XML 34 R11.htm IDEA: XBRL DOCUMENT v3.25.4
Cybersecurity Risk Management, Strategy, and Governance
12 Months Ended
Dec. 31, 2025
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]

Item 1C. Cybersecurity

 

Cyber Risk Management and Strategy

Kymera uses, stores and processes data for and about our research programs, clinical trials, employees, and suppliers. We have developed and maintain an information security program designed to assess, identify, and manage risks from cybersecurity threats, including to our data and systems. We conduct periodic assessments of our assets, including internal and external security testing, as part of our risk management process and to evaluate the effectiveness of applicable security controls. These assessments are informed by industry standards. Our cybersecurity risk management process is a part of our overall risk management program. We also have an employee education program that includes training designed to raise awareness of cybersecurity threats. We have adopted an Incident Response Policy that outlines the legal and governance process for identifying and managing material cyber risks to our information and information systems and our framework for assessing and responding to cyber incidents, as applicable.

Although risks from cybersecurity threats have to date not materially affected, and we do not believe they are reasonably likely to materially affect, us, our business strategy, results of operations or financial condition, we could, from time to time, experience threats and communicate security incidents relating to our and our third-party vendors’ information systems. For more information, please see Item 1A- Risk Factors.

Governance Related to Cybersecurity Risks

Under the ultimate direction of the Chief Executive Officer (CEO) and our executive management team, the Cybersecurity Supervisory Committee (CSSC) has primary responsibility for overseeing our management of cybersecurity risks. Members of the CSSC include the Chief Financial Officer (CFO); the Chief Legal Officer (CLO); and the Head of Information Technology (IT). Additional members of the ET may be asked to support specific incidents as deemed appropriate by the CSSC. The CSSC meets as circumstances warrant to review and update incident response procedures and to provide oversight of incident response activities of the Cyber Security Incident Response Team.

The head of information technology and the CSSC have primary responsibility for assessing and managing our cybersecurity program. The head of information technology, who reports to the Chief Financial Officer, has more than 25 years of experience in building and leading information technology and security teams.

The board of directors has ultimate oversight of our risk management program and has delegated oversight of that program, including, oversight of cybersecurity, to the audit committee of the board of directors. The head of Information Technology presents to the audit committee periodically regarding cybersecurity matters. The CFO and the CLO, in partnership with the CEO, are responsible for informing the audit committee in the event of any material cybersecurity incidents and any potential disclosure obligations arising from such incidents.

Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block]

The board of directors has ultimate oversight of our risk management program and has delegated oversight of that program, including, oversight of cybersecurity, to the audit committee of the board of directors. The head of Information Technology presents to the audit committee periodically regarding cybersecurity matters. The CFO and the CLO, in partnership with the CEO, are responsible for informing the audit committee in the event of any material cybersecurity incidents and any potential disclosure obligations arising from such incidents.

Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block]

Under the ultimate direction of the Chief Executive Officer (CEO) and our executive management team, the Cybersecurity Supervisory Committee (CSSC) has primary responsibility for overseeing our management of cybersecurity risks. Members of the CSSC include the Chief Financial Officer (CFO); the Chief Legal Officer (CLO); and the Head of Information Technology (IT). Additional members of the ET may be asked to support specific incidents as deemed appropriate by the CSSC. The CSSC meets as circumstances warrant to review and update incident response procedures and to provide oversight of incident response activities of the Cyber Security Incident Response Team.

Cybersecurity Risk Role of Management [Text Block]

Under the ultimate direction of the Chief Executive Officer (CEO) and our executive management team, the Cybersecurity Supervisory Committee (CSSC) has primary responsibility for overseeing our management of cybersecurity risks. Members of the CSSC include the Chief Financial Officer (CFO); the Chief Legal Officer (CLO); and the Head of Information Technology (IT). Additional members of the ET may be asked to support specific incidents as deemed appropriate by the CSSC. The CSSC meets as circumstances warrant to review and update incident response procedures and to provide oversight of incident response activities of the Cyber Security Incident Response Team.

The head of information technology and the CSSC have primary responsibility for assessing and managing our cybersecurity program. The head of information technology, who reports to the Chief Financial Officer, has more than 25 years of experience in building and leading information technology and security teams.

The board of directors has ultimate oversight of our risk management program and has delegated oversight of that program, including, oversight of cybersecurity, to the audit committee of the board of directors. The head of Information Technology presents to the audit committee periodically regarding cybersecurity matters. The CFO and the CLO, in partnership with the CEO, are responsible for informing the audit committee in the event of any material cybersecurity incidents and any potential disclosure obligations arising from such incidents.

Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] The CFO and the CLO, in partnership with the CEO, are responsible for informing the audit committee
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] The head of information technology, who reports to the Chief Financial Officer, has more than 25 years of experience in building and leading information technology and security teams.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] he head of Information Technology presents to the audit committee periodically regarding cybersecurity matters. The CFO and the CLO, in partnership with the CEO, are responsible for informing the audit committee in the event of any material cybersecurity incidents and any potential disclosure obligations arising from such incidents.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true