Institutional balance sheet. Household controls.
Attackers price targets on ratio: capital under control divided by effort to reach it. On that measure a single-family office is the most efficient target in private wealth.
Wire authority concentrates
Two or three people can move eight figures. Attackers do not need the network. They need one inbox and a plausible instruction.
The household is unmanaged
Spouses, adult children and staff run personal devices and private email with no corporate control, and they reference the principal by name.
No security function exists
Most offices run lean by design. Nobody owns exposure, so nobody is checking what is already public about the family.
Wealth is on record
Filings, property records, philanthropy and press coverage assemble a target profile that requires no breach at all to build.
A document you can act on, and hand to a board.
Written for a principal and a chief of staff, not a security team. Every finding names what is exposed, where it surfaced, and what to do about it.
Every finding across the principal, household, inner circle and firm infrastructure, classified by severity.
New exposure surfaced as it appears rather than at the next annual review. Alerting to a named contact.
Spouse, adult children and staff included in scope by default. Exposure travels with the person, not the entity.
What to remove, what to change, and what cannot be undone but can be monitored. Written in plain language.
No finding leaves the office without review. Evidence retained encrypted and available on request.
One fraudulent wire clears a decade of coverage.
Attackers do not breach the office. They study it, wait for a plausible moment, and send an instruction that looks exactly like the ones that get approved every week.
Reported to the FBI in one year. The highest-loss internet-crime category a decade running.
Median reported loss on a single successful business email compromise.
What is already exposed, classified by severity, before anything is remediated.
SOURCE · FBI INTERNET CRIME COMPLAINT CENTER REPORTING
We scope annually against household size, entity count and how public the family already is. The number is confirmed in writing before any engagement begins.
Request discovery callWhat principals ask first
No. The assessment is entirely external and read-only. We connect to nothing, install nothing, and test nothing intrusively.
Only to confirm who is in scope. We do not interview household members, and nothing is collected from them directly.
Encrypted, delivered to a named recipient, and never shared. Evidence is retained encrypted and destroyed on request.
You are told immediately rather than waiting for the briefing. Critical findings are escalated to your named contact within the day.
They manage systems you control. We assess what is exposed outside them: personal accounts, household devices and public records they have no visibility into.
Scope moves with household size, entity count and how public the family already is. The number is confirmed in writing before any engagement begins.
Twenty minutes. Mutual NDA on request.
For Chiefs of Staff, General Counsel, and heads of security carrying fiduciary responsibility over principal exposure, wire-fraud posture, or advisor-network risk. Analyst desk replies within one business day from an authenticated LeakTrace address.