Risk Factors Dashboard

We face cybersecurity risks as a result of the variety of networks and systems we must defend against cybersecurity attacks; and the level of harm that could occur if we suffer impacts of a material cybersecurity incident. We are committed to robust oversight of these risks and implementing mechanisms, controls, technologies, and processes designed to help us assess, identify, and manage these risks. In the year ended June 30, 2026, we did not experience a material “cybersecurity incident” as such term is defined in Item 106(a) of Regulation S-K. In the year ended December 31, 2023, we did not experience a material “cybersecurity incident” as such term is defined in Item 106(a) of Regulation S-K. However, we have experienced two such material breaches in the past (see Form 10-K for the year ended 2023) and there can be no guarantee that we will not experience such incidents in the future. Such incidents could result in us incurring significant costs related to implementing threat protection measures, and the possibility of such incidents could result in additional costs in defending against litigation, responding to regulatory inquiries or actions, paying damages, or taking other remedial steps with respect to third parties, as well as incurring significant reputational harm.

Company leadership is committed to a proactive cybersecurity strategy, with the goal of maintaining the best controls, technologies, and other processes practicable, for a company of our size and resources, in order to assess, identify, and manage material cybersecurity risks. Our cybersecurity program is aligned with applicable industry standards. Our website, individual desktop, and other IT/security services are maintained by Business Systems Consulting (BCS), a third-party IT and cybersecurity firm, based in New York. They have processes in place to assess, identify, manage, and address material cybersecurity threats and incidents. The third-party firm has processes in place to assess, identify, manage, and address material cybersecurity threats and incidents. These include, among other things, annual and ongoing security awareness advice for employees; mechanisms to detect and monitor unusual network activity; and containment and incident response tools.

We use the Microsoft 365 Business platform to protect corporate data through multiple layers of security. User access is secured with multifactor authentication and identity-based controls, while company laptops and mobile devices can be centrally managed and monitored through Microsoft Intune to ensure they meet security requirements before accessing company resources. Shared files stored in OneDrive and SharePoint, as well as Teams meeting recordings and documents, are protected by Microsoft's cloud security, access controls, encryption, and threat-detection capabilities, allowing access to be restricted to authorized users and reducing the risk of unauthorized sharing. In addition, Microsoft Defender for Business helps detect and respond to malware, ransomware, phishing attacks, and other cybersecurity threats across company devices, supporting our overall cybersecurity governance and compliance objectives.

At the recommendation of BCS, Bion recently upgraded to the Microsoft 365 Business Premium platform, with a more robust integrated security solution. The added security and device management includes the following features:

BCS personnel report to our Chief Executive Officer (“CEO”). BCS stays informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals within its team and through the use of technological tools and software. The third-party firm is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals within its team and through the use of technological tools and software. Our CEO reports directly to the Board of Directors on our cybersecurity program and efforts to prevent, detect, mitigate, and remediate issues. Cybersecurity reviews by the Board of Directors will occur at least annually, or more frequently as determined to be necessary or advisable.

Cybersecurity threats are constantly evolving, increasing the difficulty of successfully defending against them or implementing adequate preventative measures. While we seek to detect and investigate unauthorized attempts and attacks against our network and to prevent their occurrence where practicable, we remain potentially vulnerable to known or unknown threats. In some instances, we may be unaware of a threat or incident or its magnitude and effects for some time. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, which could subject us to additional liability and reputational harm. See “Item 1A. Risk Factors” of this Annual Report for more information on our cybersecurity risks and product vulnerability risks.