Assurant (AIZ) Risk Analysis

Our employees are the cornerstone of our Company's culture and acts of misconduct by any employee, and particularly by senior management, could erode trust and confidence and damage our reputation. Our employees could engage or be accused of engaging in misconduct that subjects us to investigation, litigation, regulatory sanctions, financial costs and serious harm to our reputation or financial position. Employee misconduct could prompt regulators to allege or determine, on the basis of such misconduct, that we have not established an adequate program to inform employees of applicable rules or to detect and deter violations of such rules. It is not always possible to deter employee misconduct and the precautions we take to detect and prevent misconduct may not be, and at times has not been, effective. Misconduct by employees, or even unsubstantiated allegations, could have a material adverse effect on our financial position, reputation and business.

We rely on vendors and other third parties, including independent contractors, to conduct business and provide services to our clients. We use vendors and other third parties for business, investment management, technology, operations, facilities management and other services. For example, our ability to continue to develop, use and efficiently deploy AI technologies depends on access to specific third-party equipment and services. We take steps to monitor and regulate the performance of vendors and other third parties, including in our agreements with such parties, but our oversight controls could prove inadequate. Since we do not fully control the actions of vendors and other third parties, we are subject to the risk that their decisions or operations adversely impact us, and replacing them could create significant delay and expense. If these vendors or other third parties fail to satisfy their obligations to us or if they fail to comply with legal or regulatory requirements in a high-quality and timely manner, which has occurred from time to time, our operations or reputation could be compromised, and we could face legal, regulatory and financial consequences. In addition, these third parties face their own technology, operating, business and economic risks, and any significant failures by them, including the improper use or disclosure of our confidential client, employee or Company information, could expose us to liability. An interruption in or the cessation of service by any service provider as a result of systems failures, capacity constraints, financial difficulties or for any other reason has occurred from time to time and could materially disrupt our operations, limit our ability to offer certain products and services, or result in contractual or regulatory penalties, liability claims, damage to our reputation and harm to our business. If we are unable to attract and retain qualified vendors, independent contractors and other third-party service providers, or if changes in law or judicial decisions require independent contractors to be classified as employees, our business could be significantly adversely affected. Our engagements with international vendors or third parties expose us to risks that accompany operations in a foreign jurisdiction, including international economic and political conditions, foreign laws and regulations, fluctuations in currency values and heightened data security risks. For more information on the risks associated with the use of international vendors and third parties, see " – We face risks associated with our international operations."

Limited availability of credit, disruptive geopolitical events (including regional and global conflicts and trade relations), supply chain disruptions, deteriorations of the global economies, including mortgage and real estate markets, declines in consumer confidence and consumer spending, increases in prices or in the rate of inflation, periods of high unemployment or labor shortages, persistently low or rapidly increasing interest rates, and other events outside of our control (such as a major epidemic or a pandemic, political or civil unrest, the recent U.S. government shutdown or the possibility of a default on U.S. debt obligations), could contribute, and in some cases have contributed, to increased volatility and diminished expectations for the economy and the financial markets, including the market for our stock. In addition, there is continued uncertainty concerning potential and recent actions by the current U.S. administration, including increased or new tariffs that may impact the cost of claims and disrupt supply chains. These factors may materially adversely affect our business, results of operations and financial condition. Specifically, during periods of economic downturn: - individuals and businesses may (i) choose not to purchase our insurance products, extended service contracts and other products and services, (ii) terminate existing policies or contracts or permit them to lapse and (iii) choose to reduce the amount of coverage they purchase;- conditions in the markets in which we operate may deteriorate, impacting, among other things, consumer demand for the mobile devices, electronics, appliances, automobiles, housing and other products we insure, including the rate of introduction and success of new products, technologies and promotional programs that provide opportunities for growth;- clients are more likely to underperform expectations, experience financial distress and declare bankruptcy, which could have an adverse impact on the remittance of premiums from such clients and the collection of receivables from such clients for items such as unearned premiums and could otherwise expose us to credit risk;- claims on certain specialized insurance products tend to rise;- there is a risk of fraudulent insurance claims;- there may be an impairment in the value of our tangible and intangible assets and our investment portfolio may be adversely affected;- there may be fluctuations in the labor market and a negative impact on employee retention; and - our ability to access the capital markets on favorable terms or at all may be negatively impacted. General inflationary pressures and supply chain disruptions, including within the current environment, has and may continue to increase the costs of paying claims, including for materials and labor, particularly in our Global Housing and Global Automotive businesses. In addition, inflationary pressures and shortages in the labor market have increased, and may continue to increase, our labor costs, including employee wages, and changes in interest rates has impacted, and may continue to impact, our investment portfolio and capital. See " – Financial Risks – Our investment portfolio is subject to market risk, including changes in interest rates, that may adversely affect our results of operations and financial condition." Conversely, deflationary pressures may affect the pricing of our products and services.

Our international operations face economic, political, legal, compliance, regulatory, operational, supply chain and other risks. For example, we face the risk of, the imposition of sanctions, tariffs, trade barriers or other protectionist laws or business practices that favor local competition (including from the United States), increase costs and may otherwise adversely affect our business; inflation and foreign exchange rate fluctuations; restrictions on currency conversion and the repatriation of non-U.S. investments and earnings; burdens and costs of compliance with a variety of foreign laws and regulations and the associated risk and costs of non-compliance, including reputational harm; exposure to evolving legal systems, which may result in unpredictable or inconsistent application of laws and regulations, including export controls and exposure to commercial, political, legal or regulatory risks such as corruption; political, economic or other instability in countries in which we conduct business, including possible terrorist acts; diminished ability to enforce our contractual rights; heightened data security risks; differences in cultural environments; changes in regulatory requirements, including changes in regulatory treatment of certain products or services; exposure to local economic conditions and its impact on our clients' performance and creditworthiness; and a competitive global labor market. If our business model is not successful in a particular country or region, or a country or region in which we do business experiences economic, political or other instability, we may lose all or part of our investment in that country or region. As we continue to scale our global operations and grow our international labor force within Global Capability Centers, our business becomes increasingly exposed to these and other risks, including where certain countries or regions have experienced economic or political instability. As we engage with international clients, we may make certain up-front commission payments or similar cash outlays, which we may not recover if the business does not develop as we expect. These up-front payments are typically supported by various protections, such as letters of credit, letters of guarantee and real estate, but we may not fully or timely recover amounts owed to us because of difficulties in enforcing contracts or judgments in evolving legal systems and other factors. In addition, we rely on fronting carriers in certain countries to maintain their licenses and product approvals, satisfy local regulatory requirements and continue in business. If they fail to do so, our business, reputation, and relationships with our clients and their customers could be adversely affected. For additional information on the significant international regulations that apply to us and the risks relating thereto, see "Item 1 – Business – Regulation – International Regulation" in this Report, " – Business, Strategic and Operational Risks – Our mobile business is subject to the risk of declines in the value and availability of mobile devices, and to regulatory compliance and other risks," " – Macroeconomic, Political and Global Market Risks – General economic, financial market and political conditions and conditions in the markets in which we operate may materially adversely affect our results of operations and financial condition," " – Legal and Regulatory Risks – We are subject to extensive laws and regulations, which increase our costs and could restrict the conduct of our business, and violations or alleged violations of such laws and regulations could have a material adverse effect on our reputation, business and results of operations," " – Legal and Regulatory Risks – Our business is subject to risks related to litigation and regulatory actions" and " – Legal and Regulatory Risks – The costs of complying with, or our failure to comply with, U.S. and foreign laws related to privacy, data security and data protection could adversely affect our financial condition, operating results and reputation."

We compete for business, clients, customers, agents and other distribution relationships with many insurance companies, warranty and protection companies, financial services companies, mobile device repair and logistics companies, technology and software companies and specialized competitors that focus on one market, product or service. Some of our competitors may: offer a broader array of products and services than we do or more favorable terms; be better able to tailor those products and services to client and customer needs, including through better technology systems or infrastructure; or have greater diversity of distribution resources, better brand recognition, more competitive pricing, lower costs, greater financial strength or ratings, more resources or higher quality of service. Additionally, customers may turn to our competitors because of our or our client's failure, or perceived failure, to deliver on customer expectations, product or service flaws, technology issues, gaps in operational support or other issues affecting customer experience. As a result, competition may adversely affect the persistency of our policies, our ability to sell products and provide services, maintain client relationships (including significant clients), and our revenues and results of operations, which has occurred from time to time. The evolving nature of consumer needs and preferences and improvements in technology could result in a reduction in consumer demand and in the prices of the products and services we offer. Our competitive position may be impacted if we are unable to develop, use or integrate, in an effective, compliant and competitive manner, technology such as AI and machine learning, or if our competitors collect and use data that we do not have the ability to access or use. AI technologies may fail, underperform expectations or disrupt business operations, and there can be no assurance that our use of AI will enhance our products or services, or be beneficial to our business. In addition, across many of our businesses, we must respond to the threat of disruption by traditional players, such as insurers, from new entrants, such as "Insurtech" companies, and from their use of technologies such as AI. These players are focused on using technology and innovation to simplify and improve the customer experience, increase efficiencies, alter business models and effect other potentially disruptive changes in the markets in which we operate. To maintain a competitive position, we must continue to invest in new technologies, including AI, and new ways to deliver our products and services. If we do not anticipate and respond effectively to changes in customer preferences, new industry standards, evolving distribution models, disruptive technology developments, including AI, and alternative business models, our business and results of operations could be adversely impacted.

We communicate with and distribute our products and services ultimately to individual customers. From time to time, regulators, consumer advocacy groups, the media and individual customers may focus their attention on our products and services, or on the broader industries in which we operate, which may subject us to negative publicity. We may be negatively affected if another company in one of our industries or in a related industry, or if one of our clients, engages in practices that subject our industry or businesses to negative publicity. Negative publicity may result from judicial inquiries, unfavorable outcomes in lawsuits, social media, regulatory or governmental actions, including with respect to our products or services and industry commercial practices. For example, regulators may submit queries to assess and ensure fair practices and fair value from our products and services. In addition, there is stakeholder and regulatory focus on sustainability matters, including workforce inclusion, which has recently been subject to significant change and varies among jurisdictions, and could subject us to negative publicity. An actual or perceived increase in related risks as a result of our or our industries' business activities, may subject us to negative publicity. Negative publicity may cause increased regulation and legislative scrutiny of industry practices as well as increased litigation or enforcement action by civil and criminal authorities. Additionally, negative publicity may increase our costs of doing business and adversely affect our profitability by impeding our ability to market our products and services, constraining our ability to price our products appropriately for the risks we are assuming, requiring us to change the products and services we offer or increasing the regulatory burdens under which we operate.

We rely on the uninterrupted and secure operation of our technology systems, including information technology systems and operational technology systems, and those of our vendors to operate our business and securely process, transmit and store electronic information. This electronic information includes confidential and other sensitive information, including personal data, that we receive from our customers, vendors and other third parties. Our technology systems and safety control systems and those of our vendors and other third parties with whom we share sensitive information are vulnerable to, and in some cases have been subject to, damage or interruption from a variety of external threats, including cybersecurity incidents, such as advanced ransomware, credential compromises, vulnerability exploitation including zero-day exploits, distributed denial of service attacks, hardware misconfigurations, phishing and advanced social engineering, which have been increasing in frequency and complexity. Cybersecurity incidents are rapidly evolving and becoming increasingly sophisticated, partly due to the growing use of AI by malicious actors. We are at risk of attack, and from time to time have been the subject of an attack, by a growing list of adversaries, including state-sponsored organizations, organized crime, hackers and "hacktivists" (activist hackers), through the use of increasingly sophisticated methods of attack, including long-term, persistent attacks referred to as advanced persistent threats, attacks via yet unknown vulnerabilities referred to as zero-day threats, attacks against our externally-facing applications and infrastructure components, and credential harvesting attacks against our employees through advanced social engineering tactics. Because the techniques used to obtain unauthorized access or sabotage systems change frequently and generally are not identified until they are launched against a target, we may be unable to anticipate these techniques or implement adequate preventative measures, resulting in potential data loss or other damage to technology systems. As the breadth and complexity of the technologies we use continue to grow, and as a result of the remote and hybrid work arrangements for a significant portion of our employees, the risk of security breaches and cybersecurity incidents has increased. Our systems have also been subject to compromise from internal threats such as improper action by employees and third parties who may have otherwise legitimate access to our systems. Our call centers subject us to additional risk from internal threats due to access to personal data. Moreover, we face the ongoing challenge of managing access controls in a complex environment. Remote and hybrid work arrangements, including the use of personal devices and home networks that are not managed by the organization's security control framework, bypass certain physical security controls for our employees and the employees of our vendors who have access to sensitive information. While additional controls have been put in place, they may not be sufficient to discover compromises that occur due to the loss of physical controls. The latency of a compromise is often measured in months, and we may not be able to detect a compromise in a timely manner. We could experience significant financial and reputational harm as a result of operational resiliency issues, including if our technology systems are breached, sensitive client or Company data are compromised, modified, rendered inaccessible for any period of time, made public or misused, or if we fail to make adequate disclosures to the public or law enforcement agencies following any such event. Our data protection measures may not be effective to protect our network and systems from external and internal threats. Should an attacker gain access to our network using compromised credentials of an authorized user or otherwise, or gain entry as a result of a zero-day exploit or other vulnerabilities that may exist in our systems environment, which has occurred from time to time, we are at risk that the attacker might successfully leverage that access to compromise additional systems and data. Certain measures that could increase the security of our systems take significant time and resources to deploy broadly and may not be effective against an attack. Additionally, our policies, procedures and technical safeguards may be insufficient to prevent or detect improper access to confidential, personal or proprietary information and other cybersecurity incidents, assess the severity or impact of any such incidents or appropriately respond in a timely manner. The inability to implement, maintain and upgrade effective protective measures and other safeguards or adequately respond to a breach could have a material adverse effect on our business. Although we continue to invest in security and engage in best practices for software development, code vulnerabilities may still be introduced into production environments. Our technology systems must be continually patched, hardened and upgraded to protect against vulnerabilities, including zero-day threats, and cyber attackers have, and may continue to, exploit these vulnerabilities before they have been addressed. Due to the large number and age of the systems and platforms that we operate and the increased frequency with which vendors issue security patches to their products, as well as the need to test patches and, in some cases coordinate with clients and vendors, before they can be deployed, we are at risk that we cannot deploy these patches to remediate these vulnerabilities in a timely and effective manner. We are dependent on vendors and other third parties, such as cloud service providers, to keep their systems patched and hardened in order to protect our data. We have vendors and other third parties who receive data from us in connection with the services we offer our customers. In addition, we have migrated certain data, and may increasingly migrate data, to the cloud hosted by third-party providers. From time to time, we have experienced cybersecurity incidents involving a vendor or other third party, which resulted in a breakdown of such third party's data protection measures or access to our infrastructure through the third party. To the extent that a vendor or third party suffers a cybersecurity incident that compromises their operations, our data and our customers' data could be compromised or we may experience significant service interruption. Any failure related to these activities and operational resiliency could have a material adverse effect on our business. The process of integrating the technology systems of the businesses we acquire is complex and exposes us to additional risk. For instance, we may not adequately identify weaknesses in an acquired entity's technology systems, either before or after the acquisition, which could affect the value we are able to derive from the acquisition, expose us to unexpected liabilities or make our own systems more vulnerable to a cybersecurity incident. We may be unable to integrate the systems of the businesses we acquire into our environment in a timely manner, which could further increase these risks until such integration takes place. Like many companies, we are subject to regular phishing email and social media engineering campaigns directed at our employees that have become more sophisticated, highly personalized and ultimately more successful, partly through the use of AI, and can result in significant financial and data losses. Although some of these incidents have resulted in data leaks and other damages, to date, they have not had a material adverse effect on our business or operations. These types of incidents have in the past and could in the future result in confidential, restricted personal or proprietary information being lost or stolen, modified, rendered inaccessible for any period of time, or made public, including client, employee or Company data, which could have a material adverse effect on our business. Improper access to or disclosure of sensitive client or Company information, which has occurred from time to time, could harm our reputation and subject us to litigation and significant liability under our contracts, as well as under existing or future laws, rules and regulations. In the event of a cybersecurity incident, we might have to take our systems offline, which could interfere with services to our clients, damage our reputation or expose us to litigation. In addition, our cybersecurity insurance policy may not be sufficient in type or amount to fully cover us against claims and costs related to security breaches, cybersecurity incidents, and other related data and system incidents.