5 Common Cybersecurity Gaps in Professional Services Firms

Most professional services firms believe the basics are handled. You have antivirus, you run backups, you work in Microsoft 365, and you have an IT provider you trust. On paper, the foundation looks solid — which is exactly why the remaining cybersecurity gaps tend to go unnoticed. They don’t announce themselves. They sit quietly until an incident brings them to the surface, usually at the worst possible time.

When we run our IT Risk Scorecard reviews for law firms, accounting practices, and financial offices across the North Shore and Cape Ann, the same cybersecurity gaps appear again and again. None of them is unusual. None requires an alarm. But each one quietly widens the distance between “we think we’re protected” and “we actually are.” Here are the five we see most often, and what closing each one really involves.

Why Cybersecurity Gaps Matter for Professional Services Firms

Law, accounting, and financial firms hold something attackers actively look for: concentrated, sensitive client information in one place. Tax records, case files, account numbers, confidential correspondence. A firm of fifteen people can hold the kind of data that makes it as appealing a target as a company ten times its size.

There’s also the matter of trust. For a professional firm, a breach isn’t only a technical problem — it’s a client-confidence problem and, increasingly, a compliance problem. That’s why these IT security gaps are worth understanding plainly, before circumstances force the conversation. The goal here isn’t fear. It’s clarity.

1. Multi-Factor Authentication Isn’t Enabled Everywhere

Most firms have turned on multi-factor authentication (MFA) for email, and that’s a genuinely good start. The trouble is that email is rarely the only way into your systems.

Administrative accounts, cloud applications, remote access tools, and VPN connections are the doors that often get left unlocked. Attackers know this pattern well, so they look for the one login MFA doesn’t cover. When they find it, the protection on your email no longer matters much.

Picture a firm that secured every employee’s inbox but never enabled MFA on the admin account that controls all of them. That single account is the whole building’s master key. The fix is straightforward: apply MFA consistently across every account and application, with particular attention to the privileged accounts that carry the most risk.

The better question to ask isn’t “Do we have MFA?” It’s “Where don’t we have it yet?“

MFA works best alongside strong, unique passwords. A business password manager like 1Password makes that practical by creating and remembering strong passwords for employees, rather than relying on people to do so themselves.

2. Backups Exist, But They Haven’t Been Tested

Having backups and being able to recover from them are two very different things — and the gap between them is one of the most common cybersecurity gaps we find.

Backups break quietly. A system gets added but never included in the backup scope. A setting changes. The data copies over but turns out to be incomplete. Nothing looks wrong from the outside, so the assumption holds: “We’re backed up, we’re fine.” That assumption only gets tested during a real incident, which is the worst moment to learn it doesn’t hold.

A firm we reviewed had run nightly backups for years. When we tested an actual restore, it would have taken days, not hours — long enough to halt client work entirely. The fix is to test recovery on a regular schedule, confirming both how long it takes and whether the data comes back whole. A backup you’ve actually restored is the only one you can count on.

3. Former Employees Still Have Access

When someone leaves your firm, their access is supposed to leave with them. In practice, it lingers far longer than most owners realize — and it’s one of the most overlooked security risks in any firm.

Dormant user accounts, active email forwarding rules, lingering logins to cloud applications, and company data on personal devices: each is a quiet entry point. Forwarding rules are the easy one to miss, because a single rule left in place can keep sending sensitive information out of the firm for months without anyone noticing.

The remedy isn’t complicated, but it has to be deliberate. A documented offboarding checklist that covers every system, application, and access point someone touched — not just their main email — closes a gap that otherwise stays open indefinitely.

There’s a newer version of this same problem: AI and custom applications connected directly to Microsoft 365. As businesses adopt more integrated AI tools, it’s important to understand which applications have access, what they can reach, and whether that access is still necessary.

4. Security Awareness Training Is Infrequent

Technology alone cannot stop a well-crafted phishing email. Your people remain the most targeted way into any firm, which makes them either a vulnerability or a line of defense, depending on how prepared they are.

The challenge is that a single training session once a year fades fast. Phishing tactics shift constantly, and a refresher from eleven months ago offers little protection against a convincing message that lands on a busy Tuesday afternoon.

What works is regular, brief, practical reinforcement — short sessions paired with the occasional simulated phishing test. The aim isn’t to catch people out. It’s to build the kind of instinct that makes someone pause before clicking, because that pause is often the entire difference.

5. There’s No Documented Incident Response Plan

Most firms know they should “call someone” if something goes wrong. Far fewer have written down who that someone is, what happens first, and who makes which decision — and that missing plan is itself one of the more serious cybersecurity gaps a firm can carry.

When an incident hits, hesitation is expensive. Without a documented response plan, the first few hours dissolve into confusion and crossed wires, exactly when speed and clarity matter most. Everyone is busy; no one is sure who’s actually in charge.

A workable plan defines roles, responsibilities, escalation steps, and the contacts you’ll need before you need them. Then it gets a quick practice run, so that if the day comes, the response is calm and coordinated rather than improvised.

How Many of These Cybersecurity Gaps Exist in Your Firm?

If you recognized your firm in two or three of these, you’re in good company — most firms have at least that many open, usually without knowing it. That’s not a failure of effort. It’s the natural result of running a busy practice while IT quietly grows more complex in the background.

A reasonable next step is simply to look. Check where MFA is and isn’t enabled. Find out when your backups were last actually restored. Confirm that the person who left in the spring no longer has a way in. Those three answers alone tend to be clarifying.

If you’d like a structured starting point, our free 3-minute Cybersecurity Self-Check helps professional services firms quickly spot potential areas of concern. And for a deeper view, our complimentary 35-Point IT Risk Scorecard examines your security controls, recovery readiness, and operational risk in detail — so you can close the gaps on your own terms, before an incident does it for you.

Identifying individual cybersecurity gaps is important, but it’s also worth looking at the bigger picture. Has your business outgrown its IT provider? Here are 10 questions that can help you find out.

IT Support Across the North Shore

Slingshot provides reliable, security-focused IT support for businesses across Massachusetts’ North Shore. Whether you’re dealing with cybersecurity threats, compliance requirements, or day-to-day IT challenges, our team delivers fast, proactive support tailored to your local business environment.

North Shore Communities We Serve

If your business operates in any of these North Shore communities, Slingshot can help you reduce downtime, improve security, and keep your systems running smoothly.