Most family offices were built for agility. A small team, a short chain of authority and a few trusted advisers allow a family to move quickly into new markets, technologies and geographies, often before regulators have caught up. Michael Macfarlane, opening a Wealth Office X conversation on cyber security, observes that this operating model has changed little, even as the environment around it has changed a great deal. In his framing, cyber risk has become a strategic condition for private wealth.

David Ferbrache OBE, Managing Director of Beyond Blue, takes that framing a step further. His central claim is that cyber security in a family office belongs with the people who understand what the family stands to lose. That is rarely the IT function alone.

The limits of the technical view

Ferbrache describes a trap he has seen in large corporations as well as family offices. An organisation appoints someone to run the security of its IT systems and considers the matter handled. Once that happens, he says, security is disconnected from what actually matters to the organisation or the family. The business context disappears. Awareness falls away, and so does the management of any major incident and its reputational and financial impact. What remains is patching, vulnerability management and firewalls.

He does not dismiss those things. Basic cyber hygiene, in his account, is the part a family office simply needs to get right, often with the help of a good managed IT or security service provider that can monitor for intrusions and configure systems properly. His argument concerns where the thinking starts.

So cyber for me is now a much, much broader piece. It's about what really matters to you, what are the real assets that are of concern.

— David Ferbrache OBE, Wealth Office

For Ferbrache, the starting point is what he calls the crown jewels. Which data and which assets are worth protecting above all, and what are the worst-case scenarios for this particular family? The answers vary. For some families the risk profile extends to insider threats, tracking and surveillance, and even state activity, shaped by where the family lives and travels.

Why the consequences are personal

The case for involving the principal rests on the kind of damage now at stake. Ferbrache describes a shift in criminal tactics. Organised crime groups once concentrated on encrypting data and demanding a ransom. Increasingly they sample the data they find, work out where they have landed and decide how best to apply extortion and blackmail. He also describes attempts to blackmail key executives and members of the family directly.

Ferbrache distinguishes between two kinds of consequence. For many family offices, he suggests, the financial cost of an attack may be manageable, even if it leads into the specialist territory of ransomware and negotiation. Reputational damage is harder to repair. There may be family secrets, or private matters a family has worked hard to protect. Those consequences, in his words, are family consequences rather than family office consequences.

So ultimately, the principal needs to be involved at least in thinking through some of those scenarios and what really matters and maybe how the family would respond to that.

— David Ferbrache OBE, Wealth Office

Macfarlane adds an observation from his own work. A principal may find it a high hurdle to disclose personal vulnerabilities to people they work with every day. If a family's exposure is both strategic and personal, the decision to engage specialist help may need to sit with the principal directly. Ferbrache agrees that in many circumstances it should.

The next generation as an exposure

The conversation offers a concrete example of why scenarios matter. Macfarlane describes a pattern he sees in intergenerational families. The older generation tends to be low-key and security-aware, while children may share their locations, travel and associations online as they happen. He notes that once the discussion turns to the safety of their children, a principal's thinking often changes instantly.

Ferbrache calls the analysis that criminals and state actors can perform on this material pattern of life. It allows phishing to be tailored to a person's interests and associations, enables frauds timed for when an executive is out of touch or travelling, and in extreme cases reveals where someone will be physically present. He does not argue that family members should stop living online. He points instead to modest measures, such as avoiding geotagged images and posting after leaving a place. Everything done on cyber threat, he says, applies to the family as well as the family office.

Security that lets a family function

Ferbrache closes on a point that reframes the investment question. Security that works well, in his view, is unobtrusive. It has a minimal impact on how the principal, the family and the office function, and it manages the risk around what they want to do. He lists secure communications, protection of information about locations, early detection of threats and readiness to respond. Approached in this way, security becomes an enabler that allows a family to travel, associate and carry out its business while remaining reasonably secure.

His recommended next step is modest. A principal should recognise that this is an area requiring specialist advice, because family offices and their support structures may lack the expertise, contacts and relationships required. That advice, he says, should extend beyond protecting current assets and systems to thinking through scenarios and preparing responses, engaging the family as well as the office where necessary.