Professional services firms are built on trust. Clients share commercially sensitive information. They disclose financial details. They exchange confidential documents. They rely on their advisers to communicate securely and, in many cases, act on their behalf.
Increasingly, almost all of that happens digitally. Email, cloud applications, document-management platforms, Microsoft 365, file-sharing services and mobile devices have made professional services businesses more connected and productive than ever.
They have also created an attractive environment for cybercriminals. Not necessarily because professional services firms have the largest technology environments. But because of what — and who — those environments connect to.
For professional services leaders and IT teams, cyber resilience has become a shared business priority. The question is no longer simply how to stop every cyberattack. It's: How do we build an environment that protects client information, detects threats early and allows the firm to keep operating when something goes wrong?
1. Your information has value beyond your own organisation
Professional services firms can hold an extraordinary concentration of sensitive information. Depending on the firm, that might include contracts, legal documents, financial information, intellectual property, employee records, transaction details, strategic plans or confidential correspondence.
Much of it belongs to clients. That creates an important distinction. A cyber incident doesn't necessarily expose only your firm's information. It can expose information entrusted to you by dozens, hundreds or potentially thousands of other organisations and individuals.
The consequences therefore extend beyond the immediate technical incident. There may be regulatory and privacy implications. Client relationships can be affected. Commercially sensitive matters can be exposed. And leadership may suddenly find itself explaining how information entrusted to the firm was protected.
For professional services businesses, information security and client trust are increasingly difficult to separate.
2. Your trusted relationships can be valuable to an attacker
Sometimes, the firm itself isn't the attacker's ultimate destination. Its relationships are. Consider how much trust exists in everyday professional-services communication. A client receives an email from their lawyer. A finance team receives payment instructions from an adviser. An employee receives a document from a consultant they regularly work with. A supplier receives a request from someone at the firm.
Those communications carry credibility because they come from a trusted professional relationship. If an attacker compromises an employee's account, they may inherit some of that trust. Suddenly, phishing doesn't need to come from an obviously suspicious stranger. It can come from a real email address, inside a real conversation, discussing a real matter.
That's why protecting identity has become so important. Multi-factor authentication, conditional access, appropriate privileges and strong identity monitoring aren't simply technical controls. They're safeguards around the digital identities your clients have learned to trust.
3. AI is making impersonation easier
This challenge is becoming more complicated as AI tools improve. Attackers no longer need exceptional writing skills to create convincing emails. Generative AI can help produce polished, contextual messages at scale, while publicly available information can make social-engineering attempts increasingly personalised.
Professional services firms are particularly exposed because their employees often communicate extensively with people outside the organisation:
-
Clients.
-
Prospects.
-
Suppliers.
-
Other advisers.
-
External stakeholders.
That means an unexpected external message isn't necessarily unusual. And that's precisely what can make malicious communication harder to identify. This is also why AI security needs to be considered from both directions.
There's the question of how attackers use AI against your organisation. But there's also the question of how your own employees use AI with organisational and client information.
If staff are already experimenting with generative AI, firms need visibility and governance around what information is being shared and where it is going.
4. Email remains one of your most important business systems
For many professional services firms, email is effectively part of the service-delivery platform. Client instructions arrive through it. Documents are exchanged through it. Meetings are organised through it. Invoices and payment information may be discussed through it. Sensitive matters are debated through it.
That makes a compromised mailbox particularly valuable. An attacker who gains access may be able to observe conversations before acting. They can learn how people communicate. Who approves what. Which clients are involved. When a transaction is occurring. What language employees normally use. And potentially when the perfect opportunity exists to insert themselves into a conversation.
That's why email security shouldn't be viewed solely as spam filtering. It needs to sit alongside identity protection, user awareness, monitoring and processes for verifying sensitive requests. Technology can reduce risk. Good business processes provide another layer.
5. Cyber resilience starts with assuming something will eventually get through
No organisation can guarantee that every malicious email will be blocked, every vulnerability prevented or every employee will make the correct decision every time.
A resilient security strategy acknowledges that. Instead of asking only: "How do we stop an attacker getting in?" it also asks: "What happens if they do?"
-
Can a compromised account access more information than it needs?
-
Would unusual login behaviour be detected?
-
Could an attacker move easily between systems?
-
Are endpoints being monitored?
-
Can you identify what happened?
-
Can compromised credentials be contained quickly?
-
Do you have tested backups?
-
Could the firm continue working if a critical system became unavailable?
-
Does everyone know who makes decisions during an incident?
Those questions shift cybersecurity from prevention alone to resilience. And that distinction matters.
6. A resilient IT environment has layers
There's no single product that makes a professional services firm resilient. Instead, resilience comes from multiple controls working together.
-
Identity
Strong authentication, appropriate access and visibility into suspicious behaviour.
-
Endpoints
Managed and patched devices with modern endpoint protection and detection capabilities.
-
Email and collaboration
Protection around the systems employees use to communicate and share information.
-
Data
Understanding where sensitive information sits, who can access it and how it is protected.
-
Monitoring
The ability to identify unusual activity rather than waiting for somebody to report that something feels wrong.
-
Backup and recovery
Reliable backups combined with confidence that systems and information can actually be restored.
-
People and processes
Employees who understand common threats, alongside clear processes for sensitive activities such as payment changes or unusual information requests.
Individually, none is enough. Together, they make it considerably harder for one compromised password, malicious email or vulnerable device to become a major business incident.
What does this look like in a professional services firm?
Cyber resilience can sound abstract when it's discussed only in terms of controls and frameworks. It's much more useful to see what a technology partnership can look like inside an actual professional services business.
William Buck, an accounting and advisory firm, works with Subnet to support its technology environment. For other professional services firms, the case study provides a practical example of how an external technology partner can work with an organisation where reliable technology, information security and client trust all matter.
Read the William Buck case study →
That's an important point. Cyber resilience isn't achieved by buying one security product or completing one project.
It's built through the technology, processes, people and expertise surrounding the organisation — and through continuously improving how those pieces work together.
7. Resilience also means keeping the firm operating
This is the part of cybersecurity discussions that sometimes gets overlooked. Imagine a significant cyber incident tomorrow.
-
Could your people still work?
-
Could they communicate with clients?
-
Could they access critical documents and systems?
-
Could you determine what had been affected?
-
How quickly could essential services be restored?
-
And would leadership know what to do next?
For a professional services firm, extended technology downtime can quickly become a commercial problem. People can't deliver billable work. Deadlines may be affected. Clients need answers. Employees lose productivity. Senior people are pulled away from their normal responsibilities.
So the objective of cybersecurity isn't simply to create an environment that is difficult to attack. It's to create an organisation capable of responding and recovering when an incident occurs.
Subnet's broader managed-security guidance similarly emphasises 24/7 monitoring, incident response and recovery as components of cyber resilience rather than relying on preventative controls alone.
8. Cybersecurity shouldn't depend on one person knowing everything
Many professional services firms don't have enormous internal IT departments. Some have a small technology team. Others rely heavily on one or two knowledgeable people alongside external providers.
That can work extremely well. But as the security environment becomes more specialised, it's worth asking whether the organisation has access to all the capabilities it may need.
-
Who monitors security events?
-
Who investigates something suspicious?
-
Who understands the Microsoft 365 security environment?
-
Who manages endpoint detection?
-
Who leads an incident response?
-
Who helps at 2am?
-
And what happens when the person who normally knows the answer isn't available?
The answer doesn't necessarily need to be building a much larger internal IT department. A co-managed approach can allow internal IT teams to retain their knowledge and ownership of the environment while drawing on specialist cybersecurity, infrastructure and support capability when needed. Subnet's current managed-security material explicitly supports this kind of co-managed model.
The goal isn't to replace the people who know your business best. It's to make sure they're not expected to defend it alone.
Cyber resilience protects more than systems
Ultimately, professional services firms don't sell technology. They sell expertise. Judgement. Advice. Outcomes. And, underpinning all of those things, trust.
Technology is simply where an increasing amount of that trust now lives. It's in the email account a client communicates with. The document repository containing confidential files. The identity used to access sensitive systems. The laptop an employee takes between meetings. The cloud applications the firm depends upon every day.
That's why cybersecurity in professional services needs to be about more than deploying security products. It requires an environment designed to protect information, detect threats, contain incidents and recover quickly.
Because when clients trust you with their business, they're increasingly trusting you with their data too. A resilient IT environment helps protect both.
See what this looks like in practice
See how Subnet works with William Buck and what a technology partnership can look like within a professional services firm.
Read the William Buck case study →
Or, if you're considering how resilient your own environment would be in the face of a cyber incident:
Talk to Subnet about your IT environment →
Comments