Why Accounting Firms Can't Afford to Neglect Cybersecurity: A Wake-Up Call for

In the world of accounting, cybersecurity is often seen as an afterthought, something that’s only truly considered during peak seasons or when a breach occurs. However, recent incidents demonstrate that this approach can be disastrous. Cybercriminals are increasingly targeting accounting firms, using sophisticated tools and exploiting common vulnerabilities. The latest security trends reveal just how critical it is for accounting teams to rethink their cybersecurity strategies, not only during tax season but year-round.

Cybercriminals often capitalize on the pressures of tax season, outdated security practices, and the growing complexity of cloud-based tools. Accounting professionals are responsible for vast amounts of sensitive data, which makes them prime targets for cyber-attacks. In this context, it’s not just about protecting individual firms—it’s about safeguarding an entire industry that’s becoming more vulnerable to both human error and technological threats.

Cybersecurity Threats in Accounting: The Rise of Deepfakes and SaaS Sprawl

The security landscape for accounting firms is under siege, and the risk is more real than ever. In early 2024, an employee at UK-based engineering firm Arup unknowingly participated in a video call with cybercriminals using deepfake technology. The attackers mimicked the senior management’s voices and faces so effectively that they successfully transferred $25 million out of the company. The employee had no way of knowing that the faces they were seeing were digitally altered.

Carl Froggett, CIO at Deep Instinct and former head of global infrastructure defense at Citi, points out that incidents like this should serve as a wake-up call, especially for accounting professionals. According to him, accounting teams often face high-pressure environments that make them especially vulnerable. During tax season, for instance, the sheer volume of sensitive data exchanged—such as financial documents and tax forms—creates a perfect storm for cybercriminals looking to exploit weak points in security.

The expansion of cloud-based platforms has compounded the problem. Chris Davis, CTO at Dark Horse CPAs, explains that the proliferation of Software-as-a-Service (SaaS) applications has led to “SaaS sprawl.” Firms are using multiple platforms that each have their own security protocols, increasing the likelihood of oversight and human error. This is especially problematic for smaller firms that lack a robust IT infrastructure.

Human error is a major vulnerability in this scenario. According to Davis, accounting professionals are sometimes observed using personal email accounts for work, transmitting documents via SMS, and reusing passwords. These risky behaviors can leave firms exposed to phishing and malware attacks.

Addressing Vulnerabilities: Proactive Security Measures for Accounting Firms

To combat these threats, Davis recommends implementing a few foundational security controls, such as virtual private networks (VPNs), mobile device management (MDM), and enforced multi-factor authentication (MFA). However, it’s essential that security doesn’t only focus on endpoints. As Froggett explains, attackers often target the document transmission process rather than the devices themselves. Ensuring that documents are scanned for malware while in transit is far more effective than trying to mitigate threats after they land on an endpoint.

Davis emphasizes that secure communication portals should replace traditional email attachments, even though clients may complain about the added inconvenience. By adopting more secure methods of communication, accounting firms can reduce their exposure to cybercrime. As Davis notes, cutting corners for the sake of convenience can result in severe long-term consequences.

The Human Element: Security Awareness and Education

At the heart of many cybersecurity breaches is the human element. Froggett explains that the most successful attacks often exploit human weaknesses, such as trust and stress. Cybercriminals know how to tailor their attacks to individuals, using language and references that resonate with their targets. This personalization increases the likelihood of successful phishing attempts, impersonations, and deepfake scams.

Froggett highlights the importance of security awareness training and the need for consistent reminders about the basics of cybersecurity. A short, 10 to 15-minute security session before tax season can help remind employees about their individual responsibility to protect sensitive client data. Furthermore, when something seems off—whether it’s an email, a phone call, or a Zoom meeting—Froggett advises professionals to “trust but verify.” Simple verification steps, such as calling the person directly instead of replying to an email, can prevent costly mistakes.

What Undercode Says: Rethinking Cybersecurity Strategy for Accounting Firms

Undercode’s perspective on the cybersecurity landscape in accounting is clear: firms must take a proactive approach to securing their infrastructure, data, and communications. The increasing sophistication of cyberattacks—such as deepfakes, phishing, and SaaS-related vulnerabilities—demands a more comprehensive cybersecurity strategy.

What’s alarming is the pace at which accounting professionals are exposed to these threats. The reliance on SaaS tools, lack of centralized security management, and increased human error during busy tax periods create a perfect storm for cybercriminals. Accounting firms must recognize the importance of cybersecurity not just during the rush of tax season, but as an ongoing, year-round concern.

The advice from experts like Davis and Froggett suggests that addressing cybersecurity within accounting firms requires a cultural shift. Security should be treated as a priority from the top down, with leadership driving the change. Moreover, the principle of least privilege access should be enforced rigorously. By ensuring that employees only have access to the data necessary for their roles, firms can prevent breaches from escalating into major security disasters.

Firms should also look at their technology stack holistically. Instead of relying on outdated tools and piecemeal security measures, accounting professionals must adopt integrated solutions that offer robust protection at all stages of document handling—from transmission to storage. This means not just securing endpoints but securing the entire data lifecycle.

Furthermore, accounting firms need to keep pace with emerging threats by continuously adapting their security protocols. As cybercriminals evolve their tactics, accounting firms must remain vigilant and ensure that their defenses are updated regularly. This includes ensuring that all communication channels are secure, especially those involving sensitive financial information.

Fact Checker Results:

Incident Verification: The deepfake incident at Arup was a well-documented case, highlighting the real-world threat of AI-driven fraud.
Vulnerability Insights: The SaaS sprawl issue is an increasing concern in the accounting industry, as firms often fail to integrate or secure multiple platforms effectively.
Training and Awareness: Experts agree that ongoing cybersecurity education and proactive communication protocols are essential to safeguarding sensitive data.