Inhibitor Therapeutics, Inc.

We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. Our Chief Financial Officer manages our risk management program, with periodic updates provided to the Board of Directors, to assess third party risk exposure to identify and mitigate risks from vendors, suppliers, and other business partners. We are not aware of any material cybersecurity incidents that have materially affected the Company to date. However, we cannot guarantee that we will not experience such incidents in the future. We maintain cybersecurity insurance coverage (first and third-party) with an insurance carrier that is a leader in the cybersecurity insurance industry.

Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. We are cognizant of cybersecurity risks related to our business, technical operations, privacy and compliance issues, IT security, governance, risk and compliance reviews. To defend, detect and respond to cybersecurity incidents, we are proactive in privacy and cybersecurity issues with vendors and conduct employee training as needed, monitor emerging laws and regulations related to data protection and information security and implement appropriate changes.

Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers and potential fourth-party risks when handling and/or processing our employee, business or vendor data. In addition to new vendor onboarding, we would perform risk management during potential third-party cybersecurity compromise incidents, should they occur, to identify and mitigate risks to us from third-party incidents.

We rely on information technology systems and third-party service providers in the conduct of our business, including for data storage, communications, finance and regulatory work. Our scale and resources are limited, but cybersecurity remains an area of management attention.

We maintain administrative, technical and operational measures that we believe are appropriate for our size and stage of development. As of the date of this report, we are not aware of any cybersecurity incident that has materially affected our business, strategy, results of operations or financial condition.