What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2026-02-20 compared with 2025-02-21 · 50 added, 42 removed, 349 unchanged (21% of the section changed)

39 unchanged sentences

Our approach to risk management relies on subjective variables that entail significant uncertainties.

For example, we rely heavily on estimates of PMLs for certain events that are generated by computer-run models.

For example, we rely heavily on estimates of PMLs for certain events that are generated by third-party stochastic models.

In addition, we rely on historical data and scenarios in managing credit and interest rate risks in our investment portfolio.

82 unchanged sentences

These same factors affect our ability to generate revenue and profits.

It is possible that, among other things, changes in international trade regulation, including tariffs, could lead to higher than anticipated inflation.

In an economic downturn that is characterized by higher unemployment, declining spending and reduced corporate revenues, the demand for insurance products is generally adversely affected, which directly affects our premium levels and profitability.

40 unchanged sentences

We rely on a select group of brokers, and such relationships may not continue.

We distribute the majority of our products through a select group of brokers.

We distribute the majority of our products through a select group of brokerage firms.

Of our 2025 gross written premiums, 60.6%, or $1.2 billion, were distributed through five of our approximately 227 brokers, three of which accounted for 47.6%, or $941.4 million, of our 2025 gross written premiums.

Our relationship with any of these brokers may be discontinued at any time.

Our relationship with any of these firms may be discontinued at any time.

Even if the relationships do continue, they may not be on terms that are profitable for us.

57 unchanged sentences

• our failure to implement appropriate actuarial projections and ratings formulas or other pricing methodologies;

• regulatory constraints on rate increases;

• our failure to accurately estimate investment yields and the duration of our liability for loss and loss adjustment expenses;

21 unchanged sentences

It is possible that we will misunderstand the nature or extent of the activities or facilities and the corresponding extent of the risks that we insure because of our reliance on inadequate or inaccurate information.

The failure of our information technology and telecommunications systems could materially adversely affect our business.

Our business depends on our information technology and telecommunications systems, including our web-based underwriting system.

We could suffer security breaches, loss of data or proprietary information, cyberattacks, and other information technology failures, and are subject to laws and regulations concerning data privacy and security that are continually evolving.

Actual or suspected information technology failures or failures to comply with applicable law could disrupt our operations, damage our reputation, and adversely affect our business, financial condition, or results of operations.

Our business is highly dependent on our information technology and telecommunications systems, including our web-based underwriting system.

Among other things, we rely on these systems to interact with brokers and insureds, to underwrite business, to prepare policies and process premiums, to perform actuarial and other modeling functions, to process claims and make claims payments and to prepare internal and external financial statements and information.

In addition, some of these systems include or rely on third-party systems under our direct control.

Events such as natural catastrophes, terrorist attacks, industrial accidents, third-party system or network outages or computer malware may cause our systems to fail or be inaccessible for extended periods of time.

While we have implemented business contingency and other plans to protect our systems, sustained or repeated system failures or service denials could severely limit our ability to write and process new and renewal business, provide customer service, pay claims in a timely manner or otherwise operate in the ordinary course of business.

Our operations depend on the reliable and secure processing, storage and transmission of confidential and other data and information in our computer systems and networks.

Computer malware, hackers, employee misconduct and other external hazards could expose our systems to security breaches, cyber attacks or other disruptions.

In addition, we routinely transmit and receive personal, personally identifiable, sensitive, confidential and proprietary data by electronic means and are subject to data privacy laws and regulations enacted in the jurisdictions in which we do business.

While we have implemented security measures designed to protect against breaches of security and other interference with our systems and networks, our systems and networks may be subject to significant breaches or interference.

Any such event may result in material operational disruptions as well as unauthorized access to or the disclosure or loss of our proprietary information or our customers’ data and information, which in turn may result in legal claims, regulatory scrutiny and liability, the incurrence of costs to eliminate or mitigate further exposure, the loss of customers or affiliated advisors, reputational harm or other damage to our business.

We cannot be certain that advances in criminal capabilities, discovery of new vulnerabilities, attempts to exploit vulnerabilities in our systems, data thefts, physical system or network break-ins or inappropriate access, or other developments will not compromise or breach the technology or other security measures protecting the networks and systems used in connection with our business.

We employ third-party and open-source licensed software for use in our business, and the inability to maintain these licenses, errors in the software we license or the terms of open-source licenses could result in increased costs, or reduced service levels, which would adversely affect our business.

Many of these systems and processes rely on third-party service providers or cloud-based solutions that are not located on our premises or fully under our direct control.

We and our service providers face numerous and evolving cybersecurity and operational risks that threaten the confidentiality, integrity, and availability of systems and data.

These risks include vulnerabilities in commercial software integrated into our systems or into the products and services of our suppliers, as well as increasingly sophisticated cyberattack techniques that frequently change and may originate from less regulated or remote areas of the world.

Events such as natural catastrophes, industrial accidents, terrorist attacks, power failures, computer viruses, ransomware, extortion attempts, business email compromise, or security breaches by unauthorized persons, including hackers or other threat actors, may cause our systems to fail or be inaccessible for extended periods.

These events may also result in fraudulent fund transfers, unauthorized access to or exfiltration of sensitive or proprietary information, or other material operational impacts.

We have implemented a variety of security measures, business contingency plans, and disaster recovery procedures designed to protect systems housed internally and through third-party cloud services.

However, we cannot guarantee the effectiveness of these measures.

We also monitor vendor and third-party risk, but we may fail to appropriately assess or understand the risks associated with these relationships, including the adequacy of their security and control environments.

Sustained or repeated system failures, service interruptions, or successful cyberattacks could severely limit our ability to write and process new and renewal business, provide customer service, pay claims, or otherwise operate in the ordinary course of business.

In addition, when vulnerabilities are discovered, we may be unable to remedy them promptly because attackers increasingly use tools and techniques designed to evade detection or remove forensic evidence.

Our operations also depend on the continuous availability of our physical facilities.

Disruption, damage, or loss of these facilities, for example due to natural catastrophes, utility failures, or other events, could impair our ability to maintain business functions that cannot be performed offsite or remotely.

This could compound the effects of system interruptions or cyber events.

Any such event previously discussed may result in operational disruptions as well as unauthorized access to, disclosure of, or loss of proprietary information or customers data.

Such occurrences may lead to legal claims, regulatory scrutiny or liability, reputational damage, significant costs to eliminate or mitigate further exposure, and the potential loss of customers or vendors.

Increasing requirements for public disclosure of cybersecurity incidents may also increase the harm to our business, financial condition, and results of operations.

We cannot be certain that advances in criminal capabilities, discovery of new vulnerabilities, attempts to exploit weaknesses in our systems or those of our vendors, physical break-ins, or other developments will not compromise or defeat our security measures.

As part of our normal business activities, we collect, store, and process personal information regarding employees, claimants, brokers, agents, and vendors.

As a result, we are subject to numerous federal, state, and local laws and regulations governing data privacy, security, breach notification, and the use of personal information.

These requirements continue to evolve, often becoming more stringent.

Any failure or perceived failure to comply with applicable laws, regulations, policies, or regulatory guidance could result in investigations, enforcement actions, litigation, fines, penalties, or adverse publicity.

These outcomes could erode trust in our company and adversely affect our business, financial condition, and results of operations.

We employ third-party and open-source licensed software in our business, and the inability to maintain these licenses, defects or vulnerabilities in such software, or the interruption or enforcement of open-source licenses could result in increased costs, reduced service levels, or operational disruptions, which could adversely affect our business.

Our business relies on certain third-party software obtained under licenses from other companies.

Although we believe that there are commercially reasonable alternatives to the third-party software we currently license, this may not always be the case, or it may be difficult or costly to replace.

In addition, integration of new third-party software may require significant work and require substantial investment of our time and resources.

Our use of additional or alternative third-party software would require us to enter into license agreements with third parties, which may not be available on commercially reasonable terms or at all, and add complexity to the environment.

Many of the risks associated with the use of third-party software cannot be eliminated, and these risks could negatively affect our business.

Additionally, the software powering our technology systems incorporates software covered by open-source licenses.

The terms of many open-source licenses have not been interpreted by U.S.

courts and there is a risk that the licenses could be construed in a manner that imposes unanticipated conditions or restrictions on our ability to operate our systems.

In the event that portions of our proprietary software are determined to be subject to an open-source license, we could be required to publicly release the affected portions of our source code or re-engineer all or a portion of our technology systems, each of which could reduce or eliminate the value of our technology systems.

Such risk could be difficult or impossible to eliminate, and such an event could adversely affect our business, financial condition and results of operations.

Artificial intelligence is an evolving and rapidly growing technology.

The rapid evolution of artificial intelligence ("AI") could exacerbate the information technology related risks described above, as well as alter the competitive landscape.

While we anticipate that we will continue to research and implement AI-based technology solutions to both mitigate risk and increase automation in our environment, it is possible that bad actors and/or competitors will leverage AI solutions more effectively to either exploit vulnerabilities or take market share.

Either outcome could negatively impact our business.

We are aware that generative AI tools may respond with inaccurate or fabricated information, introduce bias or fail to provide traceability of source information and have taken steps to train employees on these issues as well to avoid using these tools as primary decision processes.

We will continue to look for opportunities to deploy these tools to aid in decision making processes but cannot guarantee that the risks will be completely eliminated.

Cloud provider service failure or control weakness could adversely affect our business.

We employ cloud-based services to host the majority of our applications and intend to continue and expand our use.

As we use cloud-based services, we will rely on third-party cloud providers to maintain appropriate controls and safeguards to protect confidential information we receive, including personal, personally identifiable, sensitive, confidential or proprietary data, and the integrity and continuous operation of our proprietary technology platform.

While we conduct due diligence on these cloud providers with respect to their security and business controls, these are point-in-time assessments, and we may not have the visibility to effectively monitor the continuous implementation and efficacy of these controls.

Outside parties may be able to circumvent controls or exploit vulnerabilities, resulting in operational disruption, data loss, defects or a security event.

Operating in the cloud increases the risk of operational disruption should internet service be interrupted.

While we have implemented business contingency and other plans to facilitate continuous internet access, sustained or concurrent service denials or similar failures could limit our ability to write and process new and renewal business, provide customer service, pay claims in a timely manner or otherwise operate our business.

Any such event or failure could have a material adverse effect on our business, financial condition and results of operations.

Although we believe that there are commercially reasonable alternatives to the third-party software we currently license, such alternatives may not always be available on acceptable terms, or at all, and replacement could be difficult, costly, or time consuming to replace.

In addition, integration of new third-party software may require significant development effort and investment of time and resources and may introduce additional operational or security risks.

Our use of additional or alternative third-party software typically requires us to enter into license agreements with third parties, which may increase complexity and may not be available on commercially reasonable terms or at all.

Many of the risks associated with the use of third-party software, including cybersecurity, operational resilience, vendor concentration, and service continuity risks, cannot be fully eliminated, and these risks could negatively affect our business.

Additionally, the software powering our technology systems incorporates software components subject to open-source licenses.

The terms of many open-source licenses have not been definitively interpreted by U.S.

courts, creating uncertainty regarding the scope of the obligations they may impose and there is a risk that the licenses could be construed in a manner that imposes unanticipated conditions or restrictions on our ability to operate or modify our software.

In the event that portions of our proprietary software are determined to be subject to an open-source license, we could be required to publicly disclose affected source code, re-engineer portions of our technology systems, or discontinue certain uses, each of which could reduce or eliminate the value of our technology systems.

Such risk could be difficult or impossible to fully mitigate, and such an event could adversely affect our business, financial condition and results of operations.

Artificial intelligence is an evolving and rapidly developing technology, and its adoption presents additional risks.

The rapid evolution and increasing adoption of AI could exacerbate the information technology and cybersecurity related risks described above, as well as alter the competitive landscape.

While we continue to research and selectively implement AI-based technology solutions to enhance automation, efficiency and risk management in our environment, it is possible that bad actors and/or competitors will leverage AI solutions more effectively to either exploit vulnerabilities or take market share.

We are aware that generative AI tools may respond with inaccurate, incomplete or fabricated information, introduce bias or fail to provide traceability of source information and have taken steps to train employees on these issues and to inform on the risks of using AI tools as primary decision-making mechanisms.

We will continue to look for

opportunities to deploy these tools to aid in decision making processes but cannot guarantee that the risks associated with AI use will be fully mitigated.

Any failure to manage these risks could negatively impact our business.

We may change our underwriting guidelines or our strategy without stockholder approval.

2 unchanged sentences

If actual renewals of our existing contracts do not meet expectations, our written premiums in future years and our future results of operations could be materially adversely affected.

Many of our contracts are written for a one-year term.

Most of our contracts are written for a one-year term.

In our financial forecasting process, we make assumptions about the rates of renewal of our prior year’s contracts.

10 unchanged sentences

We could become involved in litigation with our customers, or become the target of class action lawsuits and other types of litigation, some of which involve claims for substantial or indeterminate amounts.

The outcomes of litigation are inherently uncertain and can be influenced by evolving legal trends, including third-party litigation funding.

The outcomes of litigation are inherently uncertain and can be influenced by evolving legal trends, including third-party litigation funding and social inflation.

This litigation may be based on a variety of issues, including insurance and claim settlement practices.

62 unchanged sentences

In addition, state insurance regulators have broad discretion to deny or revoke licenses for various reasons, including the violation of regulations.

In some instances, where there is uncertainty as to applicability, we follow practices based on our interpretations of regulations or practices that we believe generally to be followed by the industry.

In some instances, where there is uncertainty as to applicability, we follow practices based on our

interpretations of regulations or practices that we believe generally to be followed by the industry.

These practices may turn out to be different from the interpretations of regulatory authorities.

17 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors