Goosehead Insurance, Inc.

There have been no material changes to the risk factors disclosed in the Company's Annual Report on Form 10-K for the fiscal year ended December 31, 2024, except as follows:

Our business is dependent upon information processing systems. Security breaches, cyberattacks or other similar incidents with respect to our or our vendors' information processing systems may damage our reputation and negatively impact client retention and carrier, franchise, and Referral Partner relationships.

Our ability to provide insurance services to clients and to create and maintain comprehensive tracking and reporting of client accounts depends on our capacity to store, retrieve and process data, manage significant databases and data hygiene, and expand and periodically upgrade our information processing capabilities. As our operations evolve, we will need to continue to make investments in new and enhanced information systems. As our information system providers revise and upgrade their hardware, software and equipment technology, we may encounter difficulties in integrating these new technologies into our business. Interruption or loss of our information processing capabilities or adverse consequences from implementing new or enhanced systems could have a material adverse effect on our business, financial condition and results of operations.

In the course of providing financial services, we may electronically store, transmit or otherwise process personal information (including sensitive personal information), such as social security numbers or credit card or bank information, of clients or employees of clients. Breaches in data security or infiltration by unauthorized persons of our network security could cause interruptions in operations and damage to our reputation, among other adverse impacts. While we maintain policies, procedures and technological safeguards designed to protect the security and privacy of this information, we cannot entirely eliminate the risk of improper access to or disclosure of personal information nor the related costs we incur to mitigate the consequences from such events. Techniques used to

obtain unauthorized access or to sabotage systems change frequently. For example, attackers have used artificial intelligence to launch more targeted, automated and coordinated attacks against targets. Data privacy and cybersecurity laws, rules and regulations are matters of growing public concern and are continuously changing in the states in which we operate. The failure to adhere to or successfully implement procedures to respond to these laws, rules and regulations could result in legal liability or impairment to our reputation.

Further, despite security measures taken by us and our vendors, our systems and those of our vendors have been, and may in the future be, vulnerable to physical break-ins, unauthorized access, viruses or other disruptive problems. In the event our systems or facilities are infiltrated or damaged, our clients have experienced, and could in the future experience, data loss, financial loss and significant business interruption, which may lead to a material adverse effect on our business, financial condition and results of operations. We may be required to expend significant additional resources to modify protective measures, to investigate and remediate vulnerabilities or other exposures or to make required notifications.

Improper disclosure of confidential, personal or proprietary information, whether due to human error, misuse of information by employees or vendors, or as a result of security breaches, cyberattacks or other similar incidents with respect to our or our vendors’ systems, could result in regulatory scrutiny, legal liability or reputational harm, and could have an adverse effect on our business or operations.

We maintain confidential, personal and proprietary information relating to our company, our employees and our clients. This information includes personally identifiable information, protected health information and financial information. We are subject to laws, regulations, rules, industry standards, contractual obligations and other legal obligations relating to the collection, use, retention, security, transfer, disclosure and other processing of this information. These requirements apply to transfers of information among our affiliates, as well as to transactions we enter into with third-party vendors.

Cybersecurity breaches, cyberattacks and other similar incidents, including, among other things, computer viruses, denial of service or information attacks, worms, ransomware attacks, credential stuffing, social engineering, human error, fraud, unauthorized parties gaining access to our information technology systems, theft, malfeasance or improper access by employees or vendors, malware attacks, phishing campaigns and vulnerability exploit attempts could disrupt the security of our internal systems and business applications or those of our vendors and impair our ability to provide services to our clients and protect the privacy of their data. Any such incidents have, and may in the future, also compromise confidential business information, result in intellectual property or other confidential or proprietary information being lost or stolen, including client, employee or company data, which could harm our reputation, competitive position or otherwise adversely affect our business.

Cybersecurity risks have significantly increased in recent years, in part, because of the proliferation of new technologies, the use of the internet and telecommunications technologies to exchange information and conduct transactions, and the increased sophistication and activities of computer hackers, organized crime, terrorists, and other external parties, including foreign state and state-sponsored actors. Moreover, cybersecurity threats are constantly evolving, which makes it more difficult to detect cybersecurity incidents, assess their severity or impact in a timely manner, and successfully defend against them. The Cybersecurity threats also may see their frequency increased, and effectiveness enhanced, by the use of AI. Consequently, the risk of a cybersecurity incident has increased, and as cybersecurity threats evolve, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate or remediate any information security vulnerabilities, security breaches, cyberattacks or other similar incidents. Some of our past preventative efforts have not been, and we cannot provide assurance that our future preventative efforts or those of our vendors or service providers will be, successful, and we may not be able to anticipate all security breaches, cyberattacks or other similar incidents, detect or react to such incidents in a timely manner, implement guaranteed preventive measures against such incidents, or adequately remediate any such incident.

Although we maintain policies, procedures and technical safeguards designed to protect the security and privacy of confidential, personal and proprietary information, we cannot eliminate the risk of human error or guarantee our safeguards against employee, vendor or third-party malfeasance. The measures we implement, including our security controls over personal data and training of employees on data security, have not prevented in the past, and it is possible that they may not prevent in the future, improper access to, disclosure of, or misuse of confidential, personal or proprietary information. Moreover, while we generally perform cybersecurity due diligence on our key vendors, because we do not control our vendors and our ability to monitor their cybersecurity is limited, we cannot ensure the cybersecurity measures they take will be sufficient to protect any information we share with them. Due to applicable laws regulations, rules, industry standards or contractual obligations, we may be held responsible for security breaches, cyberattacks or other similar incidents attributed to our vendors as they relate to the information we share with them. This could cause harm to our reputation, create legal exposure, or subject us to liability under laws that protect personal data, resulting in increased costs or loss of revenue.

The occurrence of any security breach, cyberattack or other similar incident with respect to our or our vendors’ systems, or our failure to make adequate or timely disclosures to the public, regulators, law enforcement agencies or affected individuals, as applicable, following any such event, could cause harm to our reputation, subject us to additional regulatory scrutiny, expose us to civil litigation, fines, damages or injunctions or subject us to notification obligations or liability under applicable data privacy, cybersecurity and other laws, rules and regulations, resulting in increased costs or loss of commissions and fees, any of which could have a material adverse effect on our business, financial condition and results of operations. We cannot ensure that any limitations of liability provisions in our agreements with customers, vendors and other third parties with which we do business would be enforceable or adequate or would otherwise protect us from any liabilities or damages with respect to any particular claim in connection with a security breach, cyberattack or other similar incident. Additionally, we cannot be certain that our insurance coverage will be adequate for cybersecurity liabilities actually incurred, that insurance will continue to be available to us on economically reasonable terms, or at all, or that our insurer will not deny coverage as to any future claim.

Subject to the terms of the amended and restated Goosehead Financial, LLC Agreement, each LLC Unit is redeemable (along with the cancellation of the corresponding share of Class B common stock) for one share of Class A common stock.

Issuer Purchases of Equity Securities

Share repurchase activity during the three months ended March 31, 2025 was as follows (in thousands, except for average price paid per share):

(1) On April 24, 2024, our board of directors approved a share repurchase program with authorization to purchase up to $100 million of our Class A common stock through March 31, 2025.

None.

Not applicable.