Disclosure · Form 10-K · fiscal 2025
Vivos Therapeutics, Inc. 10-K cybersecurity disclosure (Item 1C), fiscal 2025
Filed April 15, 2026· period ended December 31, 2025· VVOS· CIK 1716166· Updated · filing on sec.gov ↗
Vivos Therapeutics, Inc.'s Form 10-K for fiscal 2025, filed April 15, 2026, names the Senior Vice President of Technology as its top security role, reporting to the Chief Financial Officer, with oversight by the full board.
What Vivos Therapeutics' Item 1C says
Vivos Therapeutics' Form 10-K for fiscal 2025 states that management keeps the board of directors periodically informed of cybersecurity matters, though no matters have required escalation to the board.
Board and management oversight
Matters that present potential material impacts to financial results, operations or reputation would be reported by the Senior Vice President of Technology to the Chief Financial Officer. The company has procedures to ensure that management responsible for overseeing disclosure controls are informed in a timely manner of known cybersecurity risks and incidents that may materially impact operations.
How the company manages cyber risk
The company has incorporated processes to manage risks from cybersecurity threats into its overall risk assessment process. Employees go through cybersecurity awareness training as part of their onboarding procedures. If a threat is detected, the security system automatically notifies the internal information systems management team of all activities and ranks them by level of threat or deviation from normal behavior. The system will automatically take action to secure the system, up to and including blocking user accounts and access.
Third parties and incidents
The company has processes to oversee and identify material cybersecurity risks associated with its use of third-party service providers. As of the date of the report, no cybersecurity threats have materially affected or are reasonably likely to materially affect the business, operations or financial condition.
What the section does not state
The section does not name the person who holds the top security role. The section does not name a board committee as responsible for cybersecurity oversight. The section does not name a specific security framework or standard. The section does not say how often the board or its committee is briefed on cybersecurity.
Read from the Form 10-K filed April 15, 2026, on . Every sentence rests on a passage of the section reproduced below.
The filing's fields, each with its sentence
Who leads security (the top role, as the filing names it)
Senior Vice President of Technology
Reports to
Chief Financial Officer
“Matters determined to present potential material impacts to our financial results, operations, and/or reputation would immediately be reported by our Senior Vice President of Technology to our Chief Financial Officer and escalated, as appropriate, to our board of directors or individual members or committees thereof, in accordance with our escalation framework.”
Board oversight
Full board
“Given the lack of material cybersecurity incidents relating to our company, we have no t been required to escalate any matters to our board of directors, although management keeps the board of directors periodically informed of cybersecurity matters.”
CISO or other person named
not identified
Frameworks and standards named
not identified
Outside assessors, consultants or testers
not identified
Experience of the security leadership, as stated
not identified
Material incident
The filing states none
“As of the date of this Report, there have been no cybersecurity threats that have materially affected or are reasonably likely to materially affect our business, operations, or financial condition.”
The section
616 words, Form 10-K filed April 15, 2026 for the period ended December 31, 2025
Read by claude-sonnet-5-5 on November 13, 2026; every quote verified in the stored text by code.
How peers in the same industry describe the seat
The SEC assigns Vivos Therapeutics, Inc. standard industrial classification 3841, Surgical & medical instruments & apparatus (SEC SIC list). 8 other filers in our library have the same code.
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| PetVivo Holdings, Inc.FY 2026, filed June 29, 2026 | CFO | Board | Audit Committee |
| Autonomix Medical, Inc.FY 2026, filed May 27, 2026 | Chief Executive Officer and Chief Financial Officer | Audit Committee | Audit Committee |
| Vycor Medical IncFY 2025, filed March 31, 2026 | not identified | not identified | full board |
| PAVmed Inc.FY 2025, filed March 27, 2026 | not identified | not identified | audit committee |
| Retractable Technologies IncFY 2025, filed March 27, 2026 | Information Security Officer | Chief Financial Officer (CFO) | full board |
| Tenon Medical, Inc.FY 2025, filed March 27, 2026 | not identified | not identified | full board |
| enVVeno Medical CorpFY 2025, filed March 26, 2026 | Chief Financial Officer | not identified | Audit Committee |
| Lucid Diagnostics Inc.FY 2025, filed March 25, 2026 | Techneto, Inc. d/b/a CyberTeam | our president and chief operating officer | audit committee |
Item 1C, verbatim from the filing
The text below is the Cybersecurity item of Vivos Therapeutics, Inc.'s Form 10-K as filed with the SEC on April 15, 2026, reproduced word for word from the filing on sec.gov. Page numbers and navigation lines have been removed; nothing has been added. It describes governance as of that date.
Item
1C. Cybersecurity.
Risk
management and strategy
We
understand the importance of preventing, assessing, identifying, and managing material risks associated with cybersecurity threats. Processes
to manage risks from cybersecurity threats have been incorporated as a part of our overall risk assessment process. Our cybersecurity
risks include theft of business data, fraud or extortion, lack of access to our information systems, harm to employees, harm to business
partners, violation of privacy laws, potential reputational damage, and litigation or other legal risk if a cybersecurity incident were
to occur. It is difficult to assign a monetary materiality assessment to these risks or to the impact if we were to sustain a breach
of our systems. Our approach is based on the premise that any cybersecurity incident could result in material harm to our company.
- 60 -
We
utilize a seasoned and mature artificial intelligence-based security system that learns and monitors the actions of individuals that
have access to our networks and systems, including location of access (notably from international locations), email, and SAAS platforms
that we do not host. The system not only protects based off of the specific rules implemented, it also takes action based on user activity
(including remote access to our systems by our employees) that is outside their normal behavior pattern. Additionally, our employees
go through cybersecurity awareness training as part of their onboarding procedures.
If
a threat is detected, our system automatically notifies our internal information systems management (" ISM ") team of
all activities and ranks those activities based on their level of threat to the system and/or deviation of behavior from normal. Severe
threats notify the ISM team via text message, regardless of hours of operation. In addition to the notification, the system will automatically
take action to secure the system, up to and including blocking user accounts and access. The ISM team will then review the notification,
assess the action that was taken against the actual threat, and then clear the condition or take further action.
To
mitigate risk, we periodically evaluate and assess the threat landscape and our security controls, through assessments, regular network
and endpoint monitoring. We also have processes to oversee and identify material cybersecurity risks associated with our use of third-party
service providers, including performing diligence on certain third parties that have access to our systems, data or facilities that store
such systems or data, continually monitoring cybersecurity threat risks identified through such diligence
Under
our framework, cybersecurity issues, including those involving vulnerabilities introduced by our use of third-party software, are analyzed
by subject matter experts for potential financial, operational, and reputational risks, based on, among other factors, the nature of
the matter and breadth of impact.
As
of the date of this Report, there have been no cybersecurity threats that have materially affected or are reasonably likely to materially
affect our business, operations, or financial condition.
Governance
Matters
determined to present potential material impacts to our financial results, operations, and/or reputation would immediately be reported
by our Senior Vice President of Technology to our Chief Financial Officer and escalated, as appropriate, to our board of directors or
individual members or committees thereof, in accordance with our escalation framework. Given the lack of material cybersecurity incidents
relating to our company, we have no t been required to escalate any matters to our board of directors, although management keeps the board
of directors periodically informed of cybersecurity matters. In addition, we have established procedures to ensure that members of our
management responsible for overseeing the effectiveness of disclosure controls are informed in a timely manner of known cybersecurity
risks and incidents that may materially impact our operations and that timely public disclosure is made, as appropriate.
Earlier filings on record
Fiscal 2024 Form 10-K, filed March 31, 2025 sec.gov ↗
Top security role, as the filing names it
Senior Vice President of Technology
Reports to, as the filing names it
Chief Financial Officer
“Matters determined to present potential material impacts to our financial results, operations, and/or reputation would immediately be reported by our Senior Vice President of Technology to our Chief Financial Officer and escalated, as appropriate, to our board of directors or individual members or committees thereof, in accordance with our escalation framework.”
Board oversight
Full board
“Given the lack of material cybersecurity incidents relating to our company, we have not been required to escalate any matters to our board of directors, although management keeps the board of directors periodically informed of cybersecurity matters.”
Person named in the filing
not identified
Experience, as stated
not identified
Material incident
The filing states none
“As of the date of this Report, there have been no cybersecurity threats that have materially affected or are reasonably likely to materially affect our business, operations, or financial condition.”
Read by claude-sonnet-5-5 on November 13, 2026; every quote verified in the stored text by code.
Item
1C. Cybersecurity.
Risk
management and strategy
We
understand the importance of preventing, assessing, identifying, and managing material risks associated with cybersecurity threats. Processes
to manage risks from cybersecurity threats have been incorporated as a part of our overall risk assessment process. Our cybersecurity
risks include theft of business data, fraud or extortion, lack of access to our information systems, harm to employees, harm to business
partners, violation of privacy laws, potential reputational damage, and litigation or other legal risk if a cybersecurity incident were
to occur. It is difficult to assign a monetary materiality assessment to these risks or to the impact if we were to sustain a breach
of our systems. Our approach is based on the premise that any cybersecurity incident could result in material harm to our company.
We
utilize a seasoned and mature artificial intelligence-based security system that learns and monitors the actions of individuals that
have access to our networks and systems, including location of access (notably from international locations), email, and SAAS platforms
that we do not host. The system not only protects based off of the specific rules implemented, it also takes action based on user activity
(including remote access to our systems by our employees) that is outside their normal behavior pattern. Additionally, our employees
go through cybersecurity awareness training as part of their onboarding procedures.
If
a threat is detected, our system automatically notifies our internal information systems management ("ISM") team of all activities
and ranks those activities based on their level of threat to the system and/or deviation of behavior from normal. Severe threats notify
the ISM team via text message, regardless of hours of operation. In addition to the notification, the system will automatically take
action to secure the system, up to and including blocking user accounts and access. The ISM team will then review the notification, assess
the action that was taken against the actual threat, and then clear the condition or take further action.
To
mitigate risk, we periodically evaluate and assess the threat landscape and our security controls, through assessments, regular network
and endpoint monitoring. We also have processes to oversee and identify material cybersecurity risks associated with our use of third-party
service providers, including performing diligence on certain third parties that have access to our systems, data or facilities that store
such systems or data, continually monitoring cybersecurity threat risks identified through such diligence
- 50 -
Under
our framework, cybersecurity issues, including those involving vulnerabilities introduced by our use of third-party software, are analyzed
by subject matter experts for potential financial, operational, and reputational risks, based on, among other factors, the nature of
the matter and breadth of impact.
As
of the date of this Report, there have been no cybersecurity threats that have materially affected or are reasonably likely to materially
affect our business, operations, or financial condition.
Governance
Matters
determined to present potential material impacts to our financial results, operations, and/or reputation would immediately be reported
by our Senior Vice President of Technology to our Chief Financial Officer and escalated, as appropriate, to our board of directors or
individual members or committees thereof, in accordance with our escalation framework. Given the lack of material cybersecurity incidents
relating to our company, we have not been required to escalate any matters to our board of directors, although management keeps the board
of directors periodically informed of cybersecurity matters. In addition, we have established procedures to ensure that members of our
management responsible for overseeing the effectiveness of disclosure controls are informed in a timely manner of known cybersecurity
risks and incidents that may materially impact our operations and that timely public disclosure is made, as appropriate.
Fiscal 2023 Form 10-K, filed March 28, 2024 sec.gov ↗
Top security role, as the filing names it
Senior Vice President of Technology
Reports to, as the filing names it
Chief Financial Officer
“Matters determined to present potential material impacts to our financial results, operations, and/or reputation would immediately be reported by our Senior Vice President of Technology to our Chief Financial Officer and escalated, as appropriate, to our board of directors or individual members or committees thereof, in accordance with our escalation framework.”
Board oversight
Full board
“Given the lack of material cybersecurity incidents relating to our company, we have not been required to escalate any matters to our board of directors, although management keeps the board of directors periodically informed of cybersecurity matters.”
Person named in the filing
not identified
Experience, as stated
not identified
Material incident
The filing states none
“As of the date of this Report, there have been no cybersecurity threats that have materially affected or are reasonably likely to materially affect our business, operations, or financial condition.”
Read by claude-sonnet-5-5 on November 13, 2026; every quote verified in the stored text by code.
Item
1C. Cybersecurity.
Risk management and strategy
We understand the importance of preventing, assessing, identifying, and managing material risks associated with cybersecurity threats. Processes to manage risks from cybersecurity threats have been incorporated as a part of our overall risk assessment process. Our cybersecurity risks include theft of business data, fraud or extortion, lack of access to our information systems, harm to employees, harm to business partners, violation of privacy laws, potential reputational damage, and litigation or other legal risk if a cybersecurity incident were to occur. It is difficult to assign a monetary materiality assessment to these risks or to the impact if we were to sustain a breach of our systems. Our approach is based on the premise that any cybersecurity incident could result in material harm to our company.
We utilize a seasoned and mature artificial intelligence-based security system that learns and monitors the actions of individuals that have access to our networks and systems, including location of access (notably from international locations), email, and SAAS platforms that we don't host. The system not only protects based off of the specific rules implemented, it also takes action based on user activity (including remote access to our systems by our employees) that is outside their normal behavior pattern. Additionally, our employees go through cybersecurity awareness training as part of their onboarding procedures.
If a threat is detected, our system automatically notifies our internal information systems management ("ISM") team of all activities and ranks those activities based on their level of threat to the system and/or deviation of behavior from normal. Severe threats notify the ISM team via text message, regardless of hours of operation. In addition to the notification, the system will automatically take action to secure the system, up to and including blocking user accounts and access. The ISM team will then review the notification, assess the action that was taken against the actual threat, and then clear the condition or take further action.
To mitigate risk, we periodically evaluate and assess the threat landscape and our security controls, through assessments, regular network and endpoint monitoring. We also have processes to oversee and identify material cybersecurity risks associated with our use of third-party service providers, including performing diligence on certain third parties that have access to our systems, data or facilities that store such systems or data, continually monitoring cybersecurity threat risks identified through such diligence
Under our framework, cybersecurity
issues, including those involving vulnerabilities introduced by our use of third-party software, are analyzed by subject matter experts
for potential financial, operational, and reputational risks, based on, among other factors, the nature of the matter and breadth of impact.
As of the date of this Report, there
have been no cybersecurity threats that have materially affected or are reasonably likely to materially affect our business, operations,
or financial condition.
Governance
Matters
determined to present potential material impacts to our financial results, operations, and/or reputation would immediately be reported
by our Senior Vice President of Technology to our Chief Financial Officer and escalated, as appropriate, to our board of directors or
individual members or committees thereof, in accordance with our escalation framework. Given the lack of material cybersecurity incidents
relating to our company, we have not been required to escalate any matters to our board of directors, although management keeps the board
of directors periodically informed of cybersecurity matters. In addition, we have established procedures to ensure that members of our
management responsible for overseeing the effectiveness of disclosure controls are informed in a timely manner of known cybersecurity
risks and incidents that may materially impact our operations and that timely public disclosure is made, as appropriate.
The fields above are exact quotes from the stored text. "Not identified" means no supporting sentence was found, not that the company has no such arrangement. A name in a filing is not a record of who holds the seat today: the Wire tracks that.
Browse the whole library at /disclosures, or see who the top security role reports to, by sector. Cite as "CISO Tribune, 10-K cybersecurity governance disclosures" with a link.