The evidence base

Current beliefs

Working belief titles are public. Members can read their evidence, confidence and conditions.

• Family-office AI-agent losses will first arrive through ordinary staff workflows, not autonomous bank-agent APIs.

• For Brandon's clients, remote-access appliances and browser zero-days are more likely to create near-term loss than prompt injection against production agents.

• The highest-value near-term "agent firewall" is an approval workflow around consequential actions, not a model-level prompt-injection detector.

• Family-office topology is a bigger moat than generic non-human identity.

• Browser-agent risk sells best as "secure browser profiles for money/legal work," not "AI browser security."

• Voice-clone fraud will punish weak callback rituals before it defeats strong callback registries.

• Private-bank portals are the under-discussed agent-era attack surface for UHNW clients.

• Asset managers will underweight AI workflow security until LP, regulator, insurer, or internal compliance pressure forces an inventory.

• The highest-value asset-manager control is evidence of data/model/tool flow, not blocking AI.

• MCP servers, browser extensions, and local skills are the new shadow SaaS for sophisticated AI users.

• The first catastrophic AI-agent incidents in asset management are more likely to be data exfiltration than unauthorized trading.

• Vendor-embedded AI features will create more near-term risk than customer-built agents.

• Family offices will overinvest in endpoint tools and underinvest in staff rehearsal.

• AI phishing matters less because messages are prettier and more because timing/context/relation targeting improves.

• "Read-only" AI access will not remain operationally read-only.

• Cyber insurance underwriting will become a forcing function for AI controls among family offices and small funds.

• The best first family-office buyer pays for "implementation of the memo," not "cybersecurity strategy."

• AI incident tabletop sells before AI incident response retainer.

• Model-vendor outages and silent quality changes will become operational risk once research workflows depend on frontier models.

• The generic agent-identity market will be crowded; wealth-specific authorization will remain subscale and under-served.

• The most important Line A risk register is "who can cause money or authority to move," not a device list.

• Personal AI accounts in work browsers are a bigger near-term risk than sanctioned enterprise AI accounts.

• Small asset managers need AI governance that feels like SOC 2 readiness, not AI ethics.

• PE portfolio AI security is a better PE wedge than central-firm security audit.

• AI vendor due diligence sells before AI red teaming for Brandon's buyer base.