13 paragraphs in Risk Factors of the 10-K filed Feb 20, 2026
with nothing like them in the 10-K filed Feb 24, 2025. Quoted exactly.
Paragraphs that were only edited are under 10-K change.
Risks Related to Technology, Information Security, Privacy and Third-Party Suppliers
If we or our suppliers experience unforeseen interruptions or difficulties in the operation of the information technology systems that support our business, our operations, reputation, and financial results could be negatively affected.
We and certain third-party partners rely on the continuous availability and proper functioning of our information technology systems and those of our third-party vendors to process, store, retrieve, evaluate, and use internal and external data and to perform necessary insurance functions. These functions include providing insurance quotations, processing premium payments, servicing, and modifying existing policies, filing and paying claims, supporting agents, brokers, and policyholders, and managing our investment portfolios. Our systems, and those of our suppliers, may be subject to interruptions, failures, or degradation due to technological or human errors, software or hardware defects, vulnerabilities, system capacity limitations, computer or communications failures, power outages, disruptions during system upgrades or replacements, adverse weather, or natural disasters, cyberattacks, or other unexpected events.
If these systems are disrupted or become inaccessible to our employees, agents, brokers, or policyholders for an extended period, and if our disaster recovery or business continuity plans or those of our suppliers are inadequate or do not function as intended, our ability to conduct business could be impaired. Prolonged or severe disruptions could result in the loss of critical data, harm to policyholder, agent, and partner relationships, increased claims or operating costs, reputational damage, and adverse impacts on our operations and financial results.
Our inability to adapt to or implement new technologies, including artificial intelligence, could adversely affect our business and results of operations, and the use of new technologies may create unforeseen exposure or coverage issues.
We rely on a broad range of advanced technologies, including AI, to support our operations. As these technologies continue to rapidly evolve, our business could be adversely affected if we are unable to effectively adopt, update, integrate, or scale new capabilities in a timely or cost-effective manner. Competitors with greater technology investments or faster innovation cycles may introduce enhanced AI enabled tools, digital experiences, or analytic capabilities that improve efficiency, the customer or agent experience, and business outcomes. If we fail to keep pace with such developments, we may face disadvantages in attracting and retaining policyholders, supporting our distribution partners, or achieving operational efficiency, which could adversely affect our business and results of operations. New or evolving technologies, including AI, may also create unforeseen exposures or coverage issues under the policies we write or introduce new forms of claims fraud or cybercrime. In addition, regulatory standards relating to the use of AI in the states where we do business are also evolving and may increase the complexity of our compliance and reporting obligations, as well as the regulatory risks associated with our use of this technology.
Our operations, financial performance and reputation could be adversely affected, and we could be subject to legal liability or regulatory enforcement actions, if we, or our suppliers, are unable to protect against, or effectively respond to, cyberattacks or other cyber incidents.
We rely extensively on the security, integrity, and availability of our information technology systems and those of our agents, brokers, third-party administrators, claims vendors, catastrophe response partners, and other service providers to underwrite policies, price risk, service policyholders, adjust and pay claims, manage reinsurance arrangements, and store and process large volumes of sensitive personal and commercial information. These systems are exposed to continuously evolving cybersecurity threats, including unauthorized access, malware, ransomware, distributed denial of service attacks, phishing and other social engineering schemes,
insider threats, software vulnerabilities, and operational or system failures. A cybersecurity attack or other security incident affecting us or a third-party service provider could disrupt our ability to quote, bind, issue, or service policies, impede claims intake, investigation, or settlement, compromise or misappropriate confidential agent, policyholder, claimant, or commercial customer information, affect our catastrophe response capabilities, or interfere with the operation of telematics, Internet of Things devices, or other data collection tools used in underwriting or claims processing. Such events could also expose us to regulatory investigations or enforcement actions by state insurance departments, litigation, contractual liabilities to distribution partners, remediation costs, operational delays, reputational harm, and adverse impacts on our financial condition or results of operations. Although we maintain a cybersecurity program designed to prevent, detect, and respond to security threats and continually enhance our defenses, no control environment can eliminate all risk. Like many companies in the property and casualty insurance industry, we and our third-party service providers have experienced, and are likely to continue to experience, cybersecurity events and attempts to compromise systems. To date, these events have not had a material adverse effect on our business, but there is no assurance that future incidents will not be material. Cybersecurity threats continue to grow in frequency and complexity, including due to the rapid advancement and use of AI by threat actors. As a result, we may be required to devote additional financial, technological, and personnel resources to monitor, detect, investigate, contain, mitigate, remediate, or defend against such threats. These efforts may increase costs and divert resources from other operational or strategic priorities.
We also rely on numerous third parties, including agents, brokers, claims adjusters, contractors, independent appraisers, managed repair networks, cloud providers, and other vendors, all of whom face similar cybersecurity risks. A cybersecurity incident affecting one of these third parties could compromise our data or systems, disrupt our business processes, or increase our exposure to regulatory, operational, or financial risks through the interconnected nature of our business relationships. While we employ oversight and protective measures intended to reduce these risks, we cannot guarantee that our controls or those of our third parties will prevent all cybersecurity incidents.
For more information on how we handle cybersecurity, see Item 1C. Cybersecurity.
