Medicus Pharma Ltd.

Risk Management and Strategy

We are a biotech/life sciences company focused on accelerating the clinical development programs of novel and disruptive therapeutic assets. We current do not sell any products or maintain any customer lists and have exposure to cybersecurity risks commensurate with the small size of our company and the nature of our operations, which we believe at this time is limited. Assessment, identification and management of cybersecurity related risks areintegrated into our overall risk management process. Our risk management process is designed to identify, prioritize, and monitor risks that could affect our ability to execute our corporate strategy and fulfill our business objectives and to appropriately mitigate such risks. We believe we appropriately assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. As our company grows, we plan to expand our strategy for cybersecurity in accordance with nationally accepted standards. As of the date of this annual report we do not currently engage assessors, consultants, auditors, or other third parties in connection with cybersecurity processes or have processes to oversee and identify such risks from third-party service providers.

Governance

Management is responsible for the day-to-day management of the risks we face, while our board of directors has responsibility for the oversight of risk management, including risks from cybersecurity threats. Our audit and risk assessment committee is responsible for overseeing the Company's risk management policies and procedures with regard to identification of the Company's principal risks and implementation of appropriate systems to manage such risks.

As of the date of this annual report, we arenot aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the business strategy, results of operations or financial condition of the Company. However, there is no guarantee that we will not be subject to future threats or incidents.