Family Offices

What we usually find

These are the four patterns that come up most often in an assessment of a family office, in roughly the order they cause trouble.

• Access that grew by accident. Staff, advisers and former employees hold permissions that made sense at the time. Nobody has a current list of who can see what, which means nobody can answer that question for a family council either.
• Concentration in one or two people. A bookkeeper who is the only one who understands the reporting, or an IT contractor who set everything up and documented none of it. This is an operational risk before it is a security risk.
• The household attached to the office. Principals and family members use personal devices, home networks and private email for office matters. The office has controls; the household usually has none, and the attacker picks whichever is easier.
• Nothing to show. Controls may be adequate and still be impossible to evidence. When a bank, an auditor or a beneficiary asks how information is protected, the answer is a conversation rather than a document.

How the work runs

Almost every engagement starts with Insight: two to four weeks, fixed fee, ending in a ranked list of exposures, what each would cost to deal with, and a private debrief for whoever decides. You can take that report to your existing IT provider and never speak to us again; some clients do.

Where work follows, it is usually Revive to replace or contain fragile systems, then Fortify for monitoring and tested recovery, or Guardian where the office needs senior advice and day-to-day support rather than a service desk. Where the principals' own devices and household are in scope, that is Sovereign. Families with archives worth preserving add Ark.

Our people are named to you before they start, work to your approval, and are bound by the same confidentiality terms you expect of your lawyers and accountants. The same small team stays with you, because in an office of this size the relationship is most of the value.

Reporting a family council can use

Governance is the part most providers skip. Each period you get a short written record: what was closed, what remains open, what changed, and what it cost. It is written to be read by someone who is not technical and who may be asked, later, what they had in place and how they knew it was working.

Where you want figures for a board paper, we can model breach cost avoided and continuity improved from your own numbers and published breach data. We will say plainly that these are models for comparing options, not predictions.

What we will not do

• We will not tell you technology removes the risk. It reduces the number of ways in and makes the rest survivable and evidenced.
• We will not help conceal from your governance that the work is outsourced. If a family council asks who does your IT, the honest answer should be available.
• We will not resell a platform to you. Where a licensed third-party tool is the right answer, we select it, integrate it, and show you what it costs.

Where to start

If you want the cost picture first, the configurator shows indicative starting prices by service. If you would rather talk, a first conversation is a scoping discussion under confidentiality, not a sales call. Contact us and say what is prompting the question. If you are dealing with a live incident, say so in the first line.