Lord Bernard Hogan-Howe, former Commissioner of the Metropolitan Police in London, approaches cyber security with a policing instinct. Digital crime can be terrifying because of its scale and speed, he says, yet it always has a human element. There is a motive behind every attack and usually a finger on the button. That perspective, set out in a Wealth Office X conversation with Michael Macfarlane and David Ferbrache OBE, leads him to a set of practical habits for family offices centred on mindset, time and trust.

Cost or investment

Hogan-Howe begins with economics. Family offices, he suggests, hold wealth comparable to institutions, with less infrastructure to keep it safe. He attributes that to cost rather than any lack of care. A small, efficient office will not have an HR department and will buy in many of the skills it needs. Security is one more area in which a nimble unit limits its spending.

It's a cost until you need it. It's an investment when the event happens.

— Lord Bernard Hogan-Howe, Wealth Office

He frames the decision as a risk-based assessment of whether the investment is wise now. He also notes that the international footprint of many family offices cuts both ways. Multiple bases can offer a degree of jurisdictional protection, and they make an office more vulnerable the more widely dispersed it becomes.

Planning for the breach

His central recommendation concerns the starting assumption. One can assume an attack will not happen, or assume that it will.

My suggestion is on cyber, assume it will happen and that they will get through, because if you think the opposite, then you're probably not going to take it as seriously as you might.

— Lord Bernard Hogan-Howe, Wealth Office

The assumption matters most in the early hours of an incident. Hogan-Howe describes a case from within the past year or so in which the first warning came from a third-party provider. A routine data download that normally took fifteen minutes had been running for about four hours and still had not finished. The provider flagged it, and the organisation did not take it as seriously as it might have. Signals like this are easily read as a system fault, he says, when they are often a sign that someone is attacking. Time is what does the damage, because data and money may be draining away while people work out what has gone wrong.

He is careful about the organisations involved. In his experience they are usually good organisations staffed by people who are very good at their profession. What they are less used to is responding when someone attacks them aggressively. Their job is to bank or to sell, and a crisis tests something different.

Trust as strength and weakness

Trust runs through his account in two directions. The small size of a family office is reassuring because everyone knows and trusts each other. Yet if any part of that system is an insider threat, he says, the closeness might amplify the threat rather than reduce it. People can come to trust each other so much that they take risks they probably should not. He suggests that offices adopt a mindset that anticipates the possibility, and put systems in place to deal with it.

Old methods persist alongside new technology. In one case he describes, cryptocurrency was stolen after a party was asked to prove that it existed and to bring it on a disc to a meeting, where it was taken with a version of the three shells trick. He adds that AI is starting to defeat biometric safeguards by replicating a person's voice and appearance.

Trust is also what he believes a family office must build before it needs help. Recruiting someone on the day of an incident leaves little time to form a working relationship. He favours an initial assessment of gaps and vulnerabilities, followed by advisers who stay and work alongside the team. He is critical of consultancy that hands over a long list of tasks and leaves the client with the same problem and more to worry about. Working together, he says, a client can respond to a recommendation with an alternative that suits it, and both sides prepare for an incident they hope will not come.

So I suppose what I'm describing is more of a relationship than a contract.

— Lord Bernard Hogan-Howe, Wealth Office

Questions a principal can ask

Hogan-Howe also points to the human cost of a long incident. Crises can run for weeks, and people working eighteen-hour days grow weary. He draws on his own background, where deputies provide resilience. A commercial organisation might see a deputy as a waste of money, he acknowledges, and many smaller organisations do not have one.

His final suggestion is a test any principal can apply without technical expertise. If an incident happens while the principal is abroad, in Austria for example, who will be told? Which organisation will be contacted, and who specifically will provide support? For a well-recognised principal, possibly facing state actors, the route may run through security services in several countries, and walking into a local police station is unlikely to be the right answer. The arrangements are likely to be international and complex, and they will need to be explained quickly. The principal can judge whether the answer is reassuring. If it sounds woolly, he says, that is probably a piece of work that needs to happen quickly.