We engage a third-party provider to maintain our IT systems, and our management participates in the assessment and identification of any risks from cybersecurity threats. Our third-party provider monitors our systems and reports any issues to us. Our board of directors, together with the audit committee, are engaged in our cybersecurity monitoring managed by our third-party provider. Any issues are appropriately addressed timely. We have adopted a wire transfer verification policy designed to mitigate the risk of fraudulent payment instructions. Under this policy, we have implemented a wire transfer verification policy requiring out-of-band authentication for changes to payment instructions and are reconfirming supplier banking details while requesting bank confirmation for wire transfers. In addition a general risk assessment occurs annually, or as business needs change, and covers identification of risks that could act against the company’s objectives as well as specific risks related to a compromise to the security of data. Most of the information generated and collected by us is stored and maintained by third party vendors and service providers. We believe that each of these providers has its own cybersecurity protocols to which our management believes to be adequate for protecting our files in their possession. See “Item 3.D Risk Factors—General Risk Factors—Our business and operations would suffer in the event of computer system failures, cyber attacks or a deficiency in our cybersecurity.”

The level of each identified risk is determined by considering the impact of the risk itself and the likelihood of the risk materializing and high scoring risks are actioned upon. Risks are analyzed to determine whether the risk meets company risk acceptance criteria to be accepted or whether a mitigation plan will be applied. Mitigation plans include both the individual or department responsible for the plan and may include budget considerations. 

In October 2025, we determined that we had been the victim of criminal fraud commonly referred to as “Business Email Compromise,” which involved email impersonation and the transmission of fraudulent wire instructions to members of our management in connection with an investment transaction. As a result, we initiated a wire transfer of approximately $464,000 to an account that was not owned by the intended recipient.

Following the incident, we promptly activated our response procedures, including notifying appropriate internal stakeholders (including our audit committee), engaging legal counsel and a third-party cybersecurity firm to support the investigation, and coordinating with relevant financial institutions and authorities. At that time, based on the information available, we determined that there had been no third-party access to our certain management member’s email account.

In December 2025, we identified and prevented a subsequent attempted fraud involving new, fraudulent wire instructions in connection with a payment to a supplier. Following this second incident and additional investigation, we determined that there had, in fact, been unauthorized access to certain member of our management’s email account, including the utilization of unauthorized mail-forwarding rules. We remediated and re-secured the impacted email account, including removal of unauthorized mail-forwarding rules, and implemented additional safeguards intended to reduce the risk of recurrence. We also engaged U.S. external counsel with expertise in this area to facilitate outreach to, and support an investigation by the FBI.

The incident did not have a material impact on our business, financial condition or results of operations as of the date of this annual report; however, we may incur additional costs in connection with the investigation, remediation efforts and any related recovery actions.

Following the October incident, we implemented a new transfer policy and controls intended to reduce the risk of recurrence, including (i) requiring out-of-band verification initiated by us (and, as appropriate, video confirmation) for any change to wire instructions, (ii) reviewing and reconfirming existing supplier wire instructions, and (iii) requesting our bank to require telephonic confirmation from us prior to executing wire transfers. Following the December incident, we also remediated and re-secured the impacted email account, including removal of unauthorized mail-forwarding rules, and we identified and prevented subsequent attempted fraudulent transfer requests.