Company: AIZ
Filing Date: 2025-02-20
Form Type: 10-K
Source: 0001267238-25-000008
Chunk: 82

Company: ASSURANT, INC.
Filing Date: 2025-02-20
Form: 10-K
Item: Item 1A
Chunk 82
---
 we may be unable to anticipate these techniques or implement adequate preventative measures, resulting in potential data loss or other damage to technology systems. As the breadth and complexity of the technologies we use continue to grow, and as a result of the remote and hybrid work arrangements for a significant portion of our employees, the risk of security breaches and cybersecurity incidents has increased.

Our systems have also been subject to compromise from internal threats such as improper action by employees and third parties who may have otherwise legitimate access to our systems. Our call centers subject us to additional risk from internal threats due to access to personal data. Moreover, we face the ongoing challenge of managing access controls in a complex environment. Remote and hybrid work arrangements, including the use of personal devices and home networks that are not managed by the organization’s security control framework, bypass certain physical security controls for our employees and the employees of our vendors who have access to sensitive information. While additional controls have been put in place, they may not be sufficient to discover compromises that occur due to the loss of physical controls. The latency of a compromise is often measured in months, and we may not be able to detect a compromise in a timely manner. We could experience significant financial and reputational harm as a result of operational resiliency issues, including if our technology systems are breached, sensitive client or Company data are compromised, modified, rendered inaccessible for any period of time or made public, or if we fail to make adequate disclosures to the public or law enforcement agencies following any such event.

Our data protection measures may not be effective to protect our network and systems from external and internal threats. Should an attacker gain access to our network using compromised credentials of an authorized user or otherwise, or gain entry as a result of a zero-day exploit or other vulnerabilities that may exist in our systems environment, which has occurred from time to time, we are at risk that the attacker might successfully leverage that access to compromise additional systems and data. Certain measures that could increase the security of our systems take significant time and resources to deploy broadly and may not be effective against an attack. Additionally, our policies, procedures and technical safeguards may be insufficient to prevent or detect improper access to confidential, personal or proprietary information and other cybersecurity incidents, assess the severity or impact of any such incidents or appropriately respond in a timely manner. The inability to implement, maintain and upgrade effective protective measures and other safeguards or adequately respond to a breach could have a material adverse effect on our business.

Although we continue to invest in security and engage in best practices for software development, code vulnerabilities