Pevita Pearce
Accounting firms are reporting a surge in confidence regarding their cybersecurity defenses, yet a comprehensive new study by intelligent cloud service provider Rightworks highlights a stark disconnect between perceived safety and the reality of critical protection measures. The "2026 Accounting Firm Technology Survey," which polled over 500 accounting firms, reveals that while confidence in security escalates with technological advancement—from 73% in less modern firms to 92% in their more advanced counterparts—significant vulnerabilities persist. Alarmingly, only 44% of all surveyed firms possess the capability to remotely wipe a lost or stolen device, a fundamental safeguard in today’s mobile work environment. Furthermore, even among firms that have implemented layered device security, such as multi-factor authentication, a mere 43% have deployed endpoint detection and response (EDR) across all their devices.
This widening chasm between perceived and actual security readiness is further underscored by an examination of reported cyber incidents. Less technologically advanced firms reported fewer cybersecurity incidents or breaches in the past year, with only 5% documenting such events, compared to 11% among the most advanced firms. This disparity raises a critical question for the accounting profession: are less modern firms truly experiencing fewer threats, or are their detection capabilities simply weaker, leading to unnoticed breaches? Firms with more sophisticated monitoring systems are inherently better positioned to identify nascent threats, suggesting that a lower reported incident rate may not equate to superior security but rather to a deficiency in threat detection.
Lisa Dionisio, CPA, owner of Paxus CPA Group in Norman, Oklahoma, articulated this sentiment of growing unease and awareness of the unknown. "When it comes to security, I don’t know what I don’t know," Dionisio stated. "There are so many more threats out there than I’m even aware of." This sentiment is echoed by the evolving nature of cyberattacks, which are becoming increasingly sophisticated and difficult to detect.
The rise of generative artificial intelligence (AI) is dramatically altering the cybersecurity landscape, enabling threat actors to craft more convincing and insidious attacks. Anjan Bagchee, Chief Information Security Officer at Rightworks and a former CISO of the Federal Reserve Bank of Boston, observes a significant shift in phishing attempts. "Phishing emails have shifted from bad grammar and awkward sentences to polished messages that appear legitimate, a sign of generative AI," Bagchee explained. "For accounting firms, these threats are no longer theoretical." This evolution means that even basic security awareness training, while crucial, may not be sufficient to counter highly personalized and intelligently generated malicious content.
The increasing sophistication of AI-powered attacks is leading to a tangible increase in attempted breaches. Alex Weidner, President and Managing Partner of Rudler PSC in Northern Kentucky, noted a dramatic uptick in malicious activity. "AI is being used for bad, and trying to get into and hack our data," Weidner remarked, observing "more attempts over the last 12 months than we have the prior five years." This surge in activity highlights the urgent need for accounting firms to not only enhance their defensive capabilities but also to proactively train their staff against these advanced social engineering tactics.
Human error remains a primary vector for cybersecurity breaches, yet preparedness in this area is lagging. Despite the prevalence of cybersecurity training initiatives, only 58% of firms that provide such training incorporate phishing simulations. This gap between theoretical awareness and practical, simulated experience leaves employees vulnerable when confronted with real-world, sophisticated phishing attempts. The ability to identify and report a phishing email is one thing; the ability to do so under duress, when an email appears to be from a trusted colleague or vendor, is another entirely.
The Growing Imperative of Regulatory Compliance
Beyond the technical challenges, accounting firms face increasing regulatory pressure to secure sensitive client and financial data. The requirement to maintain a written information security plan (WISP) is mandated for tax preparers, and while 81% of surveyed firms report having one, the effectiveness and comprehensiveness of these plans vary significantly. The Federal Trade Commission’s (FTC) amended Safeguards Rule further escalates the stakes, requiring covered firms to report certain data breaches involving 500 or more consumers to the FTC within 30 days of discovery. This stringent reporting deadline underscores the critical need for robust incident response capabilities and timely breach detection. Failure to comply can result in substantial fines and reputational damage, adding another layer of complexity to an already challenging security environment.
The Shift Towards Trusted Technology Partnerships
In response to these mounting threats and the complexities of modern cybersecurity, a significant majority of accounting firms are turning to external IT support. Approximately two-thirds of all firms (68%) now rely on outside IT assistance in some capacity. For firm leaders, the benefits extend beyond enhanced technical protection to alleviating the significant burden of managing IT infrastructure and security.
Hal Allen, who has led Apex Financial Solutions of Utah for 12 years, articulated the relief and strategic advantage gained from outsourcing IT support. "I’m the boss, everything stops with me," Allen explained. "I have somebody I can rely on and consult with, and that’s looking out for me. That’s not my expertise. I’m a CPA. I’m not an IT specialist." This sentiment highlights a common challenge within the profession: the need to focus on core competencies while entrusting specialized, critical functions like cybersecurity to experts.
Jennifer Brook, partner at HighPoint CPAs in Laramie, Wyoming, shared her firm’s experience before transitioning to Rightworks, illustrating the limitations of inadequate outsourced IT. "A lot of times our outsourced IT wouldn’t know there was something wrong until we called them," Brook stated. This reactive approach, where IT support is only engaged after an issue is identified by the client, is a clear indicator of insufficient proactive monitoring and threat intelligence.
The security provided by specialized partners like Rightworks offers a crucial layer of reassurance. "The security that Rightworks provides gives us peace of mind that our data and our clients’ data is secure," Weidner of Rudler PSC affirmed. "It helps me sleep better at night." This emotional benefit of security—peace of mind—is a tangible outcome of robust protection, allowing firm leaders to focus on client service and business growth rather than constant vigilance against cyber threats.
However, a considerable divide persists. Among the least modern firms, a substantial 61% continue to manage their IT entirely in-house. This contrasts sharply with the 11% of the most advanced firms that maintain this approach. Firms managing IT internally, without access to the specialized expertise and advanced tools required to combat today’s evolving cyber threats, are operating under a potentially dangerous illusion of security. The lack of dedicated cybersecurity professionals and cutting-edge threat intelligence platforms leaves them significantly more exposed to sophisticated attacks.
Ian Williams, CEO of Rightworks, cautioned against complacency. "Firms feel more confident than ever, and that’s exactly the risk," Williams stated. "Confidence isn’t the same as coverage. When fewer than half of firms can wipe a lost laptop, security can’t be something the most tech-savvy partner handles on the side. It’s a leadership decision." This perspective emphasizes that cybersecurity must be a strategic priority driven from the top, rather than an afterthought or a secondary responsibility.
The Evolving Threat Landscape and Proactive Defense Strategies
The rapid advancements in artificial intelligence are not only empowering attackers but also necessitating more sophisticated defensive measures. Generative AI can be used to craft highly personalized and contextually relevant phishing emails, making them far more convincing than traditional, template-based attacks. These AI-driven campaigns can mimic the writing style of colleagues, vendors, or even executives, increasing the likelihood of a successful social engineering attack. This evolution demands that cybersecurity solutions move beyond simple signature-based detection to more advanced behavioral analysis and anomaly detection.
The sheer volume of cyber threats encountered daily by leading security providers underscores the intensity of the current threat landscape. For example, Rightworks reports blocking approximately 3.6 million threats each month, a testament to the constant barrage that businesses, including accounting firms, face. These threats range from malware and ransomware to sophisticated phishing attempts and denial-of-service attacks, all designed to compromise data, disrupt operations, or extort financial gains.
The lack of widespread adoption of critical security measures like endpoint detection and response (EDR) is particularly concerning. EDR solutions provide real-time visibility into endpoint activity, enabling the detection and investigation of suspicious behavior that traditional antivirus software might miss. Without EDR, firms are essentially operating with blind spots on their devices, leaving them vulnerable to advanced persistent threats (APTs) that can remain undetected for extended periods.
Key Cybersecurity Priorities for Accounting Firms
In anticipation of critical periods like tax season, when firms are often under immense pressure and handling vast amounts of sensitive client data, establishing clear cybersecurity priorities is paramount. Based on current trends and expert recommendations, firms should focus on several key areas:
- Enhanced Endpoint Security: Implementing comprehensive EDR solutions across all devices, ensuring robust protection against malware, ransomware, and other endpoint threats.
- Advanced Threat Detection and Response: Deploying solutions that offer real-time monitoring, threat intelligence, and automated response capabilities to quickly identify and neutralize emerging threats.
- Continuous Employee Training and Simulation: Regularly updating cybersecurity awareness training and conducting frequent phishing simulations to keep staff vigilant and prepared for evolving attack methods. This should move beyond basic awareness to practical application and response.
- Data Backup and Recovery: Ensuring a reliable and regularly tested backup and disaster recovery plan is in place to minimize data loss and operational downtime in the event of a breach or system failure.
- Proactive Vulnerability Management: Regularly assessing and patching system vulnerabilities to close potential entry points for attackers.
Rightworks offers a suite of solutions specifically designed to address these challenges within the accounting profession. Their portfolio includes offerings like Cloud Premier, Rightworks Total Security, Cloud Protect, and WISP Compliance tools. These solutions leverage 24/7 monitoring, EDR, multi-factor authentication, and sophisticated phishing simulations, all backed by a team of IT security experts dedicated to blocking millions of threats monthly. This layered defense strategy is crucial for creating a resilient security posture against an ever-evolving threat landscape.
The "2026 Accounting Firm Technology Survey" findings are available for download at rightworks.com/resources/becoming-modern-firm. Executives from Rightworks and firm leaders featured in the report are available for interviews to provide further insights into the critical cybersecurity challenges facing the accounting industry. The ongoing digital transformation of accounting services, while offering immense benefits, necessitates a parallel and robust transformation of security practices to ensure the protection of vital financial and client data in an increasingly hazardous digital world.
