Wilson Bank Holding Co

Cybersecurity risks for banking organizations have significantly increased in recent years in part because of the proliferation of new technologies, and the use of the Internet and telecommunications technologies to conduct financial transactions. For example, cybersecurity risks may increase in the future as the Company continues to increase its mobile-payment and other Internet-based product offerings and expand its internal use of cloud-based products and applications. Even the most advanced internal control environment may be vulnerable to compromise. Targeted social engineering attacks are becoming more prevalent and sophisticated, and are extremely difficult to prevent. The rapid evolution and increased adoption of generative artificial intelligence is further increasing risks in this area, including by making fraud detection more difficult, particularly with detection devices that use voice recognition or authentication. The techniques used by bad actors change frequently, may not be recognized until launched and may not be recognized until well after a breach has occurred. Additionally, the existence of cyber-attacks or security breaches at third parties with access to the Company’s data, such as vendors, may not be disclosed to the Company in a timely manner. Consistent with industry trends, the Company remains at risk for attempted electronic fraudulent activity, as well as attempts at security breaches and cybersecurity-related incidents. The Company spends significant capital and other resources to protect against the threat of security breaches and computer viruses, and may be required to spend significant capital and other resources to alleviate problems caused by security breaches or viruses. To the extent that the Company’s activities or the activities of its vendors, regulators or customers involve the storage and transmission of confidential information, security breaches (including breaches of security of customer, vendor or regulatory systems and networks) and viruses could expose the Company

Cybersecurity risks for banking organizations have significantly increased in recent years in part because of the proliferation of new technologies, and the use of the Internet and telecommunications technologies to conduct financial transactions. For example, cybersecurity risks may increase in the future as the Company continues to increase its mobile-payment and other Internet-based product offerings and expand its internal use of cloud-based products and applications. Even the most advanced internal control environment may be vulnerable to compromise. Targeted social engineering attacks are becoming more prevalent and sophisticated, and are extremely difficult to prevent. The rapid evolution and increased adoption of generative artificial intelligence is further increasing risks in this area, including by making fraud detection more difficult, particularly with detection devices that use voice recognition or authentication. The techniques used by bad actors change frequently, may not be recognized until launched and may not be recognized until well after a breach has occurred. Additionally, the existence of cyber-attacks or security breaches at third parties with access to the Company’s data, such as vendors, may not be disclosed to the Company in a timely manner. Consistent with industry trends, the Company remains at risk for attempted electronic fraudulent activity, as well as attempts at security breaches and cybersecurity-related incidents. The Company spends significant capital and other resources to protect against the threat of security breaches and computer viruses, and may be required to spend significant capital and other resources to alleviate problems caused by security breaches or viruses. To the extent that the Company’s activities or the activities of its vendors, regulators or customers involve the storage and transmission of confidential information, security breaches (including breaches of security of customer, vendor or regulatory systems and networks) and viruses could expose the Company to claims, litigation and other possible liabilities. Any inability to prevent or promptly detect security breaches or computer viruses could

Cybersecurity risks for banking organizations have significantly increased in recent years in part because of the proliferation of new technologies, and the use of the Internet and telecommunications technologies to conduct financial transactions. For example, cybersecurity risks may increase in the future as the Company continues to increase its mobile-payment and other Internet-based product offerings and expand its internal use of cloud-based products and applications. Even the most advanced internal control environment may be vulnerable to compromise. Targeted social engineering attacks are becoming more prevalent and sophisticated, and are extremely difficult to prevent. Generative artificial intelligence is further increasing risks in this area, including by making fraud detection more difficult, particularly with detection devices that use voice recognition or authentication. The techniques used by bad actors change frequently, may not be recognized until launched and may not be recognized until well after a breach has occurred. Additionally, the existence of cyber-attacks or security breaches at third parties with access to the Company’s data, such as vendors, may not be disclosed to the Company in a timely manner. Consistent with industry trends, the Company remains at risk for attempted electronic fraudulent activity, as well as attempts at security breaches and cybersecurity-related incidents. The Company spends significant capital and other resources to protect against the threat of security breaches and computer viruses, and may be required to spend significant capital and other resources to alleviate problems caused by security breaches or viruses. To the extent that the Company’s activities or the activities