Company: AIZ
Filing Date: 2025-02-20
Form Type: 10-K
Source: 0001267238-25-000008
Chunk: 83

Company: ASSURANT, INC.
Filing Date: 2025-02-20
Form: 10-K
Item: Item 1A
Chunk 83
---
 may still be introduced into production environments. Our technology systems must be continually patched and upgraded to protect against vulnerabilities, including zero-day threats, and we are at risk that cyber attackers exploit these vulnerabilities before they have been addressed. Due to the large number and age of the systems and platforms that we operate and the increased frequency with which vendors issue security patches to their products, the need to test patches and, in some cases coordinate with clients and vendors, before they can be deployed, we are at risk that we cannot deploy these patches to remediate these vulnerabilities in a timely and effective manner. We are dependent on vendors and other third parties, such as cloud service providers, to keep their systems patched in order to protect our data. We have vendors and other third parties who receive data from us in connection with the services we offer our customers. In addition, we have migrated certain data, and may increasingly migrate data, to the cloud hosted by third-party providers. We are at risk of a cybersecurity incident involving a vendor or other third party, which could result in a breakdown of such third party’s data protection measures or access to our infrastructure through the third party. To the extent that a vendor or third party suffers a cybersecurity incident that compromises their operations, our data and our customers’ data could be compromised or we may experience service interruption. Any failure related to these activities and operational resiliency could have a material adverse effect on our business.

The process of integrating the technology systems of the businesses we acquire is complex and exposes us to additional risk. For instance, we may not adequately identify weaknesses in an acquired entity’s technology systems, either before or after the acquisition, which could affect the value we are able to derive from the acquisition, expose us to unexpected liabilities or make our own systems more vulnerable to a cybersecurity incident. We may be unable to integrate the systems of the 

35

businesses we acquire into our environment in a timely manner, which could further increase these risks until such integration takes place.

We have from time to time experienced cybersecurity incidents, such as malware incursions, distributed denial of service attacks, hardware misconfigurations, zero-day exploits, credential harvesting, social engineering attacks, employee misconduct and incidents resulting from human error, such as loss of portable and other data storage devices. Like many companies, we are subject to regular phishing email and social media engineering campaigns directed at our employees that have become more sophisticated and successful, partly through the use of artificial intelligence, and can result in malware infections and financial and data losses. Although some of these incidents have