Canadian multi-family office establishes a cross-family exposure baseline before onboarding a new principal family.

A Canadian multi-family office engaged LeakTrace to establish a cross-family exposure baseline before onboarding a new principal family. The engagement produced the reference material the office used to calibrate the standing security program the new family would join.

Engagement origin

The office serves several principal families through dedicated administrative and investment staff. A new principal family had signed an onboarding letter, and the office's Chief Executive wanted to understand the exposure baseline the new family brought into the office's existing security program before formalizing the integration. LeakTrace was referred by the office's outside counsel.

Discovery scope

LeakTrace conducted household-level external attack surface audits against the incoming principal family, and re-baselined the existing principal families, so the office could compare the incoming family's exposure profile against the baseline the existing security program had been calibrated to.

Findings summary

• Incoming family credential exposure differential. The incoming family's personal email exposure was materially higher than the office's existing principal families' baseline. Reuse patterns extended into consumer service accounts and philanthropic board correspondence.
• Property and asset record footprint. The incoming family's asset structure disclosed residential and commercial holdings across multiple provinces at a level of detail exceeding the existing families' baseline. Trust entity structures had been designed for tax purposes rather than for exposure minimization.
• Family staff and vendor overlap. The incoming family had prior vendor relationships that overlapped with the office's existing vendor network in ways that would create cross-family exposure surfaces once integration completed.
• Household staff transition period. The incoming family's household staff would remain in place through the office onboarding, creating a transition-period exposure that the office's standing employment protocols would need to address.

Office actions

The office implemented a phased integration program. The incoming family's personal email exposure was addressed through data-broker opt-out and passphrase manager rollout. Trust entity structures were reviewed with the family's counsel for exposure implications. Vendor overlap was addressed by consolidating to the office's vendor standards. Household staff onboarded to the office's employment protocols including the social media restrictions the office maintained for existing principal families.

Outcome

The new principal family onboarding completed on schedule. The office's security program was extended to cover the new family without material configuration change. The Chief Executive retained LeakTrace for annual cross-family baseline refresh.