The unglamorous backbone: operations, data and cyber risk

Nobody sets up a family office to do the books. They set one up to invest, to plan, to keep a family together across generations. The plumbing (reporting, data, the systems that hold it all) gets treated as overhead, the dull tax you pay for the interesting work. So it gets the least money, the least attention, and the least senior person in the building. Then one day a wire goes to the wrong account, or a laptop is lost, or a statement turns out to have been wrong for two years, and suddenly the dull tax is the only thing anyone wants to talk about.

This is the part of family-office life that no one writes brochures about. It deserves more attention than it gets, precisely because it is so easy to ignore.

Reporting is the floor everything else stands on

A family makes decisions on the basis of what it believes it owns. How much is liquid. What is exposed to which market. How a manager is really performing once fees and tax are counted. Every one of those judgements rests on the reporting underneath it, and if the reporting is wrong, the decision is wrong no matter how clever the person making it.

Consolidated, accurate reporting is the unglamorous foundation of the whole enterprise. It sounds like a clerical matter. It is not. A family that cannot see its full position across entities, jurisdictions and asset classes is flying on instruments it does not trust, which means it is really flying on instinct and hope. The cost of getting this right is visible and immediate. The cost of getting it wrong shows up later, larger, and at the worst possible moment.

And yet a remarkable number of offices, including wealthy and sophisticated ones, run on a spreadsheet and a trusted individual who carries the real picture in their head. It works, right up until it does not. The spreadsheet has an error no one catches. The trusted individual leaves, or falls ill, and takes the institutional memory with them. The family discovers that its single source of truth was a person, and that person is gone. Reporting that lives in one head is not a system. It is a risk wearing the costume of a system.

A small rich team is exactly what attackers want

A family office is, from the outside, an ideal target. It moves large sums. It has a tiny team, usually with no dedicated security function. And it carries the kind of information (where the family lives, what they own, when they travel, who their children are) that is valuable far beyond the money in any account. A criminal choosing between attacking a bank with a security department of hundreds and a family office of six does not have a hard decision.

The reason offices stay under-protected is psychological, not technical. Security feels like an expense with no return. You spend money, nothing visibly happens, and the natural conclusion is that you spent money for nothing. The return only becomes visible at the moment of a breach, when it arrives as the absence of a catastrophe you will never be able to prove you avoided. So the budget loses, year after year, to things with a clearer payoff. This is the same logic that leaves the reporting on a spreadsheet, and it is wrong for the same reason.

What attackers exploit is rarely some exotic technical flaw. It is the ordinary stuff. A payment instruction that looks plausible and is approved by someone in a hurry. A family member reusing a password from a site that was breached years ago. A request that seems to come from the principal, because the principal posts their holiday photographs in public and the timing fits. The weak point is almost always a person doing something reasonable under pressure, not a firewall.

Discretion is a habit, not a purchase

The instinct, once a family takes this seriously, is to buy something. A tool, a platform, an audit, a box ticked. Tools matter. But the offices that handle this well treat security and discretion as a culture rather than a line item, and culture cannot be purchased.

It looks like small, dull habits, repeated. A rule that no payment moves on the strength of an email alone, no matter who appears to have sent it, and no matter how urgent. A family that understands what it should not say in public, because the information that compromises them is rarely stolen. It is volunteered, post by post. An office where the junior member feels able to question an instruction from the principal, because the alternative is an office where the most dangerous request is the one no one dares to challenge.

This is unglamorous work, and it competes for attention with everything that is more interesting: the deal, the succession plan, the trust restructuring. It loses that competition almost every time, until the day it wins it for good. Families that vet their operational and security advisers as carefully as they vet their investment counsel, applying the same scrutiny they would give any significant adviser relationship, tend to be the ones who never have the bad day. The plumbing is boring. So is a roof that does not leak.