Accounting firms
A fixed-price CPA and accounting firm cybersecurity assessment. We check your accounting system, remote access to the server, email, IRS portal security, and backup — exactly where an attacker looks for a way in. Free PreScan in 24 hours, full report in 5 business days. No IT department required on your end.
Book a free pre-scanWe know the systems your firm runs on
The honest version
This isn't scare-talk - it's the pattern the Verizon DBIR5 and FBI IC34 reports have shown for years about firms that handle other people's money and data.
Your firm holds tax filings, payroll, and bank-account details for 20-200 businesses at once. To an attacker that is not one victim - it is an entire database in a single place. That is why accounting firms are targeted far more often than a single company of the same size.
Statutory deadlines - the 20th and 25th of each month, the year-end filing dates - are the window where downtime hurts most and pressure to pay the ransom is highest. Ransomware fired at the peak of filing season is not an outage; it is the whole firm frozen at the worst possible moment.
One forged "changed account number" message looks like routine, because routine is exactly what it is. Business email compromise (BEC) is the most common real financial loss in an accounting firm - a single hit is usually tens, sometimes hundreds of thousands.
The assessment
We check whether your system — QuickBooks Desktop, Sage 50, Drake Tax, Lacerte, ProSeries, CCH Axcess — is reachable from the internet through open RDP, TeamViewer or AnyDesk. An exposed accounting server is the most common ransomware entry point in professional-services firms.
Remote desktop to the QuickBooks or tax-prep server and VPN connections are the dominant attack vector in CPA firms. We check whether RDP is publicly visible, whether the VPN is up to date, and whether access requires MFA — not just a password.
SPF, DKIM and DMARC configuration for your domain. Without them, someone can impersonate your firm and email a client or your bookkeeper with a changed account number. Invoice-redirect and BEC fraud is the number-one threat in this industry.
You operate IRS e-Services accounts and IRS Tax Pro accounts that touch every client's return. We check how credentials and access tokens are stored, whether permissions are granted per employee (not shared firm-wide), and whether each account has MFA — phishing that impersonates the IRS is the fastest-growing threat in US tax practices.
If you run a client portal for document exchange, we look for injectable forms, outdated plugins and exposed admin panels. We also check whether your client-database backup is reachable from the internet (and therefore by ransomware) and whether an offline copy exists per the 3-2-1 rule.
We check your team addresses against breach feeds, plus the common firm pattern of one password reused across the social-security portal, the tax portal, banking and the internal system. One leaked password used everywhere is an open path into every client account.
FTC Safeguards without the scare
The short, honest answer: almost certainly yes. CPA firms, tax-prep practices, and bookkeeping services qualify as non-bank financial institutions under the Gramm-Leach-Bliley Act. The 2023 amendments added a mandatory penetration-testing requirement and breach notification to the FTC within 30 days.
| Your situation | FTC scope |
|---|---|
| CPA, tax-prep, or bookkeeping firm with individual or business clients | Covered — you are a non-bank financial institution under the Gramm-Leach-Bliley Act |
| You provide only payroll services, no tax or financial planning | Likely covered — payroll involves consumer financial data; confirm based on service scope |
| 5,000+ consumer records under management | Additional obligation — must maintain a written WISP and designate a qualified security officer |
| Breach affecting 500+ customers | Must notify FTC within 30 days — and notify affected clients under applicable state laws |
The FTC Safeguards Rule requires both a written risk assessment and annual penetration testing. CyberAudyt satisfies both in a single engagement — and produces the documentation to show an auditor.
The real cost
The FTC Safeguards Rule (under GLBA) requires a written information security program, a risk assessment, and penetration testing for covered financial institutions including CPA and tax-prep firms. Violations carry civil penalties up to $100,000 per violation per day — plus the FTC can seek injunctions and restitution.
Business email compromise is the costliest category of cybercrime in the FBI IC3 2024 report, with US losses exceeding $2.9 billion. A CPA firm authorising client wire transfers every day is a high-value target. The money rarely comes back.
Accounting is a relationship built on trust and referrals. A single email telling clients their financial data leaked can move half your book to a competitor within weeks. No PR firm softens that.
How it plays out in practice
None of these require you to be an "interesting" target. They all start with something a scan finds in the first few hours.
An attacker takes over an assistant's inbox through phishing, impersonates the firm's owner, and sends an 'urgent' request to change the account number on a client's tax payment. The money lands in the fraudster's account before anyone calls to confirm.
A compromised accounting-software update or plugin delivers ransomware straight onto the firm server. Every client's filing files, databases and returns are encrypted - in the middle of the submission deadline.
A partner works from home, so the Remote Desktop to the QuickBooks Desktop server is exposed to the internet. A bot finds it within hours, brute-forces a weak password, encrypts the client database and exfiltrates it at the same time — double extortion: ransom to decrypt and ransom not to publish client financials.
The same password protects the IRS e-Services account and the internal-system login. It leaks in a breach at an entirely different vendor, the attacker tries it everywhere, and takes over the tax portal session — with access to every client's return history and e-file status.
A staff accountant receives an email: 'Action required — IRS e-Services login expired.' One click hands over the access token. The attacker now has view access to every client's transcript on record and can modify e-file direct-deposit routing on pending refunds.
See what a real report looks like
We've redacted the name and domain. Everything else is the real output - the findings, the severity scoring, the prioritised action list, and the plain-language explanation the owner can hand to their IT provider the same day.
Deliverables
Every firm that orders the full assessment gets the same package - no tiers, no upsells, no "enterprise only" features held back.
Pricing
You start free. You only pay if there is something to fix. The CyberAudyt price is fixed - regardless of how many seats, clients or locations you run.
results in 24 h
Passive external scan of your firm. We show what is visible from the internet - with zero access on your end. Answers the question "is there even anything to worry about."
report in 5 business days
Full external assessment with manual verification: accounting system, remote access, email, IRS e-Services / tax-portal security, client portal and backup. Plain-language report with prioritised fixes and a 30-minute call. Fixed price regardless of how many seats or clients you have.
once remediation is done
After you close the gaps, we re-check that the fixes actually worked - at half the CyberAudyt price for firms that already completed one. The current report is something you can show clients as proof of due diligence.
Post-season offer. The best time for an audit is right after tax season. Book a slot during the season (January-April) and you lock in today's price and priority scheduling for May-June, when the team can breathe.
Guarantee: if CyberAudyt doesn't surface at least 3 actionable findings, you pay nothing.
Fixed price - no hourly billing, no surprises. Larger firm networks, or when a corporate client requires it: a full penetration test is also available.
Questions accounting owners ask us
You send us your domain name. We tell you in 24 hours what an attacker sees. If that's nothing serious, you keep the report and we disappear. If it's serious, you get a fixed-price proposal - no pressure, no subscription.
No credit card. No access to your systems. No recurring fees.