ImageneBio, Inc.

Cybersecurity Risk Management and Strategy

We have implemented a cybersecurity program designed to support both the effectiveness of our systems and our preparedness for information security risks. This program is designed to identify, assess and manage material risks to our information systems, third-party hosted services, communications systems, hardware and software and our critical data (including intellectual property and confidential information). Our program includes a number of safeguards, such as: password protection; multi-factor authentication; monitoring and alerting systems for internal and external threats; and episodic evaluations of our cybersecurity program.

We have an employee security awareness training program that is designed to raise awareness of cybersecurity threats across functions, as well as to encourage consideration of cybersecurity risks across our company. As part of this employee training program, we periodically conduct phishing simulations designed to raise employee awareness of such risks.

Our Board together with our information security function and third-party service providers help to identify, assess and manage the Company’s cybersecurity risks. Depending on the environment and the nature of the relevant data, we implement and maintain various technical, physical and organizational measures (such as controls and policies) designed to manage and mitigate material cybersecurity threats (such as incident response plans, periodic risk assessments, encryption of certain data, as well as network security and system monitoring controls). We use a risk-based approach with respect to our use and oversight of third-party service providers, tailoring processes according to the nature and sensitivity of the data accessed, processed, or stored by such third-party service provider. We use a number of means designed to assess cyber risks related to our third-party service providers, including conducting due diligence (such as through security questionnaires and retaining audit rights under certain circumstances) where such diligence is informed, in part, based on the nature of the services performed as well as the systems and data at issue. We also seek to include certain security terms in our contracts, where applicable as part of our oversight of third-party service providers. From time to time, we use third-party service providers to assist us in an effort to identify, assess, and manage material risks from cybersecurity threats, including for example professional services firms (including legal counsel, threat intelligence service providers, cybersecurity consultants, and cybersecurity software providers).

Our assessment and management of material risks from cybersecurity threats areintegrated into the Company’s overall risk management processes. For example, (1) cybersecurity risk is addressed as a component of the Company’s enterprise risk management program; (2) our information security function works with certain members of the Company’s management in an effort to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; (3) our management team evaluates material risks from cybersecurity threats against our overall business objectives and reports to the board of directors, which evaluates our overall enterprise risk, and (4) we have a cybersecurity incident response process designed to identify, assess, respond to, and inform escalating levels of management of such incidents based on their nature and severity. For a description of the risks from cybersecurity threats to maymaterially affect the Company and how they do so, see Item 1A—Risk Factors including the risk factor titled, “If our information technology systems or those third parties with whom we work or our data are or were compromised, we could experience adverse consequences resulting from such compromise, including, but not limited to, interruptions to our operations such as our clinical trials, claims that we breached our data protection obligations, harm to our reputation, regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, reputational harm, loss of revenue or profits, and other adverse consequences.

Cybersecurity Governance

Our management engages with third-party experts who have significant IT expertise and broad cybersecurity experience, including in cybersecurity threat management, cybersecurity training and education, incident response, cyber forensics, insider threats, business continuity and disaster recovery, and regulatory compliance. Such individuals have significant prior work experience in various roles involving IT security, auditing, compliance, systems, and programming. These individuals are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents and design. These third-party providers provide reporting to, and meet periodically with, our Senior Vice President of Finance and Administration to discuss and review our cybersecurity risk management processes.. This individual has responsibilities such as integrating cybersecurity risk considerations reported by the third-party experts into the Company’s overall risk management strategy, communicating key priorities to relevant personnel, approving relevant budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, reviewing security assessments and other security-related reports, and retaining certain third parties in connection with the Company’s cybersecurity program.

Our board of directors has delegated oversight of our Company’s cybersecurity risk management to our audit committee. The audit committee, pursuant to the audit committee charter, is responsible for reviewing the Company’s information security and technology risks (including cybersecurity), including high-level review of the threat landscape facing our Company and our Company’s strategy to mitigate cybersecurity risks and potential breaches. Our audit committee receives reports and presentations on data privacy and security, which address relevant cybersecurity issues, and which can span a wide range of topics, including but not limited to, recent developments, evolving standards, vulnerability assessments, review of risks from third parties such as service providers and suppliers, and the current threat environment. We have a process for our Senior Vice President of Finance and Administration to provide periodic and as-needed updates to the audit committee on the status of our cybersecurity program, certain cybersecurity incidents and the relevant cybersecurity risks our Company faces. The board of directors and audit committee also has access to various reports, summaries or presentations related to our cybersecurity threats, risks and mitigation strategies.

The audit committee’s cybersecurity-related oversight includes the following:

•

Receiving notice of, and providing guidance with respect to, material cybersecurity incidents;

•

Reviewing our risks and cybersecurity programs and policies;

•

Overseeing our management and mitigation of the Company’s cybersecurity and related risk management programs;

•

Reviewing the progress of major technology-related proposals, plans, projects and architecture decisions to ensure these projects and decisions support our overall business strategy.