ALLURION TECHNOLOGIES, INC.

Cyber Risk Management and Strategy

We recognize the importance of assessing, identifying, and managing risks from cybersecurity threats. We have implemented a cybersecurity risk management program in accordance with our risk profile, which is informed by and incorporates elements of recognized industry standards. Our cybersecurity risk management strategy is guided by both internal cybersecurity risk assessments and third-party information security audits.

We leverage the support of third-party information technology and security providers as part of our cybersecurity risk management program, including for penetration testing. Further, we have adopted written information security policies and procedures, including an incident response plan, which is designed to establish our processes for identifying, responding to, and recovering from cybersecurity incidents.

We have also implemented a process to assess and review the cybersecurity practices of certain third-party vendors and service providers, including through the use of vendor security questionnaires. Additionally, the Company’s employees go through cybersecurity awareness training covering topics such as general cybersecurity best practices, phishing, data protection, password protection, and network security.

We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, like other companies in our industry, we and our third-party vendors may, from time to time, experience threats and security incidents that could effect our information or systems. For more information, please see the section entitled"Risk Factors".

Governance Related to Cybersecurity Risks

Our cybersecurity risk management program is managed by our Information Security Management Committee (the “InfoSec Committee”). The InfoSec Committee is currently made up of a cross-disciplinary team, including the Company’s acting Chief Information Security Officer (CISO), Chief Legal Officer, VP of People, Senior Director of R&D & Engineering, VP of Global Marketing, Medical Affairs and our Senior Corporate Counsel. The InfoSec Committee meets on a monthly basis to provide oversight of the Company's information security management system ("ISMS"), review the performance and effectiveness of the ISMS, and review and discuss the direction of the Company’s cybersecurity program, among other responsibilities. The committee also performs an annual audit to ensure Allurion's ISMS is effectively implemented and maintained. Ouracting CISO, who is also our VP of Software Engineering, is responsible for the day-to-day oversight of the assessment and management of our information security program and cybersecurity risks. The individual who is currently in this role has approximately 25 years of experience in information technology.

The Board also engages in oversight of cybersecurity risks. With the input of the InfoSec Committee, our CISO may provide periodic updates to the Board on matters related to cybersecurity as needed.