Hancock Whitney (HWC) Risk Analysis

We depend on our ability to process, record and monitor a large number of client transactions and to communicate with clients and other institutions on a continuous basis. Our clients depend on us for access to their assets and account information. Our online, business, financial, accounting, data processing, or other operating systems and facilities, or those of our third-party service providers, may stop operating properly or become disabled or damaged as a result of a number of factors, including events that are wholly or partially beyond our control. For example, there could be sudden increases in client transaction volume; electrical or telecommunications outages; natural disasters such as earthquakes, tornadoes, floods, and hurricanes; pandemics; events arising from local or larger scale political or social matters, including terrorist acts; occurrences of employee error, fraud, or malfeasance; and, as described below, cyber-attacks. Furthermore, for most financial institutions, transitioning from existing systems and software (or transitioning legacy systems and software) to a new provider is a significant and expensive undertaking and includes a number of risks, including crashes and system downtime, transition costs, decreased productivity, security risk, and legal and regulatory compliance risks. Although we have response plans, business continuity plans and other safeguards in place, our operations and communications may be adversely affected by significant and widespread disruption to our systems and infrastructure that support our businesses and clients. While we continue to evolve and modify our response and business continuity plans, there can be no assurance in an escalating threat environment that they will be effective in avoiding disruption and business impacts. Our insurance may not be adequate to compensate us for all resulting losses, and the cost to obtain adequate coverage may continue to increase for us or the industry. Security risks for financial institutions such as ours have dramatically increased in recent years, in part because of the proliferation of new technologies, included but not limited to AI, that may be used by threat actors to perpetuate cyberattacks, the use of the internet and telecommunications technologies to conduct financial transactions, and the increased sophistication, resources and activities of hackers, terrorists, activists, organized crime, and other external parties, including nation state actors. In addition, clients may use devices or software to access our products and services that are beyond our control environment, which may provide additional avenues for attackers to gain access to confidential information. Although we have information security procedures and controls in place, certain of our technologies, systems, networks, and clients' devices and software have in the past and in the future likely will continue to be the target of cyber-attacks or information security incidents that could result in the unauthorized access, release, gathering, monitoring, use, loss, change or destruction of our or our clients' confidential, proprietary and other information (including personal identifying information of individuals), or otherwise disrupt our or our clients' or other third parties' business operations. From time to time, we, like other financial institutions, become aware of information security vulnerabilities in software emanating from outside vendors and must take active steps to mitigate and prevent the potential exploitation of such vulnerabilities. Further, U.S. financial institutions and financial services companies will continue to face compromises in security of their websites or other systems, including ransomware attacks to shut down access to their networks and systems in an attempt to extract compensation from them to regain control. Financial institutions have also experienced, and will continue to be the target of, distributed denial-of-service attacks, a sophisticated and targeted attack intended to disable or degrade internet service or to sabotage systems. We and others in our industry regularly are, and will continue to be, the subject of attempts by attackers to gain unauthorized access to our networks, systems, data and other infrastructure, or to obtain, change, or destroy confidential data (including personal identifying information of individuals) through a variety of means, including computer hacking, acts of vandalism or theft, malware, computer viruses or other malicious codes, phishing, brute force attacks, exploiting software vulnerabilities (including "zero-day attacks"), supply chain attacks, employee error or malfeasance, catastrophes, unforeseen events or other cyber-attacks. In the future, these attacks may result in unauthorized individuals obtaining access to our confidential information or that of our clients, or otherwise materially accessing, damaging, or disrupting our systems or infrastructure, or those of our third-party service providers. To date, we have seen no material adverse impact on our business or operations from cyber-attacks or events. Any future significant compromise or breach of our data security, whether external or internal, or misuse of customer, associate, supplier or Company data, could result in significant disruption of our operations, reimbursement and other costs, lost sales, fines (which fines may not be covered by our insurance policies), lawsuits, regulatory scrutiny, and other legal exposure, a loss of trust in us on the part of our clients, vendors or other counterparties, client attrition and damage to our reputation. Any of these could materially and adversely affect our results of operations, our financial condition, and/or our share price. However, the ever-evolving threats mean we and our third-party service providers and vendors must continually evaluate and adapt our respective systems and processes and overall security environment, as well as those of any companies we acquire. We are continuously enhancing our controls, processes and practices designed to protect our networks, systems, data and other infrastructure from attack, damage or unauthorized access. This continued enhancement will require us to expend additional resources, including to investigate and remediate any information security vulnerabilities that may be detected. Despite our ongoing investments in security resources, talent, and business practices, there is no guarantee that these measures will be adequate to safeguard against all data security incidents, system compromises or misuses of data.