Accounting Firms’ Cybersecurity Confidence Exceeds Key Protections, Survey Finds

Accounting firms’ confidence in their cybersecurity rises with their technology maturity, but several basic safeguards remain out of reach for many practices. The gap matters as firms prepare for tax season with sensitive financial and client data in their care: a firm may feel secure without having the tools to spot threats or respond when a device goes missing.

The 2026 Accounting Firm Technology Survey, conducted among more than 500 firms, found that confidence in current security measures ranges from 73% at the least modern firms to 92% at the most advanced. Across all firms, though, only 44% can remotely wipe a lost or stolen device. Among firms using layered device security, only 43% have endpoint detection and response (EDR) installed on every device.

Those figures point to a practical distinction: confidence describes how leaders feel about their protections, while device controls and monitoring show what a firm can do when something goes wrong. Remote wiping can limit access to data on a missing phone or laptop. EDR helps identify and respond to suspicious activity on computers and other endpoints. Gaps in either capability can leave firms less prepared to contain a problem.

Fewer reported incidents may not mean fewer threats

The survey found that 5% of the least modern firms reported a cybersecurity incident or breach in the previous year, compared with 11% of the most advanced firms. That difference has two possible readings: less modern firms could be experiencing fewer incidents, or they could be less able to detect them. The figures alone don’t resolve which explanation carries more weight.

More advanced monitoring can reveal activity that might otherwise go unnoticed. That makes incident counts difficult to compare across firms with different detection capabilities. Lisa Dionisio, CPA and owner of Paxus CPA Group in Norman, Oklahoma, described the uncertainty: “When it comes to security, I don’t know what I don’t know. There’s so many more threats out there than I’m even aware of.”

Hiring outside IT support doesn’t automatically close the gap. Jennifer Brook, partner at HighPoint CPAs in Laramie, Wyoming, said that before her firm moved to Rightworks, “A lot of times our outsourced IT wouldn’t know there was something wrong until we called them.” The experience underscores that the scope and timing of a provider’s monitoring matter alongside the decision to outsource.

AI is changing what suspicious messages look like

Phishing messages once gave themselves away with clumsy wording and obvious errors. Anjan Bagchee, Rightworks’ chief information security officer and a former CISO of the Federal Reserve Bank of Boston, said messages now can read as polished and credible, a shift he associated with generative AI. For accounting teams handling client information, that can make quick visual checks less reliable.

Alex Weidner, president and managing partner of Rudler PSC in Northern Kentucky, said attempts to get into the firm’s data had increased “over the last 12 months” compared with the prior five years. The survey also suggests a gap in staff preparation: among firms that provide cybersecurity training, only 58% run phishing simulations. Training can explain the signs of a deceptive message; simulations can show whether employees recognize those signs in practice.

Planning and support remain uneven

The survey found that 81% of firms have a written information security plan, or WISP. That makes the plan a common feature, though it isn’t universal. The source also notes that certain firms covered by the amended Safeguards Rule must report qualifying breaches involving 500 or more consumers to the FTC within 30 days of discovery. Those requirements make it important for covered firms to understand their responsibilities and have a response process in place.

About two-thirds of surveyed firms, or 68%, rely on outside IT support in some form. For owners, that can provide access to expertise and reduce the burden of handling technical decisions themselves. Hal Allen, who has run Apex Financial Solutions of Utah for 12 years, said, “I’m the boss, everything stops with me,” and described having someone to consult as valuable because IT isn’t his specialty.

Firm maturity tracks closely with who manages that work. Among the least modern firms, 61% handle IT entirely in-house; among the most advanced, the figure is 11%. The contrast doesn’t establish that outsourcing alone produces stronger protection. It does show how much internal responsibility can sit with smaller or less technologically advanced practices, which may have fewer dedicated resources for monitoring and response.

Three checks before tax season

Rightworks CEO Ian Williams framed the central risk as a mismatch between confidence and practical safeguards: “Confidence isn’t the same as coverage.” His point is reflected in the survey’s priorities for firms ahead of tax season:

• Confirm that EDR runs on every device. Only 43% of firms with layered device security have it everywhere.
• Check that staff can remotely wipe a lost laptop or phone. Just 44% of firms can do so.
• Use phishing simulations to test staff readiness. Only 58% of firms that provide cybersecurity training run them.

Weidner said the security support his firm receives gives him peace of mind about the firm’s and clients’ data. For practices weighing their own readiness, the survey’s clearest signal is that confidence should be checked against specific capabilities: what the firm can monitor, what it can disable, and how well staff respond when a message looks convincing.