Pelthos Therapeutics Inc.

Risk Management and Strategy

We maintain a comprehensive cybersecurity risk management program designed to identify, assess, and mitigate material risks posed by evolving cybersecurity threats.

Our program employs a multi‑layered strategy that includes:

•Governance through policies and technical controls that guide employee behavior and enforce secure practices.

•Centralized access administration, including required manager and system‑owner approvals, and prompt removal of access when roles change.

•Access provisioning based on the Principle of Least Privilege (PoLP) to restrict hardware, network, and data access to only what users need.

•Ongoing monitoring using a variety of software tools to detect potential cyber threats.

•Ongoing evaluation and improvement of cybersecurity safeguards employed by the company.

•Multi-layered system and data backup strategies for effective mitigation of potential cyber events.

•Ongoing employee education, including regular cybersecurity training and phishing simulations.

These controls work together to strengthen our security posture and safeguard the organization’s information assets.

To date, cybersecurity threats, including those resulting from any previous cybersecurity incidents, have not materially affected our Company, including our business strategy, results of operations or financial condition. We do not believe that cybersecurity threats resulting from any previous cybersecurity incidents of which we are aware are reasonably likely to materially affect our Company. See “Our internal computer systems, or those of our collaborators or other contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of our product development programs” and “ Cyber-security incidents, including data security breaches or computer viruses, could harm our business by disrupting our delivery of services, damaging our reputation or exposing us to liability” in the “Risk Factors” section of this Annual Report on Form 10-K for further information.

Governance

Our management andboard of directors recognize the critical importance of maintaining the trust and confidence of our business partners and employees, including the importance of managing cybersecurity risks as part of our larger risk management program. While all of our personnel play a part in managing cybersecurity risks, one of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and ourexecutive officers are responsible for the day-to-day management of the material risks that we face. In general, we seek to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, integrity, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.