Bicara Therapeutics Inc.

Cyber Risk Management and Strategy

•We have certain processes for assessing, identifying, and managing cybersecurity risks, which are built into our information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, protect employee and clinical trial information from unauthorized access or attack, as well as secure our networks and systems. Such processes include physical, procedural, and technical safeguards, and routine review of our policies and procedures in an effort to identify risks and refine our practices. We engage certain external parties to enhance our cybersecurity oversight.

•As part of our cybersecurity risk management program, we maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business.

•In an effort to deter and detect cyber threats, we perform annual phishing tests with employees. We also conduct annual cybersecurity and prevention training for employees, which may cover topics such as social engineering, phishing, password protection, confidential data protection, artificial intelligence, and mobile security, and is designed to educate employees on incident reporting. We also use technology-based tools, including third-party tools and solutions, designed to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.

•We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition; however, like other companies in our industry, we and our third-party vendors may, from time to time, experience threats and security incidents relating to our and our third-party vendors’ information systems.

Governance Related to Cybersecurity Risks

Our Board of Directors, or the Board, has established oversight mechanisms to manage risks from cybersecurity threats. Our Audit Committee of the Board, or the Audit Committee, has primary responsibility for oversight of cybersecurity risk, pursuant to the Audit Committee charter, and periodically updates our Board on such matters.

Our cybersecurity program is led by our Vice President, IT, who is tasked with the oversight of company-wide cybersecurity strategy, policy, and standards across relevant departments to assess and help prepare us to address cybersecurity risks. Our Vice President, IT reports to the Chief Financial Officer, or CFO. Our Vice President, IT has over twenty-five years of experience in information technology and also leverages the experience of a third-party managed systems provider. Our Vice President, IT regularly reports to the CFO as well as to other executive management and the Audit Committee on cyber matters, as appropriate.