Traws Pharma, Inc.

Risk Management and Strategy

Due to the size of our company, we have not yet developed robust policies and processes for assessing, identifying, and managing material risk from cybersecurity threats. We have implemented access controls with respect to our systems, which we monitor regularly. We currently rely heavily on products and services provided by third-party suppliers to operate certain critical business systems, including without limitation, cloud-based infrastructure, encryption and authentication technology, email, and other functions. We rely on third party providers and outsourced IT services to protect, detect, monitor, mitigate and address cybersecurity related risks, including installing software for threat protection and malware. Such third party providers are tasked with notifying management of any material risks or cybersecurity concerns that they identify, which management then assesses and may bring to our audit committee or board of directors to discuss if deemed necessary or appropriate. We also alert employees to significant new cybersecurity issues on a regular basis.

We rely heavily on third party service providers for our clinical development activities and cloud-based documentation and communications. A cybersecurity incident at a vendor or other third-party service provider could

have a material and adverse impact on our business, results of operations and financial condition. We do not currently have a formal process in place for evaluating or reviewing third party vendor cybersecurity risks and procedures and rely on such third parties to implement adequate protectionary and detection measures.

We do not specifically utilize assessors, consultants, auditors, or other third parties to evaluate or enhance our cybersecurity programs. On an annual basis, our information technology risks, controls and procedures are reviewed by third-party experts as part of our Sarbanes-Oxley review and testing.

Board Governance and Risk Management

Management Oversight

Our management team is primarily responsible for assessing and managing our strategic risk exposures, including material risks from cybersecurity threats, with assistance from third-party service providers. Due to the size of our company, we rely on outsourced information technology (“IT”) and cybersecurity service providers to support certain operational and security functions, and our internal oversight is led by members of senior management.

Management’s role in assessing and managing material risks from cybersecurity threats is led byour Chief Operating Officer and Chief Financial Officer, with oversight from our Chief Executive Officer. The Chief Operating Officer brings operational and technology-related experience, including prior experience in the information technology sector, and supports management oversight of our third-party IT environment. The Chief Financial Officer brings extensive experience in finance and accounting leadership, including experience with public company reporting, internal control environments and third-party service provider oversight. Collectively, these management roles provide the Company with executive-level oversight of cybersecurity risk governance, vendor coordination and incident escalation.

Prevention, Detection, Mitigation and Remediation; Escalation and Reporting

Our management team, in coordination with our outsourced IT and cybersecurity service providers, is responsible for monitoring and coordinating processes intended to support the prevention, detection, mitigation and remediation of cybersecurity incidents affecting our information systems and information residing with third-party providers. These processes are designed to be commensurate with our size, resources and risk profile and are informed by, among other things, the security capabilities embedded in key third-party systems we use (including cloud-based infrastructure and related security tools) and the ongoing monitoring and alerting performed by our outsourced IT providers.

In general, our outsourced IT providers are expected to notify management of significant cybersecurity risks, suspicious activity or cybersecurity incidents that they identify in the course of providing services. Management evaluates such information to determine appropriate response actions, which may include engaging external technical specialists (as needed), containing and remediating the issue, restoring systems and data (as applicable), and implementing corrective actions intended to reduce the likelihood of recurrence. Management also coordinates internal communication and, where appropriate, external communications and notifications.

Our board of directors has oversight responsibility for enterprise risk management, including risks from cybersecurity threats, which it administers directly and with assistance from its committees, primarily theaudit committee. Throughout the year, the board and its committees engage with management to discuss a wide range of enterprise risks, including cybersecurity. The audit committee assists the board of directors by overseeing management’s processes to assess and manage cybersecurity risks and receives updates from management regarding our cybersecurity program periodically, including at least annually, and more frequently as circumstances warrant. Cybersecurity incidents that are determined by management to be material, as well as significant cybersecurity matters (including significant changes in our risk profile), are escalated promptly to the audit committee, and the audit committee may report such matters to the full board, as appropriate.

To date, we are not aware of any cybersecurity incident that has had or is reasonably likely to have a material impact on our business or operations; however, because of the frequently changing attack techniques, along with the increased volume and sophistication of the attacks, there is the potential for us to be adversely impacted. This impact could result

in reputational, competitive, operational or other business harm as well as financial costs and regulatory action. See “Part I —Item 1A. Risk Factors” for further discussion of these risks.