RADIAN GROUP INC

Our information technology systems may fail or become outmoded, be temporarily interrupted or otherwise cause us to be unable to meet our customers’ demands or to operate our business.

Our business is highly dependent on the effective operation of our information technology systems, which are vulnerable to damage or interruption from power outages, computer and telecommunications failures, computer viruses, cyberattacks and security incidents or breaches, catastrophic events and errors in usage. Although we have disaster recovery and business continuity plans in place, we may not be able to adequately execute these plans in a timely fashion. Further, as various systems, technologies, software and applications become outdated or new technology is required, including as a result of end-of-life or end-of-support, we may not be able to replace or introduce them as quickly as needed or in a cost-effective and timely manner.

Our customers generally require that we provide an increasing number of our products and services electronically and, as such, we are dependent on e-commerce and other technologies to deliver our products and services. Our ability to meet the needs of our customers depends on our ability to keep pace with technological advances and to invest in new technology as it becomes available or to otherwise upgrade our technological capabilities. Accordingly, we may not satisfy our customers’ requirements if we fail to invest sufficient resources or are otherwise unable to maintain and upgrade our technological capabilities. Further, customers may choose to do business only with business partners with which they are technologically compatible and may choose to retain existing relationships with mortgage insurance or mortgage and real estate services providers rather than invest the time and resources to on-board new providers. With respect to our Specialty Insurance business, Lloyd’s market modernization programs and digital trading initiatives driven by our broker partners require modern and up-to-date technology to leverage, resulting in a need for us to continue to invest in innovation and currency. As a result, technology can represent a potential barrier to signing new customers and growing relationships with existing customers and other parties, including brokers. We are also dependent on our ongoing relationships with key technology providers, including their products and technologies, and their ability to support those products and technologies. The inability of these providers to successfully provide and support those products could have an adverse impact on our business and results of operations.

Because we rely on our information technology systems for many critical functions, including connecting with our customers, if such systems were to fail, experience a prolonged interruption or become outmoded, we may experience a significant disruption in our operations and in the business we receive, which could have a material adverse effect on our business, reputation and future prospects, financial condition and operating results.

We could incur significant liability or reputational harm if the security of our information technology systems, or of our third-party vendors or service providers, is breached, including as result of a cyberattack, or we otherwise fail to protect confidential information, including personally identifiable information that we maintain.

We rely on information technology systems to process, transmit, store and protect the electronic information, financial data and proprietary models that are critical to our business. Furthermore, a significant portion of the communications and business transmissions between us and our employees, customers, business partners and service providers depends on information technology and electronic information exchange.

As our work environment includes a hybrid, off-site working environment for many employees, our reliance on information technology and our exposure to the risk of cybersecurity threats and data security incidents have further increased.

Our information technology systems may be vulnerable to physical or electronic intrusions. We experience cyber activity directed at our computer systems, software, networks and network users on a daily basis. This malicious activity includes attempts at unauthorized access, implantation of computer viruses or malware and denial-of-service attacks that are intended to lead to interruptions and delays in our service and operations, as well as loss, misuse or theft of personal information and other data, confidential information or intellectual property. In addition, on a global scale, other forms of social engineering and insider threats designed to obtain confidential information, destroy data, disrupt or degrade service, sabotage systems or to cause other damage have also grown in volume and level of sophistication. Such attacks may also increase in response to actions taken by the U.S. in response to geopolitical events, such as the conflicts between Russia and Ukraine and in the Middle East. The risks of cyberattacks and information security incidents and breaches continue to increase in businesses such as ours due to, among other things, the proliferation of new technologies and the use of digital channels to conduct our business, including connectivity with customer devices that are beyond our security control systems and the use of portable computers or mobile devices that can be stolen, lost or damaged. We expect attacks to continue accelerating in both frequency and sophistication with increasing use by actors of tools and techniques that could hinder our ability to identify, investigate and recover from incidents.

We also rely on numerous third-party service providers to conduct important aspects of our business operations, and we face similar risks relating to them. While we regularly conduct security assessments on these third-party vendors, we cannot be certain that their information security protocols are sufficient to withstand a cyberattack or other security breach. We also cannot be certain that we will receive timely notification of such cyberattacks or other security breaches. In addition, to access our products and services, our clients may use computers and other devices that are beyond our security control systems.

We and many of the third parties we work with rely on open-source software and libraries that are integrated into a variety of applications, tools and systems, which may increase our exposure to vulnerabilities. Additionally, outside parties may use social engineering or fraudulent communications to employees, vendors, partners or users to try and obtain sensitive or confidential information in order to gain access to data. Any attempt by bad actors to obtain our data or intellectual property, disrupt our service, or otherwise access our systems, or those of third parties we use, if successful, could harm our business, be expensive to remedy and damage our reputation.

As part of our business, we, and certain subsidiaries, affiliates and third-party vendors maintain large amounts of confidential information, including personally identifiable information on borrowers, consumers and our employees. As a result, we are subject to numerous laws and regulations designed to protect this information, such as laws governing the protection of personally identifiable information, and to significant contractual commitments with our customers. These laws and regulations are increasing in complexity and number and the contractual commitments are increasing in requirements and in demands on our businesses. If the security of our information technology or the technology of our third-party vendors is breached, including as a result of a cyberattack, it could result in the loss or misuse of this information, which could, in turn, result in potential regulatory actions or litigation, including material claims for damages, as well as interruption to our operations and damage to our customer relationships and reputation. While we have information security policies, controls and systems in place in order to attempt to prevent, detect and respond to unauthorized use or disclosure of confidential information, including personally identifiable information, there can be no assurance that such unauthorized use or disclosure will not occur either through the actions of third parties or our employees. Any cybersecurity event or other compromise of the security of our information technology systems, or unauthorized use or disclosure of confidential information, could subject us to liability, regulatory scrutiny and action, damage our reputation and negatively affect our ability to attract and maintain customers, and could have a material adverse effect on our business prospects, financial condition and results of operations.

Our Specialty Insurance business exposes us to additional information technology and cybersecurity risks. As a U.K. based specialty insurer and reinsurer, Inigo operates through the Lloyd’s of London market and is subject to additional information technology and cybersecurity risks arising from its reliance on market-wide platforms, delegated authority arrangements, and third-party service providers that support underwriting, claims handling, bordereaux processing and regulatory reporting. Disruption, failure or cybersecurity incidents affecting Lloyd’s market infrastructure or key shared service providers could impair our ability to conduct business, meet regulatory expectations or service policyholders, even where Inigo’s own internal systems are not directly impacted. In addition, Inigo’s operations involve the exchange of data across multiple jurisdictions and counterparties, including brokers, coverholders, reinsurers and Lloyd’s. This increases exposure to data security, data quality and access-control risks, particularly where systems, controls or cybersecurity standards vary across third parties. A cybersecurity incident or data compromise affecting a delegated authority or other market participant could result in operational disruption, regulatory scrutiny, reputational harm or financial loss.

Inigo is also subject to U.K. data protection, cybersecurity and operational resilience requirements, including those applicable to firms operating within the Lloyd’s market. The evolving nature of these requirements, combined with increasing expectations around cyber resilience, incident response and third-party risk management, may increase compliance costs and operational complexity, and failures to meet such expectations could adversely affect our business, reputation or financial condition.