The softer perimeter: why the risk has moved from institutions to the families behind them

In twenty-five years of security work across banking, government, technology and critical infrastructure, I have watched the target move. Institutions spent heavily and became harder to break. The families of the people who own and run them did not, and that is where serious offenders have gone.

The move is rational. A private school logo in an Instagram post, a home on the property register, a director biography in an ASX announcement and an email address from an old breach are each harmless on their own. Put together, they are a working dossier, and assembling one takes an afternoon.

What changed at the institutions

Banks, super funds and large companies have spent a decade raising the cost of attacking them. Multi-factor authentication, fraud analytics and regulatory pressure mean that a criminal who wants money out of a bank now meets defences that did not exist ten years ago.

The personal side of the same customer's life has not moved. The email account that can reset the brokerage login, the home network, the phone number that receives the one-time codes: most are still configured the way they were first set up, by whoever set them up. For an attacker, taking over a private inbox or persuading a family member is cheaper than going through the bank, and it ends in the same place.

How it happens

A small number of patterns account for most of what I see.

Personal email comes first, because it unlocks everything else. Whoever controls a private inbox can reset access to financial platforms, change payment instructions, and write to advisers in the client's own name.

Superannuation and brokerage accounts follow. Enough personal detail from breaches and public records lets someone impersonate a member, redirect the contact details so the alerts go elsewhere, and request a rollover or a withdrawal.

Crypto holdings are taken through SIM swaps and stolen credentials. Once they move, there is no ombudsman and no chargeback.

And the family itself becomes leverage. Social media, school details and property records are enough to make a threat convincing, from a "virtual kidnapping" call through to extortion.

What an afternoon of research made possible

In one assessment I led, the client was a business owner whose public profile had risen sharply. He wanted to know what a determined adversary could do with open-source information, and the scope covered his family's physical security as well as their digital exposure.

Within days the team had the names of his children and the school they attended, drawn from public records, social media and breach data. Consultants then went to the school and asked to collect the children on their father's behalf. They were signed out with no further verification. Minutes later the head of the school took a call from the team, explaining that this had been a controlled exercise.

Nobody broke anything. The school had no reason to doubt someone who already knew the children's names.

This country has seen the real version. In 2011 a teenager in Mosman was left with what appeared to be a bomb attached to her neck, in what police treated as an attempt to extort a wealthy Sydney family. Kidnapping and ransom risk was raised again in 2015, in the debate over publishing the tax details of large private companies. Neither case turned on technology. Both turned on how easily a family could be found.

Who is responsible for it

When I raise this privately, the answer is usually that someone already has it covered.

Often that is the private bank, the family office or the accountant. They are good at structuring, tax and asset allocation, and most will say plainly that security is not their discipline. The most they can offer is a product recommendation.

Sometimes it is the company's CIO or CISO. Their mandate ends at the company's edge. A home network, a spouse's laptop and a teenager's accounts sit outside their authority and outside their insurance, and in many organisations they are barred from touching them.

And sometimes it is the principal: careful online, with anti-virus installed. That was a reasonable position until an ASX announcement, regular press coverage or a place on a rich list made them worth targeting as an individual rather than as one address among thousands.

Each of them holds part of the risk. None of them is accountable for the whole of it.

A role, not a product

Most public advice about cyber safety is written for consumers: password managers, anti-virus, identity monitoring. Those things have their place. They are not a plan for a family whose affairs are complex and whose names are public.

Companies answered the same question by appointing a CISO, one person accountable for the whole of their security. Private clients and their families already do the equivalent elsewhere, with a private banker, tax counsel, a family doctor and, where it is needed, physical close protection.

What is usually missing is the digital counterpart to that close protection: one person who treats the family's digital life with the seriousness a CISO brings to a listed company, and who stays with it rather than delivering a report and leaving.

What a proportionate response looks like

Three things, in order.

Find out what is already exposed. Assess the principal, their spouse, their children, the homes and the accounts that matter, on the assumption that somebody may already be assembling a file.

Secure the paths to money and identity before anything else. Personal email and its recovery options, the phone numbers that receive codes, the home network, and the devices used by family members and household staff. Then reduce what is public, where that can be done.

Keep it under review. Exposure changes with every announcement, every move and every new account, and an assessment that is never repeated soon describes a family that no longer exists.

Where that leaves a family

The bank will keep hardening its systems. The super fund will keep investing in security. The company's CISO will keep defending the corporate perimeter. None of them is responsible for the home network, the personal inbox or the children's accounts.

That gap is the work Praetos does for private clients and their families, and it begins with a confidential conversation.

Craig Searle has spent 25 years in cybersecurity across banking, government, technology and critical infrastructure. He is a founding partner of Praetos, a private protective service for private clients and their families.