The Vendor Is the Weak Door: Discretion as a Security Practice

For a wealthy family, discretion used to mean an adviser who never dropped a name at dinner. It now means an adviser whose inbox cannot be used to move the family’s money. Deloitte Private’s Family Office Cybersecurity Report 2024 found that 43 percent of single family offices had suffered a cyberattack in the previous 12 to 24 months, and that phishing reached 93 percent of the victims. The same survey found that 68 percent had not adopted “know your vendor” protocols.

Put those numbers side by side and the weak point shows. The family office is where the money sits, but it is rarely where the files stop. The lawyers, tax advisers, brokers and property managers around it hold the passports, the trust deeds and the wire instructions, and most of them are never asked how they protect any of it. The outside firm that can answer that question in writing, before anyone asks, is the one a careful family will prefer.

Attacked often, and surrounded by vendors

Deloitte surveyed 354 single family offices between September and December 2023, with average assets under management of USD 2.0 billion. The attacks were not evenly spread. In North America, 57 percent of offices reported one, against 41 percent in Europe and 24 percent in Asia Pacific. Among offices managing more than USD 1 billion, the figure was 62 percent. Deloitte also reported that 25 percent had experienced three or more attacks, and that a third of the victims suffered some form of loss or damage.

The kind of attack matters more than the count. Phishing, at 93 percent of victims, is an attack on correspondence: on the person who opens the email, recognizes the sender and does what it asks. Malware followed at 35 percent and social engineering at 23 percent. None of these requires breaking a vault. They require knowing who writes to whom, about what, and in which tone.

That is exactly the knowledge an outside firm carries. The old signals of discretion, the unmarked door, the partner who never names a client, still matter, but on their own they no longer protect anything. What protects the family now is a set of rules about how documents travel and how money moves, written down and followed by everyone who touches the file.

The perimeter, meanwhile, now runs through the outside firm. J.P. Morgan Private Bank’s 2026 Global Family Office Report, based on 333 family offices in 30 countries, found that legal services (52 percent), trading and market execution (45 percent) and cybersecurity (38 percent) are the functions family offices outsource most often. According to the bank’s release, 25 to 28 percent of their costs go to external services of that kind, and “technology platforms and cybersecurity have become top service needs, with 32% citing cybersecurity as their greatest priority.”

More than a third of family offices outsource cybersecurity, and more than half send their legal work outside. Their defenses are partly a set of vendors, and their most sensitive files sit partly on vendors’ servers. Deloitte’s other findings show how loosely that arrangement is managed: 31 percent of family offices had no cyber incident response plan, 50 percent had no disaster recovery plan, and only 58 percent offered cybersecurity training to staff.

Here is what a typical outside firm holds, and what it is worth to someone else.

The money leaves by email

The FBI’s Internet Crime Complaint Center received 1,008,597 complaints in 2025, with reported losses of USD 20.9 billion, 26 percent more than in 2024, according to its 2025 annual report. Business email compromise accounted for USD 3.05 billion of that, from 24,768 complaints, second only to investment fraud. Divide one figure by the other and the average reported loss per business email compromise complaint comes to about USD 123,000.

The report’s own case files show who gets impersonated. In a complaint the IC3 received in March 2025, a senior citizen in Missouri, closing on a property, received a compromised email from the “title company” with wire instructions for more than USD 1.3 million. In a complaint received in August 2025, people closing on a home received an email impersonating their legitimate attorneys, and a wire of more than USD 449,000 went out from their bank. In neither case did the attacker pose as a stranger. The attacker posed as the trusted outside firm, at the moment a real payment was due.

An attacker does not need to break into the family office. It is enough to sound like its lawyer.

The same trick now works on video. A finance professional working for the engineering firm Arup in Hong Kong was invited by email to a video call about a “confidential transaction.” On the call, the chief financial officer and the colleagues the employee recognized were deepfakes, and the employee transferred HK$200 million, about USD 25.6 million, across 15 transactions using five Hong Kong banks, as FM Magazine reported. The company reported the incident to Hong Kong police in January 2024. Arup determined that none of its systems, clients or data had been compromised. Its global chief information officer described it this way: “People were persuaded, if you like, deceived into believing they were carrying out genuine transactions that resulted in money leaving the organisation.” The IC3 report adds that businesses reported more than USD 30 million in 2025 losses to business email compromise involving AI.

No firewall would have stopped that transfer. A rule could have: nothing moves on a request the requester initiated, until someone calls back on a number the firm already had.

One page the client can hold you to

The answer to impersonation is procedure, and procedure only works if the client knows it too. The FBI’s standing advice on business email compromise is to use “secondary channels and/or two-factor authentication to verify requests for changes in account information.” That advice is useless if the family’s controller does not know that your firm will never send new bank details by email. Put it in writing.

A client security protocol fits on one page. The first lines cover how documents are sent and received, through which portal, and state that identity documents never travel as attachments. Next comes the payment rule: your details will never change by email, and any message claiming otherwise is fraud until confirmed by a call to a number already on file. The page then names the person accountable for security at your firm, with a direct line. Last, it sets how long you keep what, and what you will tell the client, and how fast, if something goes wrong.

The page does two jobs. It turns discretion into something a client can check, instead of a tone they have to trust. And it arms the client against the fake version of you: when a fraudulent email arrives in your name, your own document already contradicts it.

Hold less, and train everyone who touches the file

The cheapest security is data you no longer have. The Federal Trade Commission’s guide for business reduces the discipline to five principles: take stock, scale down, lock it, pitch it, plan ahead. On retention it is blunt: “If you don’t have a legitimate business need for sensitive personally identifying information, don’t keep it.” A passport scanned for onboarding five years ago, still sitting in a shared drive, serves nobody and is available to anyone who gets in.

Set a schedule, delete on it, and keep a record that you did. Then train, more widely than feels necessary. Phishing reached 93 percent of the attacked family offices in Deloitte’s survey, and phishing lands on whoever reads the mail: the assistant who forwards an invoice, the paralegal who uploads a trust deed, the contractor with access to the shared folder. Training that only reaches partners protects the people least likely to process the payment.

Security belongs in the proposal

Regulation is starting to push the question down the chain. Amendments to the SEC’s Regulation S-P, adopted in May 2024, require registered investment advisers, broker-dealers, investment companies and transfer agents to run an incident response program that includes written procedures for oversight, “including through due diligence and monitoring, of service providers.” Those procedures must be designed to ensure that service providers notify the firm as soon as possible, and no later than 72 hours after becoming aware of a security breach that gives unauthorized access to a customer information system they maintain. Affected individuals must generally be told as soon as practicable, and no later than 30 days after the firm becomes aware of the unauthorized access. Larger entities had to comply by December 3, 2025, and smaller ones by June 3, 2026. Any multi-family office or wealth manager registered with the SEC now has a regulatory reason to question its vendors.

Single family offices are different. Under the SEC’s 2011 family office rule, offices that meet its conditions are excluded from regulation under the Advisers Act, so the Regulation S-P requirement that applies to registered advisers does not oblige them to vet their outside firms. For them, asking is a choice. The more sophisticated offices will ask anyway, and the ones already attacked have every reason to ask in detail. Whether a given rule reaches your own firm depends on its registrations and its contracts; this dossier is not legal advice, and that question belongs with your counsel.

Do not wait for the questionnaire. Put a one-page security annex in every proposal, next to the fee: the named accountable person, how documents move, the payment verification rule, the retention schedule, the notification commitment and how staff are trained. A family choosing between two equally qualified firms will notice which one already answered the question its own diligence was going to ask.