Regulus (RGLS) Risk Factors

In the ordinary course of business, we and the third parties with whom we work process sensitive data, and, as a result, we and the third parties with whom we work face a variety of evolving threats, including but not limited to ransomware attacks, which could cause security incidents. Cyberattacks, malicious internet-based activity, online and offline fraud, and other similar activities threaten the confidentiality, integrity, and availability of our sensitive data and information technology systems, and those of the third parties with whom we work. Such threats are prevalent and continue to rise, are increasingly difficult to detect, and come from a variety of sources, including traditional computer "hackers," threat actors, "hacktivists," organized criminal threat actors, personnel (such as through theft or misuse), sophisticated nation-state and nation-state supported actors now engage in attacks (including advanced persistent threat intrusions) for geopolitical reasons and in conjunction with military conflicts and defense activities. During times of war and other major conflicts, we and the third parties with whom we work may be vulnerable to a heightened risk of these attacks, including retaliatory cyber-attacks, that could materially disrupt our systems and operations, supply chain, and ability to produce, sell and distribute our services. We and third parties with whom we work may also be the subject of a variety of evolving threats, including but not limited to social-engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks, credential stuffing, credential harvesting, personnel misconduct or error, ransomware attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other information technology assets, adware, telecommunications failures, earthquakes, fires, floods, attacks enhanced or facilitated by AI, and other similar threats. Threat actors may continue to develop and use more sophisticated tools and techniques (including AI) that are specifically designed to circumvent security controls, evade detection, and obfuscate forensic evidence, making it more difficult for us to identify, investigate and recover from incidents. In particular, severe ransomware attacks are becoming increasingly prevalent and can lead to significant interruptions, delays, or outages in our operations, disruption of clinical trials, loss of data (including data related to clinical trials), loss of income, significant extra expenses to restore data or systems, reputational loss and the diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments (including, for example, if applicable laws or regulations prohibit such payments). It may be difficult and/or costly to detect, investigate, mitigate, contain, and remediate a security incident. Our efforts to do so may not be successful. Actions taken by us or the third parties with whom we work to detect, investigate, mitigate, contain, and remediate a security incident could result in outages, data losses, and disruptions of our business. Threat actors may also gain access to other networks and systems after a compromise of our networks and systems. We rely on a global enterprise software system to operate and manage our business, and our business therefore depends on the continuous, effective, reliable, and secure operation of our computer hardware, software, services, networks, communications, Internet servers and related infrastructure. We rely upon third-party service providers and technologies to operate critical business systems and process sensitive data in a variety of contexts, including, without limitation, third-party providers of cloud-based infrastructure, encryption and authentication technology, employee email, content delivery to customers, and other functions. Our ability to monitor these third parties' information security practices is limited, and these third parties may not have adequate information security measures in place. If the third parties with whom we work experience a security incident or other interruption, we could experience adverse consequences. While we may be entitled to damages if the third parties with whom we work fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award. Similarly, supply chain attacks have increased in frequency and we cannot guarantee that third parties and infrastructure in our supply chain or our third-party partners' supply chains have not been compromised or that they do not contain exploitable defects or bugs that could result in a breach of or disruption to our information technology systems or the third-party information technology systems that support us and our services. Our remote workforce poses increased risks to our information technology systems and data, as employees utilize network connections, computers, and devices outside our premises. Additionally, future or past business transactions (such as acquisitions or integrations) could expose us to additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities' systems and technologies. Furthermore, we may discover security issues that were not found during due diligence of such acquired or integrated entities, and it may be difficult to integrate companies into our information technology environment and security program. While we have implemented security measures designed to protect against a security incident, there can be no assurance that our security measures or those of the third parties with whom we work will be effective in protecting against a security incident. We take steps designed to detect and remediate vulnerabilities, but we may be unable in the future to detect, anticipate, or prevent such vulnerabilities in our information technology, services (or those of the third parties with whom we work) because such threats and techniques change frequently, are often sophisticated in nature, and may not be detected until after an incident has occurred. Further, we may experience delays in deploying remedial measures or patches designed to address identified vulnerabilities. Vulnerabilities could be exploited and result in a security incident. Any of the aforementioned threats could cause a security incident, which, in turn, could result in unauthorized access to, damage to, disablement or encryption of, use or misuse of, disclosure of, modification of, destruction of, or loss of our data or our customers' data (or that of the third parties with whom we work), or disrupt our ability to provide our services or our service providers' ability to support our services. As a result, our business could suffer. The integrity and protection of our sensitive data, including employee and personal health information, is critical to our business, and employees and others have a high expectation that we will adequately protect their personal information. We may expend significant resources, fundamentally change our business activities and practices, or modify our operations, including our clinical trial activities, or information technology in an effort to protect against security incidents. Applicable data protection laws, privacy policies or other obligations related to data privacy (e.g. contractual obligations, obligations related to membership in industry organizations) may require us to implement specific security measures or use industry-standard or reasonable measures to protect against security measures. Applicable data privacy and security obligations may require us, or we may voluntarily choose, to notify relevant stakeholders, including affected individuals, customers, regulators, and investors, of security incidents, or to implement other requirements, such as providing credit monitoring and identify theft protection services. Such disclosures and related actions can be costly, and the disclosure or the failure to comply with such applicable requirements could lead to adverse consequences. The regulatory environment governing information, security and privacy is increasingly demanding and continues to evolve. Maintaining compliance with applicable information security and privacy obligations may increase our operating costs. If we, or a third party with whom we work, experience a security incident, or are perceived to have experienced a security incident, we may experience adverse consequences, such as: government enforcement actions that could include investigations, fines, penalties, audits and inspections; additional reporting requirements and/or oversight; restrictions on processing of sensitive data (which could impact our clinical trials); litigation (including class claims); indemnification obligations; negative publicity; reputational harm; monetary fund diversions; interruptions in our operations (including availability of data); financial loss; and other similar harms. Security incidents and attendant consequences may cause customers to stop using our services, deter new customers from using our services, and negatively impact our ability to grow and operate our business. Furthermore, our contracts may not contain limitations of liability, and even where they do, there can be no assurance that the limitations of liability in our contracts would be enforceable or adequate or otherwise protect us from liabilities or damages if we fail to comply with applicable data protection laws, privacy policies or data protection obligations related to information security or security incident. Additionally, we cannot be sure that our insurance coverage will be adequate or sufficient to protect us from or adequately mitigate liabilities or damages with respect to claims, costs, expenses, litigation, fines, penalties, business loss, data loss, regulatory actions or material adverse impacts arising out of our privacy and security practices, processing or security incidents we may experience, or that such coverage will continue to be available on commercially reasonable terms or at all. In addition to experiencing a security incident, third parties may gather, collect, or infer sensitive information about us from public sources, data brokers, or other means that reveals competitively sensitive details about our organization and could be used to undermine our competitive advantage or market position.

As we scale-up manufacturing of product candidates and conduct required stability testing, product, packaging, equipment and process-related issues may require refinement or resolution in order to proceed with any clinical trials and obtain regulatory approval for commercial marketing. We may identify significant impurities, which could result in increased scrutiny by the regulatory agencies, delays in clinical programs and regulatory approval, increases in our operating expenses, or failure to obtain or maintain approval for product candidates or any approved products.

The biotechnology and pharmaceutical industries are intensely competitive. We have competitors both in the United States and internationally, including major multinational pharmaceutical companies, biotechnology companies and universities and other research institutions. Our competitors may have substantially greater financial, technical and other resources, such as larger research and development staff and experienced marketing and manufacturing organizations. Additional mergers and acquisitions in the biotechnology and pharmaceutical industries may result in even more resources being concentrated in our competitors. Competition may increase further as a result of advances in the commercial applicability of technologies and greater availability of capital for investment in these industries. Our competitors may succeed in developing, acquiring or licensing on an exclusive basis, drug products that are more effective or less costly than any product candidate that we may develop. Most of our programs are targeted toward indications for which there are approved products on the market or product candidates in clinical development. We will face competition from other drugs currently approved or that will be approved in the future for the same therapeutic indications. Our ability to compete successfully will depend largely on our ability to leverage our experience in drug discovery and development to: - discover and develop therapeutics that are superior to other products in the market;- attract qualified scientific, product development and commercial personnel;- obtain patent and/or other proprietary protection for our microRNA product platform and future product candidates;- obtain required regulatory approvals; and - successfully collaborate with pharmaceutical companies in the discovery, development and commercialization of new therapeutics. The availability of our competitors' products could limit the demand, and the price we are able to charge, for any products that we may develop and commercialize. We will not achieve our business plan if the acceptance of any of these products is inhibited by price competition or the reluctance of physicians to switch from existing drug products to our products, or if physicians switch to other new drug products or choose to reserve our future products for use in limited circumstances. The inability to compete with existing or subsequently introduced drug products would have a material adverse impact on our business, financial condition and prospects. Established pharmaceutical companies may invest heavily to accelerate discovery and development of novel compounds or to in-license novel compounds that could make our product candidates less competitive. In addition, any new product that competes with an approved product must demonstrate compelling advantages in efficacy, convenience, tolerability and safety in order to overcome price competition and to be commercially successful. Accordingly, our competitors may succeed in obtaining patent protection, receiving FDA approval or discovering, developing and commercializing product candidates before we do, which would have a material adverse impact on our business.

The degree of market acceptance of any product candidates will depend on a number of factors, including: - demonstration of clinical safety and efficacy compared to other products;- the relative convenience, ease of administration and acceptance by physicians, patients and healthcare payors;- the prevalence and severity of any AEs;- limitations or warnings contained in the FDA-approved label for such products;- availability of alternative treatments;- pricing and cost-effectiveness;- the effectiveness of our or any collaborators' sales and marketing strategies;- our ability to obtain hospital formulary approval;- our ability to obtain and maintain sufficient third party coverage and adequate reimbursement; and - the willingness of patients to pay out-of-pocket in the absence of third party coverage. Unless other formulations are developed in the future, we expect our compounds to be formulated in an injectable form. Injectable medications may be disfavored by patients or their physicians in the event drugs which are easy to administer, such as oral medications, are available. If a product is approved, but does not achieve an adequate level of acceptance by physicians, patients and healthcare payors, we may not generate sufficient revenues from such product and we may not become or remain profitable.

The global credit and financial markets in the past have experienced, and may in the future experience, extreme volatility and disruptions. These disruptions can result in severely diminished liquidity and credit availability, increases in inflation, declines in consumer confidence, declines in economic growth, increases in unemployment rates and uncertainty about economic stability. There can be no assurance that deterioration in credit and financial markets and confidence in economic conditions will not occur. Our general business strategy may be adversely affected by any such economic downturn, volatile business environment, high inflation, high interest rates, bank failures, or continued unpredictable and unstable market conditions. If the current equity and credit markets deteriorate, it may make any necessary debt or equity financing more difficult, more costly and more dilutive. Failure to secure any necessary financing in a timely manner and on favorable terms could have a material adverse effect on our operations, growth strategy, financial performance and stock price and could require us to delay or abandon clinical development plans. In addition, there is a risk that one or more of our current service providers, manufacturers and other partners may not survive an economic downturn, exposure to a bank failure, or rising inflation, which could directly affect our ability to attain our operating goals on schedule and on budget. Other international and geo-political events could also have a serious adverse impact on our business. For instance, in February 2022, Russia initiated military action against Ukraine and the two countries are now at war. In response, the United States and certain other countries imposed significant sanctions and trade actions against Russia and could impose further sanctions, trade restrictions, and other retaliatory actions. Additionally, in October 2023, Hamas initiated an attack against Israel, provoking a state of war and subsequently a larger regional conflict. While we cannot predict the broader consequences, these conflicts and retaliatory and counter-retaliatory actions could materially adversely affect global trade, currency exchange rates, inflation, regional economies, and the global economy, which in turn may increase our costs, disrupt our supply chain, impair our ability to raise or access additional capital when needed on acceptable terms, if at all, or otherwise adversely affect our business, financial condition, and results of operations.

If any product candidates that we develop are approved for commercialization, we may also enter into agreements with third parties to market them on a worldwide basis or in more limited geographical regions. We expect that we will be subject to additional risks related to entering into international business relationships, including: - different regulatory requirements for drug approvals in foreign countries;- different payor reimbursement regimes, governmental payors or patient self-pay systems and price controls;- reduced protection for intellectual property rights;- unexpected changes in tariffs, trade barriers and regulatory requirements;- economic weakness, including inflation, or political instability in particular foreign economies and markets;- compliance with tax, employment, immigration and labor laws for employees living or traveling abroad;- foreign taxes, including withholding of payroll taxes;- foreign currency fluctuations, which could result in increased operating expenses and reduced revenues, and other obligations incident to doing business in another country;- workforce uncertainty in countries where labor unrest is more common than in the United States;- production shortages resulting from any events affecting raw material supply or manufacturing capabilities abroad; and - business interruptions resulting from geopolitical actions, including war and terrorism, natural disasters, including earthquakes, typhoons, floods and fires, public health pandemics or epidemics or other business interruptions.