XML 67 R41.htm IDEA: XBRL DOCUMENT v3.25.1
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
Risk management and strategy
 
We have not experienced any material cybersecurity incidents that have impacted our operations to date. However, like most companies, we are subject to frequent and evolving cybersecurity threats and attempted attacks from a range of sources, including opportunistic hackers, organised threat actors, and internal vulnerabilities.
 
To identify, assess, and mitigate cybersecurity risks, we have implemented a cybersecurity program covering the full scope of our information systems and data assets. This includes internally managed systems, cloud environments, third party-hosted infrastructure, and sensitive data such as intellectual property, clinical research information, strategic documents, personal data of employees and trial participants, and confidential commercial information, collectively referred to as our “Information Systems and Data.”
 
Our cybersecurity program is led by our Chief Information Officer (CIO), who has over 20 years of IT leadership experience, and is supported by an internal security function that collaborates with our broader risk management team. The CIO works across the organisation to ensure that cybersecurity is embedded within our operations and treated as a core business risk.
 
We use a variety of tools and practices to assess the cybersecurity threat landscape and evaluate our posture. These include internal and external vulnerability scans, threat intelligence feeds, cyber risk assessments, penetration testing conducted by third-party firms, and tabletop simulations to evaluate and improve our incident response readiness. We also monitor emerging regulatory developments and industry standards to ensure our practices remain aligned with evolving expectations.
 
To mitigate risks identified through these processes, we implement a combination of technical, administrative, and physical controls. These include next-generation firewalls, endpoint protection and antivirus software, multi-factor authentication, access control protocols, encryption of sensitive data, network segmentation, continuous system monitoring, secure configuration standards, data backup and recovery protocols, and security awareness training for all staff, including phishing simulations. Our cybersecurity practices are regularly reviewed and enhanced in response to changing threat dynamics.
 
Cybersecurity risk management is also extended to our third-party service providers, who perform a wide range of business-critical services including data hosting, software delivery, clinical research, supply chain management, distribution, and contract manufacturing. We assess the cybersecurity posture of key vendors through a combination of tools, such as security questionnaires, audits, analysis of certifications (e.g., ISO 27001, SOC 2), reviews of written security policies, and assessment of penetration test results. Where necessary, we engage in direct discussions with vendors' security teams to evaluate controls. We also impose contractual obligations related to cybersecurity and data protection, including confidentiality and breach notification requirements. These measures are designed to reduce the risk of vulnerabilities introduced through our supply chain or external partners.
 
Cybersecurity risks are addressed through our overall approach to operational and strategic risk management. Key risks are discussed at senior management level and prioritised based on their potential to affect our systems, data, or business continuity.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block]
To identify, assess, and mitigate cybersecurity risks, we have implemented a cybersecurity program covering the full scope of our information systems and data assets. This includes internally managed systems, cloud environments, third party-hosted infrastructure, and sensitive data such as intellectual property, clinical research information, strategic documents, personal data of employees and trial participants, and confidential commercial information, collectively referred to as our “Information Systems and Data.”
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Text Block]
We have not experienced any material cybersecurity incidents that have impacted our operations to date. However, like most companies, we are subject to frequent and evolving cybersecurity threats and attempted attacks from a range of sources, including opportunistic hackers, organised threat actors, and internal vulnerabilities.
Cybersecurity Risk Board of Directors Oversight [Text Block]
Governance
 
Oversight of cybersecurity risk forms part of the Board of Directors’ general risk oversight responsibilities. Our Chief Information Officer (CIO), who has over 20 years of experience in IT and security, is responsible for the day-to-day implementation and ongoing development of our cybersecurity program.
 
The CIO is involved in reviewing security assessments, monitoring threat activity, approving key cybersecurity controls, and helping coordinate incident preparedness across the organisation. In the event of a cybersecurity incident, our escalation procedures provide for involvement of senior management, including the CIO and, where appropriate, other members of the executive team and relevant support functions.
 
Cybersecurity matters are reported to senior management as needed, particularly in cases where a threat or incident may have a broader business impact. Our governance structure is designed to support informed decision-making around risk prioritisation, incident response, and investment in cybersecurity measures. As of the date of this filing, we are not aware of any cybersecurity threats, including past incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block]
Oversight of cybersecurity risk forms part of the Board of Directors’ general risk oversight responsibilities. Our Chief Information Officer (CIO), who has over 20 years of experience in IT and security, is responsible for the day-to-day implementation and ongoing development of our cybersecurity program.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] Our Chief Information Officer (CIO), who has over 20 years of experience in IT and security, is responsible for the day-to-day implementation and ongoing development of our cybersecurity program.
Cybersecurity Risk Role of Management [Text Block]
The CIO is involved in reviewing security assessments, monitoring threat activity, approving key cybersecurity controls, and helping coordinate incident preparedness across the organisation. In the event of a cybersecurity incident, our escalation procedures provide for involvement of senior management, including the CIO and, where appropriate, other members of the executive team and relevant support functions.
 
Cybersecurity matters are reported to senior management as needed, particularly in cases where a threat or incident may have a broader business impact. Our governance structure is designed to support informed decision-making around risk prioritisation, incident response, and investment in cybersecurity measures. As of the date of this filing, we are not aware of any cybersecurity threats, including past incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] Our cybersecurity program is led by our Chief Information Officer (CIO), who has over 20 years of IT leadership experience, and is supported by an internal security function that collaborates with our broader risk management team.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] Our Chief Information Officer (CIO), who has over 20 years of experience in IT and security, is responsible for the day-to-day implementation and ongoing development of our cybersecurity program.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block]
Cybersecurity matters are reported to senior management as needed, particularly in cases where a threat or incident may have a broader business impact. Our governance structure is designed to support informed decision-making around risk prioritisation, incident response, and investment in cybersecurity measures. As of the date of this filing, we are not aware of any cybersecurity threats, including past incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true