CORCEPT THERAPEUTICS INC

In the normal course of business, we collect and store personal information and other sensitive information, including proprietary and confidential business information, intellectual property, information regarding patients and clinical trial participants, sensitive third-party information and employee information. To protect this information, we use managed detection and response services to monitor our network infrastructure and associated endpoints for possible cybersecurity threats. In addition, we use multi-factor authentication, perform penetration testing and engage third parties to assess the effectiveness of our cybersecurity practices. We conduct a thorough risk assessment by identifying critical assets, recognizing potential threats and vulnerabilities, and implement strategies to mitigate these risks and their possible impacts. We establish incidence response plans and provide cybersecurity training to our employees and monitor their activity to ensure adherence to our security protocols.

No risks from cybersecurity threats have occurred that have affected our business strategy, results of operations, or financial condition.

The Corporate Governance and Nominating Committee of our Board of Directors oversees management of risks associated with corporate governance, including cybersecurity. This committee meets regularly with Corcept management and reports to the full Board of Directors.

See “Risk Factors – General Risk Factors” for additional information about the risks to our business associated with a breach or compromise to our information security systems.