Digital Privacy, Cyber Insurance: Why Family Offices Need Both

Summary

This article summarizes a recent panel discussion from the Family Wealth Report's Family Office Cybersecurity Forum. The panel focused on two main forms of attack: impersonation and intrusion.

Impersonation and Intrusion

• Fraud through email: Attackers gather enough publicly available information to imitate a trusted email account and send convincing emails that appear legitimate.
• Intrusion: Attackers gain unauthorized access to systems by using reused or stolen passwords, demanding payment to restore access if not paid.

Preparatory Work

The preparatory work behind these attacks is increasingly automated. What once required weeks of effort from a skilled person now takes software a matter of minutes, so that by the time an advisor learns a bank or vendor has been breached, a profile of the family may already exist.

Cyber Risk Profiles for Family Offices

Family offices are unusually difficult to protect due to their unique cyber risk profiles. They hold enterprise-scale wealth but defend it with small-business resources, often a handful of staff and a single IT contractor. The deeper challenge is that what is being protected is a family, not a company. Exposure varies widely across a household.

Privacy Tools

Privacy tools reduce exposure by removing personal information before an attacker can collect it, and by giving a family awareness of what has leaked so fraud doesn't catch them by surprise. They do not eliminate the target, which is why insurance is the second half of the answer.

Cyber Insurance

Cyber insurance covers what remains when defenses fail, such as response and investigation, legal counsel, and weeks of lost operation while systems are rebuilt. However, 63% of family offices carry no cyber insurance. It is one of the largest gaps.

Conclusion

To handle the unique security challenges faced by family offices, they should pursue both privacy tools and cyber insurance. Privacy tools reduce the likelihood that a family is successfully targeted, while insurance limits the damage when an attack succeeds.