Family offices tend to buy security at the perimeter. A capable firewall, a business-grade internet line, endpoint protection on the workstations. What we consistently find missing is any internal structure — and internal structure is what determines how much damage a single compromised device can do.

The flat network problem

A typical arrangement looks like this. The principal's residence, the office where the investment team works, and in many cases a second property are joined by a site-to-site link so that files, printers, and cameras are reachable from anywhere. Everything sits on one address range. Everything can reach everything else.

On that network you will usually find some combination of:

  • Workstations with access to banking and custodial platforms
  • Personal laptops, tablets, and phones belonging to family members
  • Household staff devices, often personally owned and unmanaged
  • Smart-home equipment — thermostats, doorbells, televisions, assistants
  • CCTV recorders and access control panels, frequently unpatched
  • A guest wireless network that is, in practice, the same network

The perimeter firewall does nothing about any of this. It governs traffic crossing the boundary. Once an adversary is inside — through a phished credential, a compromised personal phone, or an internet-exposed camera recorder with default credentials — they are on the same segment as the workstation that authorises transfers.

A firewall determines who gets in. Segmentation determines how far they get. Most family offices have invested heavily in the first question and not at all in the second.

What lateral movement actually looks like

Adversaries targeting family offices are rarely interested in the device they compromise first. That device is a foothold. From it they enumerate the network, identify which hosts hold credentials worth having, and move toward them.

The recurring pattern in the incidents we respond to is unremarkable and effective:

  • Initial access through an unmanaged personal or staff device
  • Enumeration of reachable hosts and shared storage
  • Harvesting of credentials cached on the foothold or found in accessible files
  • Reuse of those credentials against the finance workstation or file server
  • A period of quiet observation of correspondence and payment routines
  • A fraudulent instruction sent at a moment consistent with normal activity

Step two is where segmentation intervenes. If the compromised device cannot see the finance workstation, cannot see the file server, and cannot see the domain controller, the chain stops at the foothold.

A workable segmentation model

Segmentation does not require redesigning how the household lives. In practice a small number of well-chosen zones covers the great majority of the risk:

Critical operations

Finance workstations, custodial platform access, and document systems holding legal and financial records. This zone should be reachable from nothing else by default, and should reach the internet only through inspected, restricted paths.

Principal and family

Managed personal devices belonging to the principal and immediate family. Hardened, monitored, and separated from both operations and everything below.

Staff and guest

Household staff devices, contractors, visitors. Internet access only. No visibility into any other zone whatsoever.

Building systems

Cameras, access control, climate, entertainment, and every other connected appliance. These are the devices most likely to carry unpatched vulnerabilities and the least likely to ever be updated. They should be isolated from all other zones and, in most cases, from the open internet as well.

Getting the enforcement right

Zones only help if the boundaries between them are enforced. Two failures make segmentation cosmetic:

Permissive rules between zones. A rule allowing the staff segment to reach the operations segment "for the shared printer" reopens the path the design was meant to close. Inter-zone rules should be specific to host, port, and direction, and each one should be justified and reviewed.

Devices that straddle zones. A laptop that connects to the office network by cable and the family wireless simultaneously is a bridge between segments. So is a phone connected to guest wireless while holding an always-on VPN into operations. Bridging needs to be identified during design, not discovered during an incident.

Where to start

If a segmentation project is not currently feasible, the highest-value first step is to isolate the two extremes: put building systems and staff devices on their own networks with no route to anything else. That single change removes the most common initial-access paths from the most sensitive systems, and it can usually be implemented on existing hardware in a day.

The full model — documented zones, enforced rules, monitored boundaries, and a review cycle — is what we deploy during a standard institutional engagement. It is less expensive than most clients expect, and it changes the outcome of an intrusion from a loss event into a contained incident.