BROBrown & Brown

We rely on information technology and third-party vendors to provide effective and efficient service to our customers, process claims, and timely and accurately report information to carriers, which often involves secure processing of confidential, sensitive, proprietary and other types of information. We face potential threats due to new and increasingly sophisticated methods of attack. Cybersecurity breaches of any of the systems we rely on may result from circumvention of security systems, denial-of-service attacks or other cyber-attacks, software bugs, malicious or destructive code, hacking, social engineering attacks (including “phishing” attacks attacks, business email compromise and digital or telephonic impersonation), computer viruses, ransomware, malware, employee or insider error or threats, malfeasance, social engineering, physical breaches or other actions, any of which could expose us to unauthorized access, exfiltration, manipulation, corruption, loss or disclosure of proprietary, customer, employee or other data, the inability to render services due to system outages or other business disruptions, regulatory action and scrutiny, monetary and reputational damages and significant increases in compliance costs. Any of the foregoing may be exacerbated by a delay or failure to detect a cybersecurity incident or the full extent of such incident. A compromise may not manifest itself for months, or even years, and we may not be able to detect a compromise in a timely manner. In addition, disclosure or media reports of actual or perceived security vulnerabilities to our systems or those of our third-party service providers, even if no breach has been attempted or occurred, could lead to reputational harm, loss of customers and revenue, or increased regulatory actions and scrutiny. The risk of such cybersecurity breaches may be increased by our reliance on work-from-home or other remote work technologies. An interruption of our access to, or an inability to access, our information technology, telecommunications or other systems could significantly impair our ability to perform such functions on a timely basis. If sustained or repeated, such a business interruption, system failure or service denial could result in a deterioration of our ability to write and process new and renewal business, provide customer service, pay claims in a timely manner or perform other necessary business functions. We have from time to time experienced cybersecurity incidents, such as malware infections, phishing campaigns, ransomware and vulnerability exploit attempts, which to date have not had a material impact on our business.

Brown & Brown, Inc., a Florida corporation, and its subsidiaries (collectively, “Brown & Brown” or the “Company”) is a diversified insurance agency, wholesale brokerage, insurance programs and service organization that markets and sells insurance products and services, primarily in the property, casualty and employee benefits areas. Brown & Brown’s business is divided into three two reportable segments. The Retail segment provides a broad range of insurance risk management products and services to commercial, public and quasi-public entities, and to professional and individual insured customers, customers. These products and services include property and casualty insurance and reinsurance, employee benefits, private client services, captive solutions, consulting services and financial and wealth solutions, as well as non-insurance risk-mitigating warranty services and products through our the Retail segment’s automobile and recreational vehicle dealer services (“F&I”) businesses. The Programs segment, Specialty Distribution segment consists of our programs, wholesale brokerage and specialty businesses. The programs businesses, which acts act as a managing general underwriter (“MGU”), provides professional liability and related package products for certain professionals, a range of insurance products for individuals, flood coverage, and underwriters (“MGUs”), provide targeted products and services designated for specific industries, trade groups, governmental entities and market niches, all of which are delivered to the insured directly, to affinity groups, through wholesale brokers or through a nationwide global network of independent agents, including Brown & Brown retail agents. These products and services include specialty property and casualty insurance, financial lines, life and health benefits, reinsurance, travel/accident and health insurance, captive administrative services, warranty services and specialty packages of coverages. The Wholesale Brokerage segment markets wholesale brokerage businesses underwrite and sells place excess and surplus commercial and personal lines insurance, typically for specialized or hard-to-place types of risks, primarily through a global network of independent agents and brokers, as well as including Brown & Brown retail agents. The specialty business offers solutions across affinity and administrative services, captives, reinsurance, travel/accident, warranty, and life & health.

The Arrowhead Programs segment manages over 60 a diverse portfolio of professional liability, personal lines, commercial lines, public entity and specialty programs supported by over 100 well-capitalized carrier partners. insurance carriers. In most cases, the insurance carriers that support these programs have delegated underwriting and, in many instances, claims-handling authority to our programs operations. These programs are generally distributed through a global network of independent agents and brokers, including Brown & Brown retail agents, and offer targeted products and services designed for businesses, individuals, specific industries, trade groups, professions, public entities entities, municipalities, and market niches. niche markets. This segment division also operates a our write-your-own flood insurance carrier, WNFIC and participates in two Captives. a quota share captive and an excess of loss layer captive. WNFIC’s underwriting business consists of policies written on behalf of and fully ceded to the NFIP, as well as excess flood policies, which are fully reinsured in the private market. The Captives provide additional underwriting capacity that enable growth in core commissions and fees, and allow us to participate in underwriting results with limited exposure to claims expenses. The Company has traditionally participated in underwriting profits through profit-sharing contingent commissions. These Captives give us another way to continue to participate in underwriting results while limiting exposure to claims expenses. The Captives focus on property insurance for earthquake and wind exposed properties underwritten by certain of our MGUs. The Captives limit the Company's exposure to claims expenses either through reinsurance or by participating in limited tranches of the underwriting risk.