A family office can harden its own systems and still send the family’s most sensitive documents to personal accounts it does not control, where they accumulate for years. Why that archive matters, and what to change: send links rather than attachments, protect the accounts that receive what remains, and agree the channels in advance.

Most family offices make the false assumption that their IT provider is handling cybersecurity efforts, but this is often not the case.