XML 30 R11.htm IDEA: XBRL DOCUMENT
v3.25.4

Cybersecurity Risk Management, Strategy, and Governance | 12 Months Ended
--- | ---
Dec. 31, 2025
Cybersecurity Risk Management, Strategy, and Governance [Line Items] |
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] | Item 1C. C ybersecurity Risks Management and Strategy We rely on our Manager’s cybersecurity program, to identify, assess, and manage material risks to our business from cybersecurity threats. With oversight from our Board, our Manager and executive officers are responsible for establishing and monitoring the effectiveness of our controls for cybersecurity risk and have implemented an enterprise-wide information security program designed to identify, protect against, detect, assess, respond to, and manage reasonably foreseeable cybersecurity risks and threats to our systems. Our Manager’s cybersecurity risk management processes are integrated into our broader risk management processes and are evaluated in conjunction with other operational and business risks. The program, which is supported in part by third-party consultants and service providers, includes cybersecurity risk assessments, an incident response plan, business continuity planning, as well as ongoing vulnerability scanning and periodic penetration testing. In addition, Kennedy Lewis has implemented mandatory cybersecurity training for all employees and phishing tests designed to raise awareness and educate personnel on cybersecurity risks. To protect our systems from cybersecurity threats, our Manager uses various security tools that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, software for employee access monitoring and reporting, threat detection, and mobile device controls. Cybersecurity threats may also arise from internal sources, including employee misconduct, misuse of authorized access, human error, or failures to follow established security policies and procedures. Our Manager’s cybersecurity program is designed to mitigate such internal risks through access controls, monitoring and logging, segregation of duties, mandatory cybersecurity training, and policies governing acceptable use and data protection. Our risk management processes include oversight and identification of cybersecurity threats related to third-party service providers. Service provider due diligence may include, as appropriate depending on the nature of the service and the provider’s access to our data, periodic reviews of the provider’s business continuity planning, data protection, and cybersecurity practices, as well as contractual commitments to maintain IT systems in accordance with cybersecurity standards. As of the date of this Form 10-K, we are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including in our business strategy, results of operations or financial condition. However, our business is highly dependent on our ability to collect, use, store and manage organizational and property data. If any of our significant information and data management systems do not operate properly or are disabled, we could suffer a material disruption of our business or managing real estate, loss of sensitive data, regulatory intervention, breach of confidentiality or other contract provisions, or reputational damage. These systems may fail to operate properly or become disabled as a result of events wholly or partially beyond our control, including disruptions of electrical or communications services, natural disasters, political instability, terrorist attacks, sabotage, computer viruses, deliberate attempts to disrupt our computer systems through “hacking,” “phishing,” or other forms of both deliberate or unintentional cyber-attack, or our inability to occupy our office location. See “Part I, Item 1A. Risk Factors” for more information on risks from cybersecurity threats that are reasonably likely to materially affect our business strategy, results of operations and financial condition. Governance The Audit Committee of the Board (the “Audit Committee”) oversees Millrose’s cybersecurity risk as part of our overall risk management policies. The Board, including the Audit Committee, receives updates on a quarterly basis from our Manager and executive officers on our cybersecurity program, including measures taken to address cybersecurity risks and significant cybersecurity incidents. Our Chief Technology Officer (“CTO”) leads the cybersecurity program, and is responsible for developing, implementing, and monitoring our cybersecurity infrastructure and managing our response to threats or security incidents, in coordination with our Manager’s IT and Compliance team. Our General Counsel provides oversight on legal and regulatory aspects of cybersecurity risk management. We engage a third party to assist with cybersecurity risk assessment, policies and documentation, training and tabletop exercises, and vulnerability scanning and penetration testing. Our CTO has served in this role since February 2025 and has more than ten years of technology and cybersecurity experience. He is concurrently a Managing Director at Kennedy Lewis where he has been responsible for managing the firm’s technology and analytical capabilities since 2022.
Cybersecurity Risk Management Processes Integrated [Flag] | true
Cybersecurity Risk Management Processes Integrated [Text Block] | Our Manager’s cybersecurity risk management processes are integrated into our broader risk management processes and are evaluated in conjunction with other operational and business risks.
Cybersecurity Risk Management Third Party Engaged [Flag] | true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] | true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] | false
Cybersecurity Risk Board of Directors Oversight [Text Block] | Governance The Audit Committee of the Board (the “Audit Committee”) oversees Millrose’s cybersecurity risk as part of our overall risk management policies. The Board, including the Audit Committee, receives updates on a quarterly basis from our Manager and executive officers on our cybersecurity program, including measures taken to address cybersecurity risks and significant cybersecurity incidents. Our Chief Technology Officer (“CTO”) leads the cybersecurity program, and is responsible for developing, implementing, and monitoring our cybersecurity infrastructure and managing our response to threats or security incidents, in coordination with our Manager’s IT and Compliance team. Our General Counsel provides oversight on legal and regulatory aspects of cybersecurity risk management. We engage a third party to assist with cybersecurity risk assessment, policies and documentation, training and tabletop exercises, and vulnerability scanning and penetration testing. Our CTO has served in this role since February 2025 and has more than ten years of technology and cybersecurity experience. He is concurrently a Managing Director at Kennedy Lewis where he has been responsible for managing the firm’s technology and analytical capabilities since 2022.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] | The Audit Committee of the Board (the “Audit Committee”) oversees Millrose’s cybersecurity risk as part of our overall risk management policies.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] | The Board, including the Audit Committee, receives updates on a quarterly basis from our Manager and executive officers on our cybersecurity program, including measures taken to address cybersecurity risks and significant cybersecurity incidents.
Cybersecurity Risk Role of Management [Text Block] | The Audit Committee of the Board (the “Audit Committee”) oversees Millrose’s cybersecurity risk as part of our overall risk management policies. The Board, including the Audit Committee, receives updates on a quarterly basis from our Manager and executive officers on our cybersecurity program, including measures taken to address cybersecurity risks and significant cybersecurity incidents. Our Chief Technology Officer (“CTO”) leads the cybersecurity program, and is responsible for developing, implementing, and monitoring our cybersecurity infrastructure and managing our response to threats or security incidents, in coordination with our Manager’s IT and Compliance team. Our General Counsel provides oversight on legal and regulatory aspects of cybersecurity risk management. We engage a third party to assist with cybersecurity risk assessment, policies and documentation, training and tabletop exercises, and vulnerability scanning and penetration testing.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] | true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] | Our Chief Technology Officer (“CTO”) leads the cybersecurity program, and is responsible for developing, implementing, and monitoring our cybersecurity infrastructure and managing our response to threats or security incidents, in coordination with our Manager’s IT and Compliance team.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] | Our CTO has served in this role since February 2025 and has more than ten years of technology and cybersecurity experience. He is concurrently a Managing Director at Kennedy Lewis where he has been responsible for managing the firm’s technology and analytical capabilities since 2022.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] | The Board, including the Audit Committee, receives updates on a quarterly basis from our Manager and executive officers on our cybersecurity program, including measures taken to address cybersecurity risks and significant cybersecurity incidents.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] | true

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardOfDirectorsOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementExpertiseOfManagementResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleReportToBoardFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskManagementProcessesForAssessingIdentifyingAndManagingThreatsTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K + Details
Name: | cyd_CybersecurityRiskManagementStrategyAndGovernanceLineItems
Namespace Prefix: | cyd_
Data Type: | i:stringItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskManagementThirdPartyEngagedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskMateriallyAffectedOrReasonablyLikelyToMateriallyAffectRegistrantFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskProcessForInformingBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskProcessForInformingManagementOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskRoleOfManagementTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskThirdPartyOversightAndIdentificationProcessesFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration