Disclosure · Form 10-K · fiscal 2025
Axogen, Inc. 10-K cybersecurity disclosure (Item 1C), fiscal 2025
Filed February 24, 2026· period ended December 31, 2025· AXGN· CIK 805928· Updated · filing on sec.gov ↗
Axogen, Inc.'s Form 10-K for fiscal 2025, filed February 24, 2026, names the Vice President of Information Technology as its top security role, with oversight by the Audit Committee.
What Axogen's Item 1C says
Axogen's Form 10-K for fiscal 2025 places oversight of the effectiveness of cybersecurity risk management with the Board, in coordination with the Audit Committee. The Vice President of Information Technology is the member of management principally responsible for overseeing the cybersecurity risk management program.
Board and management oversight
The Board and the Audit Committee each receive regular presentations and reports on cybersecurity risks. The Board and the Audit Committee also receive prompt and timely information on any cybersecurity incident that meets established reporting thresholds, along with ongoing updates until it has been addressed. On a regular basis, the Board and the Audit Committee discuss the approach to cybersecurity risk management with the cyber team and senior leadership team. The Audit Committee supports the Board's oversight and regularly interacts with the Vice President of Information Technology and other members of the cyber team and management.
Who leads security
The Vice President of Information Technology works in coordination with senior leadership, which includes the Chief Executive Officer, Chief Financial Officer, and General Counsel. The Vice President of Information Technology has served in various roles in information technology and information security for over 20 years across a number of public and private organizations. The Vice President of Information Technology holds a bachelor's degree in management, information systems and accounting from Case Western Reserve University.
How the company manages cyber risk
The company integrates its cybersecurity policies, standards and practices into its enterprise risk management approach. The company's cybersecurity standards and practices align with frameworks established by the Center for Internet Security. The company provides periodic training for personnel regarding cybersecurity threats. The company maintains incident response and recovery plans, and such plans are tested and evaluated periodically. The company manages cybersecurity risks through the assessment and testing of its processes and practices.
Third parties and incidents
The company engages third parties as appropriate to perform assessments of its cybersecurity measures. The company endeavors to identify and oversee cybersecurity risks presented by third parties. The Vice President of Information Technology and senior leadership monitor cybersecurity incidents in real time and report such incidents to the Audit Committee when appropriate. The filing states that cybersecurity threats resulting from previous incidents have not materially affected the company, including its business strategy, results of operations or financial condition.
What the section does not state
The section does not name the person who holds the top security role.
Read from the Form 10-K filed February 24, 2026, on . Every sentence rests on a passage of the section reproduced below.
The filing's fields, each with its sentence
Who leads security (the top role, as the filing names it)
Vice President of Information Technology
Reports to
not identified
Board oversight
Audit Committee
“The Board's oversight over the effectiveness of our cybersecurity risk management is supported by the Audit Committee, which regularly interacts with our Vice President of Information Technology and other members of the cyber team and management.”
CISO or other person named
not identified
Frameworks and standards named
CIS Controls
Where the filing names it
- CIS Controls: “Our cybersecurity standards and practices follow industry trends, which align with frameworks established by the Center for Internet Security.”
Outside assessors, consultants or testers
not identified
Experience of the security leadership, as stated
Stated
“Our Vice President of Information Technology has served in various roles in information technology and information security for over 20 years across a number of public and private organizations including Ernst & Young, Sherwin-Williams, Eaton, TriMas Corporation and Evergen (formerly RTI Surgical).”
Material incident
The filing states none
“Cybersecurity threats, resulting from any previous cybersecurity incidents, have not materially affected or are not reasonably likely to affect us, including our business strategy, results of operations, or financial condition.”
The section
972 words, Form 10-K filed February 24, 2026 for the period ended December 31, 2025
Read by claude-sonnet-5-5 on October 26, 2026; every quote verified in the stored text by code.
How peers in the same industry describe the seat
The SEC assigns Axogen, Inc. standard industrial classification 3845, Electromedical & electrotherapeutic apparatus (SEC SIC list). 5 other filers in our library have the same code.
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| Adm Tronics Unlimited, Inc.FY 2026, filed July 10, 2026 | CSO | not identified | full board |
| CapsoVision, IncFY 2025, filed March 26, 2026 | Senior Director of Information Technology | not identified | Audit Committee |
| Nuwellis, Inc.FY 2025, filed March 11, 2026 | Director of Operations | board of directors | Audit Committee |
| Outset Medical, Inc.FY 2025, filed February 13, 2026 | VP of Information Technology | not identified | Audit Committee |
| Non Invasive Monitoring Systems IncFY 2025, filed January 30, 2026 | not identified | not identified | full board |
Item 1C, verbatim from the filing
The text below is the Cybersecurity item of Axogen, Inc.'s Form 10-K as filed with the SEC on February 24, 2026, reproduced word for word from the filing on sec.gov. Page numbers and navigation lines have been removed; nothing has been added. It describes governance as of that date.
ITEM 1C. CYBERSECURITY
Cybersecurity represents an important component of our overall approach to risk management. Our cybersecurity policies, standards and practices are integrated into our enterprise risk management approach, and cybersecurity risks are one of the enterprise risks that are subject to oversight by our Board. Our cybersecurity standards and practices follow industry trends, which align with frameworks established by the Center for Internet Security. We approach cybersecurity threats through a cross-functional strategy which endeavors to: (i) identify, prevent and mitigate cybersecurity threats to us; (ii) preserve the confidentiality, security and availability of the information that we collect and store to use in our business; (iii) protect our IP; (iv) maintain the confidence of our customers, clients and business partners; and (v) provide appropriate public disclosure of cybersecurity risks and incidents when required.
Risk Management and Strategy
Our cybersecurity program focuses on the following areas:
a. Vigilance: We maintain cybersecurity threat operations with the goal of identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with our established incident response and recovery plans.
b. Systems Safeguards: We deploy system safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through ongoing vulnerability assessments and cybersecurity threat intelligence.
c. Collaboration: We utilize collaboration mechanisms established with public and private entities, including intelligence and enforcement agencies, industry groups and third-party service providers, to identify, assess and respond to cybersecurity risks.
d. Third-Party Risk Management : We endeavor to identify and oversee cybersecurity risks presented by third parties, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.
e. Training: We provide periodic training for personnel regarding cybersecurity threats, which reinforces our information security policies, standards and practices.
f. Incident Response and Recovery Planning: We have established and maintain incident response and recovery plans that address our response to a cybersecurity incident and the recovery from a cybersecurity incident, and such plans are tested and evaluated periodically.
Axogen, Inc.
g. Communication, Coordination and Disclosure: We utilize a cross-functional strategy to address the risk from cybersecurity threats, involving management personnel from our technology, operations, legal, risk management and other key business functions, as well as the members of the Board and the Audit Committee of the Board in an ongoing dialogue regarding cybersecurity threats and incidents, while also implementing controls and procedures for the escalation of cybersecurity incidents pursuant to established thresholds so that decisions regarding the disclosure and reporting of such incidents can be made by management in a timely manner.
h. Governance: The Board's oversight over the effectiveness of our cybersecurity risk management is supported by the Audit Committee, which regularly interacts with our Vice President of Information Technology and other members of the cyber team and management.
We manage risks from cybersecurity threats through the assessment and testing of our processes and practices focused on evaluating the effectiveness of our cybersecurity measures. We engage third parties as appropriate to perform assessments of our cybersecurity measures. The results of such assessments and reviews are reported to the Audit Committee and the Board, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by the assessments, audits and reviews.
Governance
The Board, in coordination with the Audit Committee, oversees the effectiveness of management of risks from cybersecurity threats, including the policies, standards, processes and practices that our management implements to address risks from cybersecurity threats. The Board and the Audit Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party reviews, the threat environment, technological trends and information security considerations arising with respect to our peers. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding such incident until it has been addressed. On a regular basis, the Board and the Audit Committee discuss our approach to cybersecurity risk management with our cyber team and senior leadership team.
Our Vice President of Information Technology is the member of our management team that is principally responsible for overseeing our cybersecurity risk management program, in partnership with other business leaders across the Company. The Vice President of Information Technology works in coordination with senior leadership, which includes our Chief Executive Officer, Chief Financial Officer, and General Counsel. Our Vice President of Information Technology has served in various roles in information technology and information security for over 20 years across a number of public and private organizations including Ernst & Young, Sherwin-Williams, Eaton, TriMas Corporation and Evergen (formerly RTI Surgical). The Vice President of Information Technology holds a bachelor's degree in management, information systems and accounting from Case Western Reserve University.
Our Vice President of Information Technology in coordination with senior leadership, works collaboratively across the Company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. To facilitate the success of this program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with our policy as it relates to the incident, management response and recovery plan. Through the ongoing communications from these teams, the Vice President of Information Technology and senior leadership monitor the prevention, detection, mitigation and remediation of cybersecurity incidents in real time, and report such incidents to the Audit Committee when appropriate.
Cybersecurity threats, resulting from any previous cybersecurity incidents, have not materially affected or are not reasonably likely to affect us, including our business strategy, results of operations, or financial condition.
Axogen, Inc.
Earlier filings on record
Fiscal 2024 Form 10-K, filed February 26, 2025 sec.gov ↗
Top security role, as the filing names it
Vice President of Information Technology, Security and Business Intelligence
Reports to, as the filing names it
not identified
Board oversight
Audit Committee
“The Board's oversight over the effectiveness of the Company's cybersecurity risk management is supported by the Audit Committee, which regularly interacts with the Company's Vice President of Information Technology, Security and Business Intelligence and other members of the cyber team and management.”
Person named in the filing
not identified
Experience, as stated
Stated
“The Company's Vice President of Information Technology, Security and Business Intelligence has served in various roles in information technology and information security for over 18 years, including Biogen, AstraZeneca, Iron Mountain, and consulting roles at Charles River Labs, Sunovion Pharmaceuticals, Agero and DentaQuest.”
Material incident
The filing states none
“Cybersecurity threats, resulting from any previous cybersecurity incidents, have not materially affected or are not reasonably likely to affect the Company, including its business strategy, results of operations, or financial condition.”
Read by claude-sonnet-5-5 on October 26, 2026; every quote verified in the stored text by code.
ITEM 1C. CYBERSECURITY
Cybersecurity represents an important component of the Company's overall approach to risk management. The Company's cybersecurity policies, standards and practices are integrated into the Company's enterprise risk management approach, and cybersecurity risks are one of the enterprise risks that are subject to oversight by the Company's Board of Directors (the "Board"). The Company's cybersecurity standards and practices follow industry trends, which align with frameworks established by the Center for Internet Security. The Company approaches cybersecurity threats through a cross-functional approach which endeavors to: (i) identify, prevent and mitigate cybersecurity threats to the Company; (ii) preserve the
P58
Table of Conten t
confidentiality, security and availability of the information that we collect and store to use in our business; (iii) protecting the Company's IP; (iv) maintaining the confidence of our customers, clients and business partners; and (v) providing appropriate public disclosure of cybersecurity risks and incidents when required.
Risk Management and Strategy
The Company's cybersecurity program focuses on the following areas:
a. Vigilance: The Company maintains cybersecurity threat operations with the goal of identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with our established incident response and recovery plans.
b. Systems Safeguards: The Company deploys system safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through ongoing vulnerability assessments and cybersecurity threat intelligence.
c. Collaboration: The Company utilizes collaboration mechanisms established with public and private entities, including intelligence and enforcement agencies, industry groups and third-party service providers, to identify, assess and respond to cybersecurity risks.
d. Third-Party Risk Management : The Company endeavors to identify and oversee cybersecurity risks presented by third parties, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.
e. Training: The Company provides periodic training for personnel regarding cybersecurity threats, which reinforces the Company's information security policies, standards and practices.
f. Incident Response and Recovery Planning: The Company has established and maintains incident response and recovery plans that address the Company's response to a cybersecurity incident and the recovery from a cybersecurity incident, and such plans are tested and evaluated periodically.
g. Communication, Coordination and Disclosure: The Company utilizes a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from the Company's technology, operations, legal, risk management and other key business functions, as well as the members of the Board and the Audit Committee of the Board in an ongoing dialogue regarding cybersecurity threats and incidents, while also implementing controls and procedures for the escalation of cybersecurity incidents pursuant to established thresholds so that decisions regarding the disclosure and reporting of such incidents can be made by management in a timely manner.
h. Governance: The Board's oversight over the effectiveness of the Company's cybersecurity risk management is supported by the Audit Committee, which regularly interacts with the Company's Vice President of Information Technology, Security and Business Intelligence and other members of the cyber team and management.
The Company manages risks from cybersecurity threats through the assessment and testing of the Company's processes and practices focused on evaluating the effectiveness of our cybersecurity measures. The Company engages third parties as appropriate to perform assessments of our cybersecurity measures. The results of such assessments and reviews are reported to the Audit Committee and the Board, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by the assessments, audits and reviews.
Governance
The Board, in coordination with the Audit Committee, oversees the effectiveness of management of risks from cybersecurity threats, including the policies, standards, processes and practices that the Company's management implements to address risks from cybersecurity threats. The Board and the Audit Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding such incident until it has been addressed. On a regular basis, the Board and the Audit Committee discuss the Company's approach to cybersecurity risk management with the Company's cyber team and senior leadership team.
P59
Table of Conten t
The Company's Vice President of Information Technology, Security and Business Intelligence is the member of the Company's management that is principally responsible for overseeing the Company's cybersecurity risk management program, in partnership with other business leaders across the Company. The Vice President of Information Technology, Security and Business Intelligence works in coordination with senior leadership, which includes our Chief Executive Officer, Chief Financial Officer, and General Counsel. The Company's Vice President of Information Technology, Security and Business Intelligence has served in various roles in information technology and information security for over 18 years, including Biogen, AstraZeneca, Iron Mountain, and consulting roles at Charles River Labs, Sunovion Pharmaceuticals, Agero and DentaQuest. The Vice President of Information Technology, Security and Business Intelligence holds a master's degree in business administration from Boston University, a master's degree in electrical and computer engineering from Utah State University, and a bachelor's degree in electronics engineering from Mumbai University. The Company's Information Technology team has specific professional certifications and has over 10 years of experience with managing risks arising from cybersecurity threats.
The Company's Vice President of Information Technology, Security and Business Intelligence, in coordination with senior leadership, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. To facilitate the success of this program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with the Company's policy as it relates to the incident, management response and recovery plan . Through the ongoing communications from these teams, the Vice President of Information Technology, Security and Business Intelligence and senior leadership monitor the prevention, detection, mitigation and remediation of cybersecurity incidents in real time, and report such incidents to the Audit Committee when appropriate.
Cybersecurity threats, resulting from any previous cybersecurity incidents, have not materially affected or are not reasonably likely to affect the Company, including its business strategy, results of operations, or financial condition.
P60
Table of Conten t
Fiscal 2023 Form 10-K, filed March 5, 2024 sec.gov ↗
Top security role, as the filing names it
VP of Information Technology, Security and Business Intelligence
Reports to, as the filing names it
not identified
Board oversight
Audit Committee
“The Board's oversight of cybersecurity risk management is supported by the Audit Committee, which regularly interacts with the the Company's VP of Information Technology, Security and Business Intelligence and other members of the cyber team and management.”
Person named in the filing
not identified
Experience, as stated
Stated
“The Company's VP of Information Technology, Security and Business Intelligence has served in various roles in information technology and information security for over 18 years, including Biogen, AstraZeneca, Iron Mountain, and consulting roles at Charles River Labs, Sunovion Pharmaceuticals, Agero and DentaQuest.”
Material incident
The filing states none
“Cybersecurity threats, resulting from any previous cybersecurity incidents, have not materially affected or are not reasonably likely to affect the Company, including its business strategy, results of operations, or financial condition.”
Read by claude-sonnet-5-5 on October 26, 2026; every quote verified in the stored text by code.
ITEM 1C. CYBERSECURITY
Cybersecurity represents an important component of the Company's overall approach to risk management. The Company's cybersecurity policies, standards and practices are integrated into the Company's enterprise risk management approach, and cybersecurity risks are one of the enterprise risks that are subject to oversight by the Company's Board of Directors (the "Board"). The Company's cybersecurity standards and practices follow industry trends, which align with frameworks established by the Center for Internet Security ("CIS"). The Company approaches cybersecurity threats through a cross-functional approach which endeavors to: (i) identify, prevent and mitigate cybersecurity threats to the Company; (ii) preserve
P59
Table of Conten t
the confidentiality, security and availability of the information that we collect and store to use in our business; (iii) protecting the Company's intellectual property; (iv) maintaining the confidence of our customers, clients and business partners; and (v) providing appropriate public disclosure of cybersecurity risks and incidents when required.
Risk Management and Strategy
The Company's cybersecurity program focuses on the following areas:
a. Vigilance: The Company maintains cybersecurity threat operations with the goal of identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with our established incident response and recovery plans.
b. Systems Safeguards: The Company deploys system safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through ongoing vulnerability assessments and cybersecurity threat intelligence.
c. Collaboration: The Company utilizes collaboration mechanisms established with public and private entities, including intelligence and enforcement agencies, industry groups and third-party service providers, to identify, assess and respond to cybersecurity risks.
d. Third-Party Risk Management: The Company endeavors to identify and oversee cybersecurity risks presented by third parties, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.
e. Training: The Company provides periodic training for personnel regarding cybersecurity threats, which reinforces the Company's information security policies, standards and practices.
f. Incident Response and Recovery Planning: The Company has established and maintains incident response and recovery plans that address the Company's response to a cybersecurity incident and the recovery from a cybersecurity incident, and such plans are tested and evaluated periodically.
g. Communication, Coordination and Disclosure: The Company utilizes a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from the Company's technology, operations, legal, risk management and other key business functions, as well as the members of the Board and the Audit Committee of the Board in an ongoing dialogue regarding cybersecurity threats and incidents, while also implementing controls and procedures for the escalation of cybersecurity incidents pursuant to established thresholds so that decisions regarding the disclosure and reporting of such incidents can be made by management in a timely manner.
h. Governance: The Board's oversight of cybersecurity risk management is supported by the Audit Committee, which regularly interacts with the the Company's VP of Information Technology, Security and Business Intelligence and other members of the cyber team and management.
The Company manages risks from cybersecurity threats through the assessment and testing of the Company's processes and practices focused on evaluating the effectiveness of our cybersecurity measures. The Company engages third parties as appropriate to perform assessments of our cybersecurity measures. The results of such assessments and reviews are reported to the Audit Committee and the Board, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by the assessments, audits and reviews.
Governance
The Board, in coordination with the Audit Committee, oversees the management of risks from cybersecurity threats, including the policies, standards, processes and practices that the Company's management implements to address risks from cybersecurity threats. The Board and the Audit Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding such incident until it has been addressed. On a regular basis, the Board and the Audit Committee discuss the Company's approach to cybersecurity risk management with the Company's cyber team and senior leadership team.
P60
Table of Conten t
The Company's VP of Information Technology, Security and Business Intelligence is the member of the Company's management that is principally responsible for overseeing the Company's cybersecurity risk management program, in partnership with other business leaders across the Company. The VP of Information Technology, Security and Business Intelligence works in coordination with senior leadership, which includes our Chief Executive Officer, Chief Financial Officer, and General Counsel. The Company's VP of Information Technology, Security and Business Intelligence has served in various roles in information technology and information security for over 18 years, including Biogen, AstraZeneca, Iron Mountain, and consulting roles at Charles River Labs, Sunovion Pharmaceuticals, Agero and DentaQuest. The VP of Information Technology, Security and Business Intelligence holds a MBA from Boston University, a Master's degree in Electrical and Computer Engineering from Utah State University, and a Bachelor's degree in Electronics Engineering from Mumbai University. The Company's Information Technology team has specific professional certifications, and has over 10 years of experience with managing risks arising from cybersecurity threats.
The Company's VP of Information Technology, Security and Business Intelligence, in coordination with senior leadership, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. To facilitate the success of this program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with the Company's policy as it relates to the incident, management response and recovery plan . Through the ongoing communications from these teams, the VP of Information Technology, Security and Business Intelligence and senior leadership monitor the prevention, detection, mitigation and remediation of cybersecurity incidents in real time, and report such incidents to the Audit Committee when appropriate.
Cybersecurity threats, resulting from any previous cybersecurity incidents, have not materially affected or are not reasonably likely to affect the Company, including its business strategy, results of operations, or financial condition.
P61
Table of Conten t
The fields above are exact quotes from the stored text. "Not identified" means no supporting sentence was found, not that the company has no such arrangement. A name in a filing is not a record of who holds the seat today: the Wire tracks that.
Browse the whole library at /disclosures, or see who the top security role reports to, by sector. Cite as "CISO Tribune, 10-K cybersecurity governance disclosures" with a link.