RADIAN GROUP INC

Table of ContentsGlossaryPart I. Item 1A. Risk Factors

Risks Related to Information Technology and Cybersecurity

Our information technology systems may fail or become outmoded, be temporarily interrupted or otherwise cause us to be unable to meet our customers’ demands.

Our business is highly dependent on the effective operation of our information technology systems, which are vulnerable to damage or interruption from power outages, computer and telecommunications failures, computer viruses, cyberattacks and security incidents or breaches, catastrophic events and errors in usage. Although we have disaster recovery and business continuity plans in place, we may not be able to adequately execute these plans in a timely fashion. Further, as various systems, technologies, software and applications become outdated or new technology is required, including as a result of end-of-life or end-of-support, we may not be able to replace or introduce them as quickly as needed or in a cost-effective and timely manner.

Our customers generally require that we provide an increasing number of our products and services electronically and, as such, we are dependent on e-commerce and other technologies to deliver our products and services. Our ability to meet the needs of our customers depends on our ability to keep pace with technological advances and to invest in new technology as it becomes available or to otherwise upgrade our technological capabilities. Accordingly, we may not satisfy our customers’ requirements if we fail to invest sufficient resources or are otherwise unable to maintain and upgrade our technological capabilities. Further, customers may choose to do business only with business partners with which they are technologically compatible and may choose to retain existing relationships with mortgage insurance or mortgage and real estate services providers rather than invest the time and resources to on-board new providers. As a result, technology can represent a potential barrier to signing new customers. We are also dependent on our ongoing relationships with key technology providers, including their products and technologies, and their ability to support those products and technologies. The inability of these providers to successfully provide and support those products could have an adverse impact on our business and results of operations.

Because we rely on our information technology systems for many critical functions, including connecting with our customers, if such systems were to fail, experience a prolonged interruption or become outmoded, we may experience a significant disruption in our operations and in the business we receive, which could have a material adverse effect on our business, reputation and future prospects, financial condition and operating results.

We could incur significant liability or reputational harm if the security of our information technology systems, or of our third-party vendors or service providers, is breached, including as result of a cyberattack, or we otherwise fail to protect confidential information, including personally identifiable information that we maintain.

We rely on information technology systems to process, transmit, store and protect the electronic information, financial data and proprietary models that are critical to our business. Furthermore, a significant portion of the communications and business transmissions between us and our employees, customers, business partners and service providers depends on information technology and electronic information exchange.

Our transition to a hybrid work environment has further increased our reliance on information technology and our exposure to the risk of cybersecurity threats and data security incidents.

Our information technology systems may be vulnerable to physical or electronic intrusions. We experience cyber activity directed at our computer systems, software, networks and network users on a daily basis. This malicious activity includes attempts at unauthorized access, implantation of computer viruses or malware and denial-of-service attacks that are intended to lead to interruptions and delays in our service and operations, as well as loss, misuse or theft of personal information and other data, confidential information or intellectual property. In addition, on a global scale, other forms of social engineering and insider threats designed to obtain confidential information, destroy data, disrupt or degrade service, sabotage systems or to cause other damage have also grown in volume and level of sophistication. Such attacks may also increase in response to actions taken by the U.S. in response to geopolitical events, including the conflicts between Russia and Ukraine and the Israeli-Hamas war. The risks of cyberattacks and information security incidents and breaches continue to increase in businesses such as ours due to, among other things, the proliferation of new technologies and the use of digital channels to conduct our business, including connectivity with customer devices that are beyond our security control systems and the use of portable computers or mobile devices which can be stolen, lost or damaged. We expect attacks to continue accelerating in both frequency and sophistication with increasing use by actors of tools and techniques that could hinder our ability to identify, investigate and recover from incidents.

We also rely on numerous third-party service providers to conduct important aspects of our business operations, and we face similar risks relating to them. While we regularly conduct security assessments on these third-party vendors, we cannot be certain that their information security protocols are sufficient to withstand a cyberattack or other security breach. We also cannot be certain that we will receive timely notification of such cyberattacks or other security breaches. In addition, in order to access our products and services, our clients may use computers and other devices that are beyond our security control systems.

We and many of the third parties we work with rely on open-source software and libraries that are integrated into a variety of applications, tools and systems, which may increase our exposure to vulnerabilities. Additionally, outside parties may

Table of ContentsGlossaryPart I. Item 1A. Risk Factors

use social engineering or fraudulent communications to employees, vendors, partners, or users to try and obtain sensitive or confidential information in order to gain access to data. Any attempt by bad actors to obtain our data or intellectual property, disrupt our service, or otherwise access our systems, or those of third parties we use, if successful, could harm our business, be expensive to remedy and damage our reputation.

As part of our business, we, and certain subsidiaries, affiliates, and third-party vendors maintain large amounts of confidential information, including personally identifiable information on borrowers, consumers and our employees. As a result, we are subject to numerous laws and regulations designed to protect this information, such as U.S. federal and state laws governing the protection of personally identifiable information, and to significant contractual commitments with our customers. These laws and regulations are increasing in complexity and number and the contractual commitments are increasing in requirements and in demands on our businesses. If the security of our information technology or the technology of our third-party vendors is breached, including as a result of a cyberattack, it could result in the loss or misuse of this information, which could, in turn, result in potential regulatory actions or litigation, including material claims for damages, as well as interruption to our operations and damage to our customer relationships and reputation. While we have information security policies, controls and systems in place in order to attempt to prevent, detect and respond to unauthorized use or disclosure of confidential information, including personally identifiable information, there can be no assurance that such unauthorized use or disclosure will not occur either through the actions of third parties or our employees. Any cybersecurity event or other compromise of the security of our information technology systems, or unauthorized use or disclosure of confidential information, could subject us to liability, regulatory scrutiny and action, damage our reputation and negatively affect our ability to attract and maintain customers, and could have a material adverse effect on our business prospects, financial condition and results of operations.

We use statistical models, including artificial intelligence and machine learning models, to assist our decision making in key areas, such as underwriting, claims and pricing, but actual results could differ materially from the model outputs and related analyses.

We use various modeling and advanced learning techniques along with data analytics to analyze and estimate loss trends and other risks associated with our underwriting and claims operations. We use the modeled outputs and related analyses to assist us in certain decisions involving underwriting, pricing, claims, reserving and risk distribution. Our modeled outputs and related analyses may contain inaccuracies which could adversely affect our businesses. As with many technological innovations, artificial intelligence (‘’AI”) and machine learning present risks and challenges that could affect their adoption as well as our business. The assumptions used in deriving modeled outputs and related analyses are subject to risks and uncertainties, including, limitations of historical internal and industry data as well as increased risks associated with intellectual property infringement or misappropriation, data privacy and operational risks. Additionally, in general, AI algorithms may be flawed and datasets underlying AI algorithms may be insufficient or may contain biased information. If our use of AI, machine learning and statistical models produce analyses or recommendations that are or are alleged to be deficient, inaccurate, or biased, it could subject us to liability or regulatory scrutiny, and our reputation, business, financial condition, and results of operations may be adversely affected.