Lexeo Therapeutics, Inc.

Risk Management and Strategy

We have established policies and processes for assessing, identifying, and managing risk from cybersecurity threats. We periodically assess risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. Following these risk assessments, we evaluate how to reasonably address any identified gaps in existing safeguards and monitor the effectiveness of our safeguards. We devote resources and designate high-level personnel, including our Vice President, Associate General Counsel, who reports to our Chief Financial Officer, to manage the risk assessment and mitigation process in a manner that is consistent andintegrated with our overall risk management processes.

As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, including our cybersecurity safeguards, in collaboration with human resources, IT, and management. Personnel at all levels and departments receive periodic trainings on cybersecurity best practices and threats. For example, we conduct e-mail phishing campaigns with our employees and contractors which send phishing-style e-mails, monitor user responses, and automatically assign further training, as needed, and also provide convenient solutions for our employees to report suspicious messages.

Weengage specialized third parties in connection with our risk assessment processes. These third parties assistus in designing and implementing our cybersecurity policies and procedures, as well as in monitoring and testing our safeguards.

We also conduct IT security assessments on our key third-party service providers and require them to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of their security measures that may affect our company.

We have not previously experienced any cybersecurity risk or cybersecurity incident which has been determined to bematerial. For additional information regarding whether any risks from cybersecurity threats are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, “Risk Factors” in this Annual Report on Form 10-K, including the risk factor entitled “Our business and operations would suffer in the event of system failures, cyberattacks or a deficiency in our or our CMOs’, CROs’, manufacturers’, contractors’, consultants’ or collaborators’ cybersecurity”.

Governance

One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through our audit committee.

Our security governance steering committee, which includes senior representatives from key functions including Clinical Operations, Legal, Finance and Human Resources, has primary responsibility for assessing and managing our risks from cybersecurity threats. Our security governance steering committee oversees our cybersecurity policies and processes, including those described in “Risk Management and Strategy” above. The day-to-day implementation of our cybersecurity policies and processes is primarily overseen by our Vice President, Associate General Counsel in consultation with our Chief Financial Officer and external advisors including our IT and Cybersecurity consultant. Our Vice President, Associate General Counsel has more than a decade of advising onrisk management and compliance in the highly regulated biopharmaceutical industry. Our IT and Cybersecurity consultant hasover 20 years of experience with IT, with an emphasis on cybersecurity over the past four years. Our managementis informed about the prevention, detection, mitigation, and remediation of cybersecurity incidents through support by our security governance steering committee which, in consultation with external advisors, oversees, works with, and delegates daily operations to the IT/IS and other teams. Our information security policies are developed and implemented, and are reviewed at least annually with updates authorized and approved, by the security governance steering committee.

Representatives from our security governance steering committee provide periodic briefings to the audit committee regarding our company’s cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides updates to the board of directors on such reports.