Disclosure · Form 10-K · fiscal 2026
Avai Bio, Inc. 10-K cybersecurity disclosure (Item 1C), fiscal 2026
Filed July 14, 2026· period ended March 31, 2026· AVAI· CIK 1740797· Updated · filing on sec.gov ↗
Avai Bio, Inc.'s Form 10-K for fiscal 2026, filed July 14, 2026, places oversight of cybersecurity risk with the full board; a top security role title is not identified.
What Avai Bio's Item 1C says
Avai Bio's Form 10-K for fiscal 2026 states that the company should have a formal risk management program that addresses cybersecurity and data privacy risks. The filing states that this program should include regular reporting to senior management and the Board of Directors, who provide oversight and direction.
How the company manages cyber risk
The company maintains an incident response plan that includes policies and procedures for notifying affected third parties and complying with applicable laws. The company states that it has not established an enterprise risk management framework to assess and prioritize these risks.
Third parties and incidents
The company states that during the last fiscal year it did not experience cybersecurity incidents.
What the section does not state
The section does not name the person who holds the top security role. The section does not say who the top security role reports to.
Read from the Form 10-K filed July 14, 2026, on . Every sentence rests on a passage of the section reproduced below.
The filing's fields, each with its sentence
Who leads security (the top role, as the filing names it)
not identified
Reports to
not identified
Board oversight
Full board
“This program should include regular reporting to our senior management and Board of Directors, who provide oversight and direction.”
CISO or other person named
not identified
Frameworks and standards named
not identified
Outside assessors, consultants or testers
not identified
Experience of the security leadership, as stated
not identified
Material incident
The filing states none
“During the last fiscal year, we did not experienced cybersecurity incidents.”
The section
297 words, Form 10-K filed July 14, 2026 for the period ended March 31, 2026
Read by claude-sonnet-5-5 on November 11, 2026; every quote verified in the stored text by code.
How peers in the same industry describe the seat
The SEC assigns Avai Bio, Inc. standard industrial classification 7374, Services-computer processing & data preparation (SEC SIC list). 8 other filers in our library have the same code.
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| ReposiTrak, Inc.FY 2026, filed September 28, 2026 | not identified | not identified | Audit Committee |
| 8x8, Inc.FY 2026, filed May 22, 2026 | Chief Information Security Officer | Chief Legal Officer | Technology & Cybersecurity Committee |
| DXC TechnologyFY 2026, filed May 8, 2026 | Global Chief Information Security Officer | President of Global Infrastructure Services | Nominating/Corporate Governance Committee |
| Gloo Holdings, Inc.FY 2026, filed April 15, 2026 | Director of Security & Information Technology | not identified | Audit Committee |
| Veritone, Inc.FY 2025, filed April 15, 2026 | Chief Information Security Officer | not identified | full board |
| Ooma IncFY 2026, filed April 3, 2026 | Chief Information Security Officer | not identified | full board |
| Powerdyne International, Inc.FY 2025, filed April 3, 2026 | Chief Executive Officer | not identified | full board |
| Corvex, Inc.FY 2025, filed March 31, 2026 | Vice President of Engineering | CEO | full board |
Item 1C, verbatim from the filing
The text below is the Cybersecurity item of Avai Bio, Inc.'s Form 10-K as filed with the SEC on July 14, 2026, reproduced word for word from the filing on sec.gov. Page numbers and navigation lines have been removed; nothing has been added. It describes governance as of that date.
Item 1C. Cybersecurity.
Cybersecurity and Data Privacy Risks
We are subject to cybersecurity and data privacy risks.
Cyberattacks and security vulnerabilities could lead to increased costs, liability claims, or harm to our competitive position.
Cybersecurity Risks
Our operations and the operations of our and partners
involve the storage, transmission, and processing of third parties' and our data, including personal, confidential, or proprietary
information. This data is subject to privacy and security laws, regulations, and customer-imposed controls. Cybercriminals use a variety
of methods to exploit potential vulnerabilities in our systems, products, and services. Sophisticated attacks could result in unauthorized
access, loss, misuse, disclosure, modification, or destruction of this data. We are committed to protecting our third parties' and
our data. Despite efforts, our systems, products, and services remain vulnerable to attacks.
Data Privacy
Data privacy issues are becoming increasingly significant
due to the rapidly changing legal and regulatory landscape. Compliance with global and local data privacy laws requires ongoing investment
in our information technology and employee training, and will continue to impact our business.
Governance and Oversight
We should have a formal risk management program that
addresses cybersecurity and data privacy risks. This program should include regular reporting to our senior management and Board of Directors,
who provide oversight and direction. We have not established an enterprise risk management framework to assess and prioritize these risks.
Incident Response
We maintain an incident response plan that includes
policies and procedures for notifying affected third parties and complying with applicable laws.
Investments in Cybersecurity
We will continually invest in our cybersecurity capabilities
to protect our assets and those of our third parties. This potentially will include investment in advanced threat detection, encryption,
and other security measures.
Recent Cybersecurity Incidents
During the last fiscal year, we did not experienced
cybersecurity incidents.
Earlier filings on record
Fiscal 2025 Form 10-K, filed July 8, 2025 sec.gov ↗
Top security role, as the filing names it
not identified
Reports to, as the filing names it
not identified
Board oversight
not identified
Person named in the filing
not identified
Experience, as stated
not identified
Material incident
The filing states none
“During the last fiscal year, we did not experienced cybersecurity incidents.”
Read by claude-sonnet-5-5 on November 11, 2026; every quote verified in the stored text by code.
Item 1C. Cybersecurity.
Cybersecurity and Data Privacy Risks
We are subject to cybersecurity and data privacy risks.
Cyberattacks and security vulnerabilities could lead to increased costs, liability claims, or harm to our competitive position.
Cybersecurity Risks
Our operations and the operations of our and partners
involve the storage, transmission, and processing of third parties' and our data, including personal, confidential, or proprietary
information. This data is subject to privacy and security laws, regulations, and customer-imposed controls. Cybercriminals use a variety
of methods to exploit potential vulnerabilities in our systems, products, and services. Sophisticated attacks could result in unauthorized
access, loss, misuse, disclosure, modification, or destruction of this data. We are committed to protecting our third parties' and
our data. Despite efforts, our systems, products, and services remain vulnerable to attacks.
Data Privacy
Data privacy issues are becoming increasingly significant
due to the rapidly changing legal and regulatory landscape. Compliance with global and local data privacy laws requires ongoing investment
in our information technology and employee training, and will continue to impact our business.
Governance and Oversight
We should have a formal risk management program that
addresses cybersecurity and data privacy risks. This program should include regular reporting to our senior management and Board of Directors,
who provide oversight and direction. We have not established an enterprise risk management framework to assess and prioritize these risks.
Incident Response
We maintain an incident response plan that includes
policies and procedures for notifying affected third parties and complying with applicable laws.
Investments in Cybersecurity
We will continually invest in our cybersecurity capabilities
to protect our assets and those of our third parties. This potentially will include investment in advanced threat detection, encryption,
and other security measures.
Recent Cybersecurity Incidents
During the last fiscal year, we did not experienced
cybersecurity incidents.
Fiscal 2024 Form 10-K/A, filed February 19, 2025 sec.gov ↗
Top security role, as the filing names it
not identified
Reports to, as the filing names it
not identified
Board oversight
Full board
“This program should include regular reporting to our senior management and Board of Directors, who provide oversight and direction.”
Person named in the filing
not identified
Experience, as stated
not identified
Material incident
The filing states none
“During the last fiscal year, we did not experienced cybersecurity incidents.”
Read by claude-sonnet-5-5 on November 11, 2026; every quote verified in the stored text by code.
Item 1C. Cybersecurity
Cybersecurity and Data Privacy Risks
We are subject to cybersecurity and data privacy risks. Cyberattacks and
security vulnerabilities could lead to increased costs, liability claims, or harm to our competitive position.
Cybersecurity Risks
Our operations and the operations of our and partners involve the storage,
transmission, and processing of third parties' and our data, including personal, confidential, or proprietary information. This
data is subject to privacy and security laws, regulations, and customer-imposed controls. Cybercriminals use a variety of methods to exploit
potential vulnerabilities in our systems, products, and services. Sophisticated attacks could result in unauthorized access, loss, misuse,
disclosure, modification, or destruction of this data.
We are committed to protecting our third parties' and our data. Despite
efforts, our systems, products, and services remain vulnerable to attacks.
Data Privacy
Data privacy issues are becoming increasingly significant due to the rapidly
changing legal and regulatory landscape. Compliance with global and local data privacy laws requires ongoing investment in our information
technology and employee training, and will continue to impact our business.
Governance and Oversight
We should have a formal risk management program that addresses cybersecurity
and data privacy risks. This program should include regular reporting to our senior management and Board of Directors, who provide oversight
and direction. We have not established an enterprise risk management framework to assess and prioritize these risks.
Incident Response
We maintain an incident response plan that includes policies and procedures
for notifying affected third parties and complying with applicable laws.
Investments in Cybersecurity
We will continually invest in our cybersecurity capabilities to protect
our assets and those of our third parties. This potentially will include investment in advanced threat detection, encryption, and other
security measures.
Recent Cybersecurity Incidents
During the last fiscal year, we did not experienced cybersecurity incidents.
The fields above are exact quotes from the stored text. "Not identified" means no supporting sentence was found, not that the company has no such arrangement. A name in a filing is not a record of who holds the seat today: the Wire tracks that.
Browse the whole library at /disclosures, or see who the top security role reports to, by sector. Cite as "CISO Tribune, 10-K cybersecurity governance disclosures" with a link.