Cybersecurity in the Age of AI, Extortion & Exposure | Lord Bernard Hogan-Howe & David Ferbrache OBE | Wealth Office
财富办公室

Episodes / Wealth Office X

Cybersecurity in the Age of AI, Extortion & Exposure

Lord Bernard Hogan-Howe and David Ferbrache OBE explain why extortion, impersonation and oversharing now place family offices on the front line of cyber risk.

Cybersecurity in the Age of AI, Extortion & Exposure▶ Watch

Episode overview

In this Wealth Office X conversation, Michael Macfarlane brings together Lord Bernard Hogan-Howe, former Commissioner of the Metropolitan Police in London, and David Ferbrache OBE, Managing Director of Beyond Blue, to examine cyber risk for private wealth and business-owning families. Macfarlane's opening proposition is that, for these families, cyber risk has become a strategic condition. Capital moves globally and digitally, identity is exposed by default and attacks are increasingly automated. Losses are often irreversible and frequently invisible until it is too late, yet most family offices remain small, trust-based teams relying on a handful of advisers.

Both guests describe a threat that is changing shape. Ferbrache says surveys suggest around a third of family offices experience a cyber incident each year, and that criminal groups are moving from encrypting systems towards stealing data and using it for extortion, sometimes aimed at individual family members. Artificial intelligence is improving their research and their impersonation, from well-crafted phishing lures to simulated voices and video. Hogan-Howe notes that the small size of a family office is reassuring because everyone trusts each other, but that the same trust can amplify an insider threat. Both see next-generation oversharing online as a source of intelligence for criminals, with physical as well as digital consequences.

The discussion then moves from threat to response. Ferbrache argues that cyber security cannot be left to IT alone, and that principals should be involved in thinking through scenarios because the hardest damage to repair is reputational and personal. Hogan-Howe recommends assuming an attack will get through, building trusted relationships before a crisis and knowing exactly whom to call in each jurisdiction. Both describe good security as unobtrusive, allowing a family to travel, associate and do business while the risk is managed around them.

Key ideas

Family offices now sit near the front line

Lord Bernard Hogan-Howe suggests that family offices now hold wealth comparable to institutions, with less infrastructure to protect it. He attributes this to cost rather than carelessness. A lean office buys in the skills it does not hold, and security is one more area where spending is limited. He adds that multiple international bases can offer jurisdictional protection while making an office more vulnerable the more widely it is dispersed.

Extortion is overtaking simple ransom

David Ferbrache OBE describes organised crime groups moving beyond encrypting data for ransom. Increasingly they sample the data they find, work out where they have landed and look for the most effective form of extortion. For family offices that brings reputational as well as financial damage. He also reports attempts to blackmail key executives and family members directly, and says the time between initial compromise and attack is shortening.

AI is making impersonation easier

Ferbrache says artificial intelligence helps criminals scan many systems quickly and research targets thoroughly, producing credible phishing lures and, at times, simulated video and audio. Impersonation is increasingly the source of damage. He describes law and accountancy firms being compromised so that attackers can email clients with the firms' credibility. Macfarlane calls it a hijacking of trust, and Ferbrache agrees. Hogan-Howe adds that AI is starting to defeat biometric safeguards.

Early warning signals are easy to miss

Hogan-Howe recalls a recent case in which a third-party provider noticed that a routine data download, normally fifteen minutes long, had been running for about four hours. The organisation did not treat the warning as seriously as it might have. Such signals are often mistaken for system faults. He argues that staff should be sensitised to unusual signals, because time is the most damaging factor as data and money are lost.

Oversharing becomes operational intelligence

Macfarlane describes older family members who keep a low profile while the next generation shares locations and associations online. Hogan-Howe notes that software can identify where an image was taken, linking cyber risk to physical risks such as kidnap. Ferbrache calls the resulting analysis pattern of life. Neither argues for withdrawing from social media. Ferbrache suggests simple measures, such as avoiding geotagged images and posting after leaving a place.

Cyber security is more than an IT issue

Ferbrache warns against delegating security to a technical function alone, which disconnects it from what matters to the family. Basic hygiene, often delivered through a managed security provider, still has to be right. The starting point, in his view, is identifying the crown jewels and the worst-case scenarios. Because reputational damage falls on the family, he argues that principals should be involved in thinking those scenarios through.

Assume a breach and build relationships early

Hogan-Howe advises assuming that an attack will happen and will get through. He favours an initial assessment of gaps followed by advisers who work alongside the team, describing a relationship more than a contract. He highlights resilience, including deputies during long incidents, and urges principals to ask exactly who would be contacted if an incident struck abroad. If the answer sounds woolly, he says, work is needed.

In their words

It's a cost until you need it. It's an investment when the event happens.

— Lord Bernard Hogan-Howe, Wealth Office

My suggestion is on cyber, assume it will happen and that they will get through, because if you think the opposite, then you're probably not going to take it as seriously as you might.

— Lord Bernard Hogan-Howe, Wealth Office

If any part of that system is an insider threat, then in fact that might amplify the threat rather than reduce it.

— Lord Bernard Hogan-Howe, Wealth Office

So cyber for me is now a much, much broader piece. It's about what really matters to you, what are the real assets that are of concern.

— David Ferbrache OBE, Wealth Office

It's a hijacking of trust, exactly.

— David Ferbrache OBE, Wealth Office

Quotes are taken word for word from the episode transcript.

Questions this conversation answers

How common are cyber incidents among family offices?

David Ferbrache OBE says most surveys suggest that about a third of family offices experience a cyber incident each year. He adds that incidents now often involve data theft and extortion as well as disruption, with reputational consequences. Michael Macfarlane observes that many incidents are first identified by third parties, such as a bank, which can leave the family behind the curve.

How is artificial intelligence changing the cyber threat to wealthy families?

According to Ferbrache, AI lets criminal groups scan systems quickly and research targets in depth, producing well-crafted phishing lures and sometimes deepfake video or audio. Lord Bernard Hogan-Howe notes that AI can replicate a person's voice and appearance, which is starting to defeat biometric safeguards. Both describe a shift towards impersonation and the exploitation of trusted relationships, including those with professional advisers.

Who should take responsibility for cyber security in a family office?

Ferbrache argues that it cannot sit with IT alone. In many circumstances he believes the principal should be directly involved, because reputational and personal damage falls on the family. Hogan-Howe suggests principals test their arrangements by asking who exactly would be contacted if an incident occurred abroad. Both recommend specialist advice covering scenarios and response as well as technical protection.