<img src="https://www.cpapracticeadvisor.com/wp-content/uploads/2026/10/rightworks_1920x1080_Modern-Firm.png" alt="Accounting Firms’ Cybersecurity Confidence is Outpacing Their Protections” loading=”lazy”>
Firm Management | October 29, 2026
Accounting Firms’ Cybersecurity Confidence is Outpacing Their Protections
Three cybersecurity priorities accounting firms should should focus on before tax season.
Accounting firms are increasingly confident in their cybersecurity, but new research from Rightworkspoints to some significant gaps in the key protections needed to safeguard sensitive financial and client data. Rightworks is an intelligent cloud service provider and trusted advisor of purpose-built solutions for accounting firms and tax professionals.
The 2026 Accounting Firm Technology Survey, conducted among more than 500 accounting firms, found confidence in current security measures rises from 73% at the least modern firms to 92% at the most advanced. Yet only 44% of all firms can remotely wipe a lost or stolen device. Even among firms using layered device security such as multifactor authentication, just 43% have endpoint detection and response (EDR) on every device.
The least modern firms also reported the fewest cybersecurity incidents or breaches in the past year (5%, compared with 11% among the most advanced firms). That raises an important question for the profession: Do less modern firms have fewer incidents or weaker detection? Firms with more advanced monitoring are better positioned to identify threats, so some incidents at less modern firms may go unnoticed.
“When it comes to security, I don’t know what I don’t know,” said Lisa Dionisio, CPA, owner of Paxus CPA Group in Norman, Oklahoma. “There’s so many more threats out there than I’m even aware of.”
Outsourcing IT doesn’t necessarily close that gap, since not every provider offers the same level of monitoring. Jennifer Brook, partner at HighPoint CPAs in Laramie, Wyoming, saw this firsthand before her firm moved to Rightworks: “A lot of times our outsourced IT wouldn’t know there was something wrong until we called them.”
AI is Making Cyberattacks Harder to Recognize
Anjan Bagchee, Chief Information Security Officer at Rightworks and former CISO of the Federal Reserve Bank of Boston, said phishing emails have shifted from bad grammar and awkward sentences to polished messages that appear legitimate, a sign of generative AI. “For accounting firms, these threats are no longer theoretical,” he said.
Alex Weidner, President and Managing Partner of Rudler PSC in Northern Kentucky, said AI is “being used for bad, and trying to get into and hack our data,” with more attempts “over the last 12 months than we have the prior five years.”
Human error is a leading cause of breaches, yet only 58% of firms that provide cybersecurity training run phishing simulations, leaving a potential gap between awareness and real-world preparedness.
Compliance Raises the Stakes
The risk isn’t only technical. Tax preparers are legally required to keep a written information security plan (WISP), and 81% of surveyed firms have one. Under the Federal Trade Commission’s amended Safeguards Rule, covered firms must also report certain breaches involving 500 or more consumers to the FTC within 30 days of discovery.
Accounting Firms Are Turning to Trusted Technology Partners
About two-thirds of all firms (68%) now rely on outside IT support in some form, and for firm leaders the benefit extends beyond technical protection to reducing the burden of managing IT. “I’m the boss, everything stops with me,” said Hal Allen, who has run Apex Financial Solutions of Utah for 12 years. “I have somebody I can rely on and consult with, and that’s looking out for me. That’s not my expertise. I’m a CPA. I’m not an IT specialist.”
“The security that Rightworks provides gives us peace of mind that our data and our clients’ data is secure,” Weidner said. “It helps me sleep better at night.”
But not every firm has made that move, and the divide closely aligns with firm maturity. Among the least modern firms, 61% still manage IT entirely in-house, compared to 11% of the most advanced firms. Without access to the specialized expertise needed to combat today’s evolving cyberthreats, these firms risk operating with a false sense of security.
“Firms feel more confident than ever, and that’s exactly the risk,” said Ian Williams, CEO of Rightworks. “Confidence isn’t the same as coverage. When fewer than half of firms can wipe a lost laptop, security can’t be something the most tech-savvy partner handles on the side. It’s a leadership decision.”
3 Cybersecurity Priorities Before Tax Season
- Put EDR on every device. Among firms with layered device security, only 43% have it everywhere.
- Make sure you can remotely wipe a lost laptop or phone. Just 44% of firms can today.
- Test staff with phishing simulations. Only 58% of firms that train staff run them.
Rightworks helps firms close these gaps with a portfolio of solutions built for the unique demands of the accounting profession, including Cloud Premier, Rightworks Total Security, Cloud Protect and WISP Compliance. Firms rely on Rightworks’ 24/7 monitoring, EDR, multifactor authentication and phishing simulations, backed by IT security experts who block 3.6 million threats each month. The result is a layered defense that keeps firms protected against an evolving threat landscape.
The full survey findings are available at rightworks.com/resources/becoming-modern-firm. Rightworks executives and firm leaders featured in this release are available for interviews.
Sign in to get access to this free resource, and all of our whitepapers and reports.
Download this content today!
Register to get free access to this content, as well as newsletters, continuing education, podcasts, and more…
Already registered?
How Playing and Coaching Baseball Has Influenced Leigh D’Andrea’s Career at Deloitte
Playing and coaching baseball has shaped the leadership style of Leigh D’Andrea, Deloitte’s new managing principal in Stamford, CT.
Where Do Your First-Years Get Their Reps Now?
Before we rip out the tasks AI can replace, we need to ask what else those tasks delivered and how we plan to replace it.
Centri Makes an Impact in Communities Nationwide Through Annual VTO Day
Teams from Centri’s 10 offices partnered with local nonprofits to support food security, serve vulnerable populations and help maintain public green space.
AICPA 2026 National Tax Conference to Spotlight AI, Tax Policy and Emerging Issues for Taxpayers
National Taxpayer Advocate Erin Collins will provide an update on key issues facing taxpayers and practitioners.
