A growing threat

Family offices are becoming increasingly concerned about cyberattacks. More than seven in ten (71%) believe they are more likely to suffer a cyberattack now than they were a few years ago. A larger proportion of North Americans (79%) are preparing for an attack. 

Escalating fears over cyberattacks come amid a rise in the number of family offices reporting incidents. Globally, more than a fifth (21%) say they have suffered a cyberattack in the past 12 months. This rises to a quarter (25%) of North American family offices, which is up from 17% in 2020. Adding to these fears, 42% say they know other family offices that have suffered cyberattacks, and this increases to 51% in North America.

Greater awareness and knowledge of incidents is therefore fueling worries about cyberattacks. Nonetheless, despite the growing concern, just 31% say their cyber risk management processes are well-developed. The figure is even lower in Asia (15%) and the Middle East (13%). These findings reveal an alarming gap between awareness of cybersecurity risks and the actions put in place to prevent and repel attacks.

Poor cybersecurity capabilities also reflect inadequate staff training. Just 29% say staff cyber/tech training programs are sufficient, and less than half have upgraded staff training programs to address rising risks (48%) or regularly update cyber policies (49%). Such shortcomings are compounded by lack of leadership. One in seven (15%) globally say their office lacks an internal lead for cybersecurity and data protection, rising to 31% in Asia.

Reliance on third-party technology vendors and infrastructure exposes the family office to technology failures, cyber threats and data breaches, necessitating robust contingency plans and cybersecurity measures. Family offices may be better served by replicating real-life scenarios. Running mock cyberattacks such as phishing exercises, for instance, would allow firms to assess how staff react and identify where improvements are needed.

Beyond these internal weaknesses, only a quarter (26%) say cybersecurity risks are proactively flagged by advisors. This is a key—and potentially damaging—oversight on behalf of advisors.