Julia Chirkova
Despite a prevailing sense of confidence in their cybersecurity measures, a significant disconnect exists between the perception and the reality of data protection within accounting firms. New research indicates that many firms, particularly those considered less technologically advanced, harbor an overestimation of their defenses, leaving them vulnerable to increasingly sophisticated cyber threats that target sensitive financial and client data. This gap poses a substantial risk, especially as the tax season approaches, a period of heightened activity and potential exploitation for cybercriminals.
The findings emerge from the 2026 Accounting Firm Technology Survey, conducted by Rightworks, a provider of firm management, security technology, and IT solutions. The survey, which garnered responses from over 500 accounting firms, revealed a striking disparity in perceived security strength. While 73% of firms identified as "least modern" expressed confidence in their cybersecurity, this figure soared to 92% among the "most advanced" firms. However, a closer examination of actual security protocols paints a less reassuring picture. Alarmingly, only 44% of all surveyed firms possess the capability to remotely wipe a lost or stolen device – a fundamental safeguard for client data. Furthermore, even among firms that employ layered device security, such as multi-factor authentication (MFA), a mere 43% have implemented endpoint detection and response (EDR) on every device. This suggests that even those firms actively pursuing modernization may have critical blind spots in their defense strategies.
The Evolving Threat Landscape: AI and Sophisticated Phishing
The nature of cyber threats is rapidly evolving, with artificial intelligence playing an increasingly prominent role in enabling more sophisticated attacks. Anjan Bagchee, Chief Information Security Officer at Rightworks and former CISO of the Federal Reserve Bank of Boston, underscored this shift. He noted that phishing emails have transitioned from easily identifiable messages with poor grammar and awkward phrasing to highly polished and convincing communications that mimic legitimate correspondence. This evolution is a direct consequence of generative AI, which can craft highly personalized and contextually relevant messages, making them far more effective at deceiving recipients.
This sentiment is echoed by practitioners on the front lines. Alex Weidner, President and Managing Partner of Rudler PSC in Northern Kentucky, observed a dramatic increase in cyberattack attempts. "AI is being used for bad, and trying to get into and hack our data," Weidner stated, noting that the volume of such attempts over the last 12 months has surpassed that of the preceding five years combined. This anecdotal evidence aligns with broader industry reports indicating a surge in AI-powered cybercrime, targeting businesses of all sizes, but particularly those handling sensitive financial information.
Human Error: A Persistent Vulnerability
Beyond technological sophistication, human error remains a leading cause of data breaches within organizations. The Rightworks survey highlights a significant gap in preparedness concerning this persistent vulnerability. While cybersecurity training is provided by 58% of firms, a critical deficiency emerges in practical application: only a fraction of these firms conduct phishing simulations. This leaves a substantial disconnect between theoretical awareness of phishing tactics and the actual ability of employees to recognize and respond to such threats in real-world scenarios. The absence of regular, practical drills means that employees may not be adequately equipped to identify the subtle nuances of advanced phishing attempts, making them susceptible to falling victim.
The implications of these findings are profound for the accounting profession. Accounting firms are custodians of some of the most sensitive and valuable data imaginable – client financial records, personal identifiable information, and proprietary business strategies. A breach in an accounting firm can have devastating consequences, not only for the firm itself through reputational damage, regulatory fines, and potential litigation, but more critically, for its clients, who could face financial ruin, identity theft, and severe business disruption.
A Call for Enhanced Preparedness: Key Data Steps
In light of these escalating risks, Rightworks emphasizes the need for accounting firms to proactively bolster their cybersecurity posture, particularly as the critical tax season approaches. While the survey does not detail specific recommended actions, industry best practices, and the insights from the survey itself, point to several crucial areas for improvement:
- Robust Endpoint Security: Implementing EDR solutions across all devices is paramount. EDR provides continuous monitoring of endpoints, allowing for the detection, investigation, and remediation of advanced threats that traditional antivirus software may miss. This is especially critical given that many firms lack comprehensive EDR coverage, even with MFA in place.
- Remote Device Management and Wiping: The ability to remotely wipe lost or stolen devices is a non-negotiable security measure. This capability ensures that sensitive data cannot be accessed if a device falls into the wrong hands, mitigating the risk of data exfiltration. The fact that less than half of all firms can perform this basic function is a significant cause for concern.
- Effective Cybersecurity Training with Simulations: Cybersecurity awareness training needs to move beyond theoretical lectures. Regular phishing simulations are essential to test employees’ ability to identify and report suspicious emails in a controlled environment. This practical experience reinforces learning and helps to build a more resilient human firewall. The low rate of simulation adoption suggests a missed opportunity to bridge the gap between knowledge and action.
- Layered Security Approach: Relying on a single security measure is insufficient. A layered approach, incorporating MFA, EDR, firewalls, intrusion detection systems, and robust data encryption, creates multiple barriers that cybercriminals must overcome, significantly increasing the difficulty of a successful attack.
- Regular Audits and Vulnerability Assessments: Proactive identification of weaknesses is crucial. Firms should conduct regular security audits and vulnerability assessments to pinpoint potential entry points and ensure that security measures are up-to-date and effective against the latest threats.
Broader Context and Implications for the Profession
The findings of the Rightworks survey are not isolated incidents but reflect a broader trend across various industries. However, the unique position of accounting firms as trusted advisors and data gatekeepers amplifies the stakes. The perceived confidence in cybersecurity may stem from a lack of awareness regarding the sophistication of current threats or an underestimation of the potential impact of a breach.
The timeline of evolving cyber threats underscores the urgency. Just a few years ago, sophisticated AI-driven attacks were largely theoretical. Today, they are a palpable reality, as evidenced by the shift in phishing tactics and the increasing volume of attacks reported by practitioners. The COVID-19 pandemic, which accelerated remote work adoption, further expanded the attack surface for many organizations, including accounting firms, making robust endpoint security and remote management capabilities even more critical.
The implications of these cybersecurity gaps extend beyond individual firms. A widespread vulnerability within the accounting sector could have cascading effects on the broader economy, impacting the integrity of financial reporting and the trust placed in the profession. Regulators are increasingly scrutinizing cybersecurity practices, and firms that fail to meet evolving standards risk significant penalties and reputational damage.
Rightworks, as a provider of security solutions, has a vested interest in highlighting these vulnerabilities. However, the data presented in their survey is independently verifiable and aligns with general industry concerns. The availability of the full survey findings at rightworks.com/resources/becoming-modern-firm allows for a deeper dive into the data and provides a resource for firms seeking to assess their own security posture.
The article concludes by offering access to this comprehensive report, along with other valuable resources, through registration. This highlights the commitment of platforms like CPA Practice Advisor to educating and empowering accounting professionals. The availability of interviews with Rightworks executives and featured firm leaders further suggests an ongoing dialogue and a commitment to addressing these critical cybersecurity challenges. The overarching message is clear: the time for complacency is over. Accounting firms must move beyond perceived security and embrace a proactive, multi-layered approach to protect themselves and their clients from the ever-present and evolving threat of cyberattacks.
