Expert Says Family Offices Are Underestimating Cyber Threats—and Leaving Trillions at Risk

Sixty-three percent of financial services firms in the U.S. and Canada reported increased fraud last year, with digital fraud accounting for half of their overall losses.

This may not be surprising given that the International Monetary Fund (IMF) found that “extreme financial losses” for all businesses have quadrupled since 2017 due to cyberattacks.

It’s little wonder then that Lexis Nexis found that nearly half (48 percent) of financial services firms took steps in 2024 to further mitigate fraud, which includes educating consumers and leveraging the “cutting-edge technologies like artificial intelligence, machine learning and biometric- and behavior-based authentication methods” to combat fraud.

Yet one sector in the financial services sector, family offices — firms catering to the investment and wealth management needs of high-net-worth individuals and families — appears to be lagging behind others in the industry when it comes to making the fight against cybercrime a top priority.

Data from JP Morgan Private Bank  — which is based on surveys with 190 family offices around the globe  — reveals that 40 percent of family office executives admit cybersecurity is a leading gap in their practice.

This admission is even more surprising given the fact that 25 percent of family office executives say that their firms have been exposed to a data breach or financial fraud in the past.

Susan Lindeque, CEO of Avestix Group, an alternative investment firm that works with family offices, isn’t entirely surprised to learn that these wealth management firms are operating behind the curve in protecting their organizations from cybercriminals.

“If family offices lack cybersecurity awareness, it may be because the leadership teams in those firms have other priorities,” Lindeque says. “When JP Morgan surveyed family offices, they were asked who was in charge of internal decision-making. More than one-third said CEOs or Presidents. Chief Financial Officers made decisions for 28 percent of the family offices surveyed while Chief Investment Officers were in charge about 25 percent of the time. There was no mention in the study of Chief Information Security Officers or similar cybersecurity-focused roles serving in leadership roles whatsoever.”

Indeed, JP Morgan Private Bank points out that “despite the increasing importance of the role of technology and risks of cyberattacks,” only a small percentage of family offices it surveyed even have a dedicated Chief Technology Officer on staff.

So while it makes sense that CEOs and CFOs — who understand the need to prioritize customer service and manage the bottom line — oversee family office operations, those leadership roles may not place a high premium on fending off cybercriminals.

But Lindeque suggests there might be another reason family offices fail to prioritize cybersecurity.

“Most family offices cater to exclusive, niche clientele,” she says. “As a result, many may operate with the belief that they are ‘under the radar’ for the average investor or the average fraudster. If this is their perception, it may create a misguided sense of security.”

Lindeque says if any family office executives believe their relatively low profile in the financial services industry might serve as a shield from cyberattacks, they need to think again.

“Family offices are becoming increasingly popular,” she says. “Right now, there are about 8,000 firms doing business around the world and analysts predict that the number could grow to about 11,000 within the next five years. With that growth will come an increased risk of cyberattacks.”

Lindeue isn’t suggesting family office executives are oblivious to the threat of cybercrimes.

“According to data, almost 60 percent of family offices currently use technology to prevent cybercrimes. Four in ten require their staff to complete cybersecurity training, while one-third of family offices work with outside security vendors,” she says. “But less than 10 percent of them currently have in-house cyber defense personnel. Given the magnitude and sophistication of today’s cyber threats, that is a problem.”

Lindeque points out that analysts predict family offices around the globe will collectively manage $10 trillion in cash and assets within five years. And while she applauds them for requiring employees to complete in-house security training and hiring outside cyber defense vendors, she says those actions amount to “table stakes” at this point.

“In our era of rapid-fire technological advancements, outsourcing your cybersecurity requirements is no longer enough,” she says. “I understand why family offices would prefer not to take on the burden and expense of building internal firewalls and staff, but the family office down the street might.

“Doing so could provide your firm with a significant competitive advantage, both against other family offices as well as big investment houses,” says Lindeque. “The ongoing threat of cyberattacks isn’t going to taper off anytime soon. The question is whether your firm is willing to take the necessary precautions needed to protect your clients and your practice.”