict liability and a breach of warranties. Claims could also be asserted under state consumer protection acts. If we become subject to product liability claims and cannot successfully defend ourselves against them, we could incur substantial liabilities. In addition, regardless of merit or eventual outcome, product liability claims may result in, among other things: withdrawal of subjects from our clinical studies; substantial monetary awards to patients or other claimants; decreased demand for our product candidates or any future product candidates following marketing approval, if obtained; damage to our reputation and exposure to adverse publicity; increased FDA warnings on product labels; litigation costs; distraction of management's attention from our primary business; loss of potential revenue; and the inability to successfully commercialize our product candidates or any potential future product candidates, if approved. We maintain product liability insurance coverage for our clinical studies through both domestic and international insurance policies, subject to an annual coverage limit. Nevertheless, our insurance coverage may be insufficient to reimburse us for any expenses or losses we may suffer if a judgment or settlement exceeds available insurance proceeds. Moreover, in the future, we may not be able to maintain insurance coverage at a reasonable cost or in sufficient amounts to protect us against losses, including if insurance coverage becomes increasingly expensive. If and when we obtain marketing approval for our product candidates, we intend to expand our insurance coverage to include the sale of commercial products; however, we may not be able to obtain this product liability insurance on commercially reasonable terms. Large judgments have been awarded in class action lawsuits based on drugs that had unanticipated side effects. The cost of any product liability litigation or other proceedings, even if resolved in our favor, could be substantial, particularly in light of the size of our business and financial resources. A product liability claim or series of claims brought against us could cause our stock price to decline and, if we are unsuccessful in defending such a claim or claims and the resulting judgments exceed our insurance coverage, our business, prospects, financial condition and results of operations could be materially harmed. During the course of treatment, patients may suffer adverse events, including death, for reasons that may or may not be related to our product candidates. Such events could subject us to costly litigation, require us to pay substantial amounts of money to injured patients, delay, negatively impact or end our opportunity to receive or maintain regulatory approval to market our product candidates, if approved, or require us to suspend or abandon our commercialization efforts of any approved product candidates. Even in a circumstance in which we do not believe that an adverse event is related to our product candidates, the investigation into the circumstance may be time-consuming or inconclusive. These investigations may interrupt our sales efforts, delay our regulatory approval process, or impact and limit the type of regulatory approvals our product candidates receive or maintain. As a result of these factors, a product liability claim, even if successfully defended, could have a material adverse effect on our business, prospects, financial condition and results of operations.

The tax regimes to which we are subject or under which we operate are unsettled and may be subject to significant change. The issuance of additional guidance related to existing or future tax laws, or changes to tax laws or regulations proposed or implemented by the current or a future U.S. presidential administration, Congress, or taxing authorities in other jurisdictions, including jurisdictions outside of the United States, could materially affect our tax obligations and effective tax rate. To the extent that such changes have a negative impact on us, including as a result of related uncertainty, these changes may adversely impact our business, financial condition, results of operations, and cash flows. The amount of taxes we pay in different jurisdictions depends on the application of the tax laws of various jurisdictions, including the United States, to our international business activities, tax rates, new or revised tax laws, or interpretations of tax laws and policies, and our ability to operate our business in a manner consistent with our corporate structure and intercompany arrangements. The taxing authorities of the jurisdictions in which we operate may challenge our methodologies for pricing intercompany transactions pursuant to our intercompany arrangements or disagree with our determinations as to the income and expenses attributable to specific jurisdictions. If such a challenge or disagreement were to occur, and our position was not sustained, we could be required to pay additional taxes, interest, and penalties, which could result in one-time tax charges, higher effective tax rates, reduced cash flows, and lower overall profitability of our operations. Our financial statements could fail to reflect adequate reserves to cover such a contingency. Similarly, a taxing authority could assert that we are subject to tax in a jurisdiction where we believe we have not established a taxable connection, often referred to as a "permanent establishment" under international tax treaties, and such an assertion, if successful, could increase our expected tax liability in one or more jurisdictions. Effective January 1, 2022, the Tax Cuts and Jobs Act of 2017 eliminated the option to deduct research and development expenses for tax purposes in the year incurred and requires taxpayers to capitalize and subsequently amortize such expenses over five years for research activities conducted in the United States and over 15 years of research activities conducted outside the United States. Unless the United States Department of the Treasury issues regulations that narrow the application of this provision to a smaller subset of our research and development expenses or the provision is deferred, modified, or repealed by Congress, in future years we may experience a material decrease in our cash flows from operations and an offsetting similarly sized increase in our net deferred tax assets over these amortization periods. The actual impact of this provision will depend on multiple factors, including the amount of research and development expenses we will incur and whether we conduct our research and development activities inside or outside the United States and our overall net operating loss position.

We do not currently have an infrastructure for the sale, marketing, market access, patient service and distribution of pharmaceutical products. In order to market our product candidates, if approved by the FDA or any other regulatory authority outside the United States, we must build our sales, marketing, managerial and other non-technical capabilities, or arrange with third parties to perform these services. There are risks involved with both establishing our own commercial capabilities and entering into arrangements with third parties to perform these services. For example, recruiting and training a sales force or reimbursement specialists is expensive and time-consuming and could delay any product candidate launch. If commercialization is delayed or does not occur, we would have prematurely or unnecessarily incurred such expenses. This may be costly, and our investment would be lost if we cannot retain or reposition our commercialization personnel. If we enter into arrangements with third parties to perform sales, marketing, commercial support and distribution services, any product candidate revenue or the profitability of that revenue may be lower than if we were to market and sell any products we may develop ourselves. In addition, we may fail to enter into arrangements with third parties to commercialize our product candidates or may be unable to do so on terms that are favorable to us. We may have little control over such third parties, and any of them may fail to devote the necessary resources and attention to sell and market our product candidates effectively. If we do not establish commercialization capabilities successfully, either on our own or in collaboration with third parties, or if we are unable to do so on commercially reasonable terms, we will not be successful in commercializing our product candidates if approved and our business, prospects, financial condition and results of operations will be materially harmed.

Many nations, including the United States, continue to implement mitigation measures, that have in the past and may in the future limit our ability to access patients and physicians at certain local clinical centers that are participating in any future development activities. We may face limitations and difficulties enrolling patients in our planned and future clinical trials if the patient populations that are eligible for our clinical trials are affected by the coronavirus and/or the COVID-19 vaccines or other pandemics. Any such restrictions at trial sites could delay any future clinical studies. In addition, if the patients enrolled in any future clinical trials become infected with COVID-19 or other viruses, we may have more adverse events and deaths in our clinical trials as a result. Vulnerable patients may be at a higher risk of contracting COVID-19 and other viruses may experience more severe symptoms from the disease, adversely affecting our chances for regulatory approval or requiring further clinical studies. The adverse effects that may occur from administration of vaccines to patients participating in our future clinical trials could adversely affect clinical trial outcomes or data analysis. Furthermore, the extent to which the COVID-19 pandemic, or future outbreaks of infectious disease, hinders access to facilities, procurement of resources, raw materials or components necessary for research studies or preclinical or clinical development is not fully predictable. Delays and disruptions from the COVID-19 pandemic, or future outbreaks of infectious disease, may increase our capital needs while potentially interfering with our access to capital.