MBX Biosciences, Inc.

Risk Management and Strategy

We manage cybersecurity threats as part of our oversight, evaluation, and mitigation of enterprise-level risks. We have implemented a cybersecurity risk management program, in accordance with our risk profile and business size, that is designed to detect, identify, assess, and respond to current and emerging cybersecurity threats. Our cybersecurity risk management program is supported by third-party information technologies and vendors, including a managed services provider that assists us with, cybersecurity system monitoring, detection and alerting tools, and response support services. We also leverage third-party information technology service providers to monitor and evaluate our cybersecurity posture through cybersecurity risk reviews and assessments. Our cybersecurity risk assessments are informed by industry standards and frameworks and incorporate elements of the same, including elements of the National Institute of Standards and Technology ("NIST") cybersecurity framework.

We have adopted an incident response plan designed to coordinate the steps to identify, contain, eradicate, and recover from cybersecurity incidents. In addition, we provide security awareness training for all newly-hired employees and conduct annual cybersecurity training for all employees. We also have a process to review certain third-party information technology service providers and vendors, including through contractual requirements, due diligence and proactive threat intelligence monitoring, as appropriate.

To date, we have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, however, like other companies in our industry, we and our third-party information technology service providers and vendors have from time to time experienced threats that could affect our information or systems. For more information, please refer to Item 1A, “Risk Factors,” in this Annual Report.

Governance

Our Senior Director of Information Technology coordinates with our Chief Financial Officer ("CFO") and relevant third parties, such as consultants and external legal advisors, to assess and manage material risks from cybersecurity threats. Our Senior Director of Information Technology has over fifteen years of experience in information technology, including over five years in cybersecurity and information security. Our Senior Director of Information Technology is also supported by a cross-functional security incident response team, which is responsible for identifying, reporting, investigating, documenting, and mitigating cybersecurity incidents pursuant to our incident response plan and policy.

Our board of directors has overall oversight responsibility for our risk management, and delegates its oversight of risk assessment and management guidelines to the audit committee of the board of directors. Members of the audit committee receive periodic updates from our CFO, who is briefed by our Senior Director of Information Technology, regarding matters of cybersecurity. These discussions may include updates on management’s efforts to address and mitigate cybersecurity risks, cybersecurity incidents (if any), and the status of key information security initiatives. Executive management will promptly update our board of directors regarding significant threats and incidents as they arise.