Accounting Firms Face Device Security Gaps Ahead of Tax Season
Survey data shows gaps in device controls and phishing practice at accounting firms, despite high confidence in their cybersecurity.
Accounting firms’ confidence in their cybersecurity outpaces several of the controls that could limit damage when devices go missing or staff encounter convincing scams. With tax season approaching, a survey of more than 500 firms points to three practical pressure points: endpoint detection on every device, the ability to erase lost devices remotely, and phishing simulations that test staff readiness.
The 2026 Accounting Firm Technology Survey, conducted by Rightworks, found that reported confidence in security measures ranged from 73% at the least modern firms to 92% at the most advanced. Yet just 44% of firms said they could remotely wipe a lost or stolen device. Among firms using layered device security, only 43% had endpoint detection and response (EDR) installed on every device. Those figures suggest that confidence and coverage do not always move together.
Coverage matters across the device fleet
EDR is designed to identify and respond to suspicious activity on computers and other endpoints. Its value depends in part on where it is installed: protection on some machines can leave others outside the same line of defense. The survey does not specify why firms lack full coverage, but the gap gives firm leaders a concrete inventory question to resolve before peak workload makes system changes harder to coordinate.
Firms can start by checking which laptops, desktops and other work devices are covered, then compare that list with the devices staff actually use to handle client work. A policy or product choice alone doesn’t establish that every endpoint is protected; the useful measure is whether deployment reaches the full fleet and remains in place as devices change hands or are replaced.
That detail matters in accounting, where staff may work across offices and remotely, and where client financial information is part of routine operations. A device that falls outside security coverage can create an exposure even when a firm has adopted multiple other safeguards. The survey’s 43% figure applies specifically to firms with layered device security; it should not be read as a measure of EDR use among all firms.
Remote wiping is a direct response to device loss
The ability to remotely erase a lost or stolen laptop or phone offers a way to remove information from a device that a firm can no longer physically control. But only 44% of surveyed firms said they had that ability. That leaves a majority without a reported remote-wipe capability, according to the survey.
Having the option available is only one part of preparedness. Firms need to know which staff members can trigger a wipe, which devices are enrolled, and what steps follow when a device goes missing. These are operational questions, and the source survey does not report how firms handle them. Still, a simple check of device enrollment and response procedures can reveal whether a stated capability would work in practice.
For employees, clear instructions can reduce uncertainty during a stressful incident. For clients, the concern is whether sensitive records stored or accessed through a device remain exposed. The survey does not quantify losses or incidents connected to missing devices, so its findings describe protection gaps rather than their financial consequences.
Training needs practice, not just awareness
Phishing remains another concern because a message can prompt a person to disclose information or open a harmful link. Rightworks Chief Information Security Officer Anjan Bagchee said these threats are no longer theoretical and described phishing messages that have moved beyond the poorly written emails people may be used to spotting. He pointed to generative AI as a factor in the more polished messages.
That shift raises the value of practice. Only 58% of firms that provide cybersecurity training also run phishing simulations, according to the survey. Training can explain warning signs; simulations can show how staff respond when a suspicious message arrives in a realistic setting. The figures do not show how often simulations occur or how firms use their results, but they highlight a gap between instruction and testing.
Alex Weidner, president and managing partner of Rudler PSC in Northern Kentucky, said attempts to compromise data had increased over the prior 12 months compared with the preceding five years. His account is an individual practitioner’s experience, rather than a survey-wide measure. It nonetheless adds context to the survey’s emphasis on staff readiness and evolving message quality.
Three checks before the busy period
The survey’s findings point to a focused review: verify that EDR covers every work device, confirm that lost laptops and phones can be wiped remotely, and use phishing simulations alongside staff training. The headline confidence figures offer one view of firms’ self-assessments; the control figures show where those assessments may not yet translate into consistent coverage.
Rightworks describes itself as a provider of firm management, security technology and IT solutions for accounting firms and tax professionals. The survey findings are available through its 2026 Accounting Firm Technology Survey resource page. The practical takeaway is to check whether safeguards reach every device and whether staff can apply their training under realistic conditions before seasonal demands intensify.
