Disclosure: I co-founded Mitosis Labs, which runs Private SuperIntelligence. This is an adaptation of the original guide written for family offices.
This is not a reason to abandon AI. It is a reason to put AI vendors on the same cyber program you already run for custodians and IT providers.
Deloitte's Family Office Cybersecurity Report 2024 surveyed 354 single family offices between September and December 2023. 43% had a cyberattack in the previous 12 to 24 months globally, 57% in North America, and offices with more than US$1 billion AUM reported 62%, against 38% for smaller offices. Of attacked offices, 93% had received phishing emails. 31% had no cyber incident response plan. 68% had not adopted "know your vendor" protocols. Deloitte defines that as reviewing a vendor's security before you sign, for example by requesting security audit reports.
The 2026 RBC and Campden Wealth North America Family Office Report found that 59% name cybersecurity and data breaches the top near-term operational concern, up from 16% the year before. J.P. Morgan Private Bank's February 2026 report found that 32% cite cybersecurity as their greatest service need.
Three places AI widens the surface
IBM's 2025 Cost of a Data Breach Report, which studied 600 organizations, found that 16% of breaches involved attackers using AI tools, most often for phishing or deepfake impersonation. The FBI's IC3 received 22,364 complaints in 2025 that referenced AI, with losses of $893,346,472. Phishing, already 93% of Deloitte's attacked offices, got cheaper to write.
Staff paste family material into tools nobody approved. IBM uses "shadow AI" for that: one in five organizations reported a breach due to shadow AI; 63% of breached organizations had no AI governance policy or were still developing one. IBM did not break out family offices.
Assistants that read email can act. OWASP LLM01 is prompt injection, LLM02 is sensitive information disclosure, LLM06 is excessive agency. IBM found 13% of organizations reported breaches of AI models or applications, and 97% of those lacked proper AI access controls. Ask what the assistant can do without a person approving it.
Same Deloitte steps. Five vendor questions.
Identity by role. Vendor review. Training that includes cloned voices. An incident response plan that names who to call if an AI tool exposes family data. A maturity assessment that lists every AI tool in use, approved or not.
Ask whether a vendor trains on your data, how long it keeps it, where processing happens, what it can do without approval, and how you delete everything when you leave. Those five questions belong in the same vendor file as the custodian's security packet.
We built Private SuperIntelligence as an AI concierge for one family office, working across that office's own email, documents and data with citations, within permissions you set. A client deployment sends no telemetry back to Mitosis Labs.
Speak with the founders
Private SuperIntelligence takes a limited number of families at a time so every one gets the same standard of service. Book a private call to talk through your office with Alex Morris.
Prakshal Jain (PJ), Co-founder and CTO, Private SuperIntelligence (by Mitosis Labs)
Alexander Morris, Co-founder and CEO, Private SuperIntelligence (by Mitosis Labs)
Originally published at privatesuperintelligence.si.
Sources: Deloitte 2024 https://www.deloitte.com/content/dam/assets-shared/docs/services/deloitte-private/2024/family-office-cybersecurity-report-2024.pdf ; RBC/Campden via PR Newswire, 2026-09-29 https://www.prnewswire.com/news-releases/2026-rbc-and-campden-wealth-report-north-american-family-offices-shift-from-caution-to-optimism-amid-great-wealth-transfer-ai-acceleration-302892391.html ; J.P. Morgan via PR Newswire, 2026-02-02 https://www.prnewswire.com/news-releases/jp-morgan-private-bank-releases-2026-global-family-office-report-302676012.html ; IBM Newsroom, 2025-07-30 https://newsroom.ibm.com/2025-07-30-ibm-report-13-of-organizations-reported-breaches-of-ai-models-or-applications,-97-of-which-reported-lacking-proper-ai-access-controls ; IC3 2025 https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf ; OWASP LLM Top 10 2025 https://genai.owasp.org/llm-top-10/
Piece ID: FOC1-DEV
Top comments (0)