Sensei Biotherapeutics, Inc.

Risk Management and Strategy

We have established policies and processes designed for assessing, identifying, and managing material risk from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including clinical trial data, intellectual property, confidential information that is proprietary, strategic, financial or competitive in nature, and personal data.

Our legal team as well as the Vice Presidents of Product and Engineering are responsible for identifying, assessing and managing the Company’s cybersecurity threats and risks. These functions use various methods such as automated tools, reports of threats and threat actors, third-party threat assessments, and vulnerability assessments in an effort to identify, monitor and assess cybersecurity threats.

Depending on the environment, system and data, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats, including, for example, cybersecurity testing and cybersecurity awareness training, encryption of certain data, network security controls, data segregation, access controls, asset management processes, and systems monitoring tools.

We retain third-party service providers in an effort to help identify, assess and manage the Company’s cybersecurity threats and risks, including for example, professional services firms (such as outside legal counsel) and cybersecurity consultants.

We use third-party service providers to perform a variety of functions throughout our business, including, for example, application providers, hosting companies, contract research organizations, and contract manufacturing organizations. Depending on the nature of the services provided, the sensitivity of the systems and data at issue, and the identity of the provider, our vendor engagement processes may include risk assessments, security evaluations, audit requirements, and imposition of cybersecurity obligations.

We have integrated our assessment and management of material risks from cybersecurity threats into our overall risk management systems and processes. For example, our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the board or the board’s audit committee which evaluates our overall enterprise risks.

For a description ofthe risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the risk entitled “If our information systems or data, or those of our collaborators, contractors, consultants or other third parties with whom we work, are or were compromised, we could experience adverse consequences, including but not limited to regulatory investigations or actions; litigation; fines and penalties; significant disruption of our product development programs and our ability to operate our business effectively; reputational harm; and other adverse consequences.”

Governance

Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The board of directors’ audit committee is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.

Our Vice President of Engineering, Vice President of Product, and General Counsel integrate cybersecurity risk considerations into the Company’s overall risk management strategy, communicate key priorities to relevant personnel, help prepare for cybersecurity incidents, approve cybersecurity processes, and review security assessments and other security-related reports.

Our Vice President of Engineering has approximately 15 years of experience in healthcare technology, including prior roles at Flatiron Health and Epic Systems involving systems that process sensitive patient data. He has expertise in designing and operating systems subject to HIPAA and SOC 2 compliance requirements, including security architecture review, access control and authentication design, and participation in SOC 2 and HIPAA audit and incident response processes.

Our Vice President of Product has over 20 years of experience delivering products across the healthcare ecosystem, including digital health products used in clinical trial management and pharmaceutical ordering. He has experience managing products subject to HIPAA and 21 CFR Part 11 regulatory requirements and maintains training related to HIPAA, data privacy, and security practices in regulated healthcare environments.

Our General Counsel oversees the Company's cybersecurity incident response processes and evaluates cybersecurity risks in the context of SEC disclosure obligations. He has prior experience advising public and private companies on regulatory compliance and risk management, including matters involving data privacy and information security.

Ourcybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our General Counsel. The General Counsel works with the Company’s incident responders in an effort to help mitigate and remediate cybersecurity incidents of whichhe is notified. In addition, our incident response processes include reporting to our disclosure committee and audit committee of the board of directors for certain cybersecurity incidents.

Our audit committee receives periodic reports from management concerning the Company’s significant cybersecurity threats and risks and the processes designed to address them. The audit committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.