Private-Wealth AI Threat Model
A threat model asks four blunt questions: What are we protecting? Who could misuse it? Where does control change hands? How would we recover?
A private-wealth AI threat model lists the records, people, systems, and relationships that need protection. It then traces how information moves, where someone could misuse it, and how the office would detect, contain, and recover from a problem.
List what could leak, break, or act without permission.
Family-office systems can contain financial records, entity structures, tax and legal material, personal correspondence, security information, household operations, medical details, and the relationships between them. An AI system can also infer facts that were not written in one place.
Include source data, embeddings, prompts, outputs, model settings, identities, access tokens, audit logs, and the notes needed to maintain the system. Put all of them on the map before choosing protections.
OWASP’s current LLM risk categories cover issues such as prompt injection, sensitive information disclosure, supply-chain risk, improper output handling, excessive agency, and system prompt leakage. The family-office context adds concentrated privacy, physical-security, succession, and reputational consequences.
Test what happens when the system is wrong.
| Threat | Primary control | Verification |
|---|---|---|
| Shadow AI and disclosure | Approved tools, data rules, blocked destinations where appropriate, and staff training tied to real examples. | Attempt prohibited uploads; review tool inventory and network or application logs. |
| Prompt injection | Treat retrieved and external content as untrusted; isolate instructions from data; restrict tools and destinations. | Seed malicious instructions in documents and webpages; confirm the system ignores or contains them. |
| Excessive agency | Minimum permissions, transaction limits, human approval, dual control, and revocable credentials. | Try actions outside scope and above limits; confirm denial and an intelligible audit trail. |
| Improper output handling | Validate and sanitize model output before it reaches email, databases, code, or downstream tools. | Use malformed and adversarial output; confirm downstream systems treat it as data, not instruction. |
| Vendor or administrator access | Contractual limits, technical isolation, named support access, approval, time bounds, and customer-visible logs. | Run a support-access exercise and verify revocation plus retained evidence. |
| Retention and derived data | Document retention for prompts, outputs, embeddings, backups, and logs. Apply deletion and export processes. | Delete a test record and trace copies; run an export and restore test. |
| Model or integration change | Version control, evaluations, staged rollout, change approval, and rollback. | Compare a fixed evaluation set before and after change; confirm rollback works. |
| Provider exit or outage | Portable data and configurations, documented dependencies, alternate workflows, and recovery priorities. | Run a tabletop exercise with the provider unavailable. |
Mark every handoff.
- Between a person and the AI interface.
- Between the interface and family-controlled data sources.
- Between retrieval services and embeddings or indexes.
- Between the control layer and each model provider.
- Between an agent and the tools it can call.
- Between the environment and administrators, support staff, backups, or monitoring providers.
- Between the current generation’s permissions and successor access.
For each line, record who signs in, what crosses, where it is kept, who can inspect it, and how access ends. Include administrators and backups. They are easy to miss and often hold broad access.
A local model can still leak or misuse data.
Local processing reduces some provider exposure. It does not fix broad internal permissions, compromised laptops, unsafe integrations, weak backups, unreviewed agent actions, or a missing incident plan.
Try to break it five ways before production.
- Wrong person. Confirm that a user cannot retrieve another role’s records through direct or indirect prompts.
- Poisoned source. Place hostile instructions in a permitted document and observe the model and agent response.
- Wrong answer. Give the system conflicting sources and confirm it exposes uncertainty and provenance.
- Wrong action. Ask an agent to exceed its authority, bypass approval, or send data to an unapproved destination.
- Provider unavailable. Confirm the office can identify dependencies, preserve records, and continue the priority workflow.
Convert the selected controls into the family office AI governance framework. Deployment choices are covered in Private AI for Family Offices.
Questions to ask before sensitive data goes in.
What is the biggest AI risk for a family office?
It depends on the work. Sensitive disclosure, broad access, unreviewed agent actions, and false answers can each cause harm. Rank them against the office’s actual records and decisions.
What is prompt injection?
It is an attempt to make a model follow hostile instructions contained in user input, retrieved documents, webpages, or tool output. Restricting data and tools limits the damage a successful injection can cause.
Are embeddings sensitive data?
They can carry information derived from the source records. Give them the same deliberate rules for access, storage, backup, export, and deletion.
Can audit logs create privacy risk?
Yes. Logs may contain prompts, answers, names, source references, and action details. Limit who can see them, set a retention period, and do not collect content you do not need.
What should an AI incident plan include?
Name the contacts, shutdown steps, credentials to revoke, systems and data to inspect, evidence to keep, vendors to call, legal review, recovery work, and the change that should prevent a repeat.
Where these claims come from.
- OWASP, Top 10 for Large Language Model Applications
- NIST, AI Risk Management Framework
- OpenAI, Enterprise Privacy, updated January 8, 2026
Published 2026-07-12. Product terms and legal duties change. Check them against the family office’s current facts before acting.
Pair threats with operating rules
Test the weak points before production.
A private review maps the data, handoffs, agent permissions, and recovery plan.
Request a private briefing