HORACE MANN EDUCATORS CORP /DE/

Except as set forth below, we believe there are no material changes from the risk factors as previously disclosed in Part I - Item 1A of our Annual Report on Form 10-K for the year ended December 31, 2025.

Cybersecurity

Cybersecurity breaches could have an adverse effect on our business and reputation.

Cybersecurity threats and incidents have increased in recent years in frequency, levels of persistence, sophistication and intensity, and we may be subject to heightened cyber-related risks. Our business depends on the proper functioning and availability of our information technology platform, including communications and data processing systems, our proprietary systems, and systems of our third-party service providers. We and our service providers collect, process, store and transmit sensitive personal, financial, health and other confidential information relating to our policyholders, customers, employees and business partners, as well as our proprietary business information. We have implemented and maintain what we believe to be reasonable security measures, but we cannot guarantee that the controls and procedures we have in place to protect or recover our respective systems and the information stored on such systems will be effective, successful or sufficiently rapid to avoid harm to our business. Moreover, while we generally perform cybersecurity due diligence on our key service providers, we cannot ensure the cybersecurity measures they take will be sufficient to protect any information we share with them. Our service providers’ use of AI, including AI capabilities embedded in their products and services, may introduce additional vulnerabilities or expose information to uses or parties beyond our visibility or control. Due to applicable laws, regulations, rules, standards and contractual obligations, we may be held responsible for cyber-attacks, security breaches or other similar incidents attributed to our service providers as they relate to the information we share with them.

Cybersecurity threats are evolving in nature and becoming increasingly difficult to detect, and may come from a variety of sources, including organized criminal groups, “hacktivists,” terrorists, and nation state-supported actors. These threats include, among other things, computer viruses, worms, malware, ransomware, denial of service attacks, defective software, credential stuffing, social engineering, phishing attacks, human error, fraud, theft, or improper access by employees or service providers, and other similar threats. Furthermore, cyber-attacks increasingly involve the use of artificial intelligence (AI) and machine learning, including generative AI, with bad actors using these technologies to launch more automated, targeted, and coordinated attacks.

We have established AI governance, including a cross-functional AI Governance and Risk Committee and policies governing the use of AI tools. AI use by employees, contractors and service providers can create cybersecurity and data protection risks, including through tools used without organizational approval or oversight (“shadow AI”). These risks include exposing sensitive information, granting inappropriate access to systems or data, and enabling AI agents to take unintended actions or modify records. Such activities may compromise information and systems, even when data remains within our environment. Our policies, controls and training are designed to address these risks but may not identify or prevent all inappropriate uses.

Any cybersecurity incident, including system failure, cyber-attacks, security breaches, disruption by malware or other damage, with respect to our or our service providers’ information technology systems, could interrupt or delay our operations, result in a violation of applicable cybersecurity, privacy, data protection or other laws, regulations, rules, standards or contractual obligations, damage our reputation, cause a loss of customers or expose sensitive customer data, give rise to civil litigation, injunctions, damages, monetary fines or other penalties, subject us to additional regulatory scrutiny or notification obligations, and/or increase our compliance costs, any of which could adversely affect our business, financial conditions and results of operations.

We may not be able to anticipate all cyber-attacks, security breaches or other similar incidents, detect or react to such incidents in a timely manner, or adequately remediate any such incident. It may also take considerable time for us to investigate and evaluate the full impact of cyber-attacks, particularly for sophisticated attacks, which may inhibit our ability to provide prompt, full, and reliable information about cybersecurity incidents to our customers, regulators, and the public. Limitations in logging, record retention or attribution of automated activity may prevent us from fully reconstructing and assessing the full scope and impact of such incidents. In addition, recent disclosure requirements add additional risk that bad actors might use the information with malicious intent, exacerbating the impacts of a breach. While management is not aware of any cyber-attack, security breach or other similar incident that has had a material effect on our operations, there can be no assurances that such an incident that could have a material impact on us will not occur in the future.

Further, the cybersecurity, privacy and data protection regulatory environment is evolving, and it is likely that the costs of complying with new or developing regulatory requirements will increase. For example, we operate in a number of jurisdictions with strict cybersecurity, privacy, data protection and other related laws, regulations, rules and standards, which could be violated in the event of a significant cyber-attack, security breach or other similar incident affecting personal, proprietary or confidential information or in the event of noncompliance by our personnel with such obligations. The use of AI by us or our service providers may further complicate compliance with requirements governing the collection, use, retention, sharing and protection of information.

We cannot ensure that any limitations of liability provisions in our agreements with clients, service providers and other third parties with which we do business would be enforceable or adequate or otherwise protect us from any liabilities or damages with respect to any claim in connection with a cyber-attack, security breach or other similar incident. In addition, while we maintain insurance that would mitigate the financial loss under such scenarios, providing what we believe to be appropriate policy limits, terms and conditions, we cannot guarantee that our insurance coverage will be adequate for all financial and non-financial consequences from a cybersecurity event, including an AI-related event, that insurance will continue to be available to us on economically reasonable terms, or at all, or that our insurer will not deny coverage as to any future claim.

Artificial Intelligence Risks

Our use of artificial intelligence could adversely affect our business, regulatory compliance and reputation.

Our increasing use of AI technologies and the use of AI by our third-party service providers introduces risks that could impact our business operations, regulatory compliance, financial performance, and customer relationships. These risks include potential inaccuracies in AI-driven processes, increased regulatory scrutiny, unintended biases, data privacy and security concerns, operational disruptions, and broader ethical considerations.

AI systems, including generative AI, may produce inaccurate, incomplete, misleading or fabricated outputs, rely on flawed, biased or outdated data, or operate in ways that are difficult to explain, validate or reproduce. Overreliance on these systems, insufficient human oversight, or failure to identify and correct errors could adversely affect business decisions, customer communications, financial reporting or other processes. To the extent AI is used in underwriting, pricing, claims handling or other insurance-related activities, errors or unintended biases could result in inappropriate or discriminatory outcomes, customer harm, regulatory action or litigation.

Our ability to manage these risks depends in part on identifying where and how AI is used, establishing appropriate access and data restrictions, evaluating third-party technologies, and maintaining effective testing, monitoring and human oversight. See also the cybersecurity risk factor above regarding unauthorized use of AI, including "shadow AI", and AI agents. AI capabilities may also be introduced through changes to existing third-party products and services, limiting our ability to identify and evaluate their use promptly. Failures, outages, changes in functionality or terms of use, or discontinuation of third-party AI services could disrupt affected processes or increase our costs.

The use of AI may also expose us to claims concerning intellectual property infringement, ownership or permitted use of data and AI-generated content, confidentiality, or other rights. We may have limited ability to determine the sources of data used to develop third-party models or to obtain adequate contractual protections or recovery from providers.

Evolving and increasingly complex AI-related laws, regulations, and industry standards may increase our compliance costs and regulatory exposure, and failure to maintain effective governance, oversight, and risk controls could materially and adversely affect our business, results of operations, or reputation. While we seek to implement AI responsibly and consistent with our AI governance policies, there can be no assurance that AI-related risks will not affect our business, reputation, or compliance obligations.

Further, AI technologies also have the potential to materially alter the competitive landscape. Specifically, there is a risk that existing or new market participants can utilize AI technology to reduce their operating costs and accelerate speed to market for new market participants.