What Has Changed, What AI Makes Harder, and What to Do Next
If your firm runs on Microsoft 365, Clio, Xero, cloud storage, and a stack of SaaS apps, your “front door” is no longer your office network. It’s your identities. In 2026, identity security for professional services firms matters more than ever because attackers do not have to “break in” anymore. They can simply log in with stolen credentials.
Recent breach reporting backs this up. Verizon’s 2024 Data Breach Investigations Report (DBIR) lists “use of stolen credentials” as the top initial action in breaches at 24%. And Verizon’s 2025 DBIR executive summary still calls credential abuse the most common initial access vector, while also noting that third-party involvement in breaches doubled from 15% to 30%.
So the big question is not “Is our firewall strong?” It’s “How easy is it for someone to impersonate one of our people?”
The Shift From “Breaking In” To “Logging In”
For years, cybersecurity felt like building stronger walls: firewalls, antivirus, and password rules. Those controls still matter, but the center of gravity has moved.
Here is the practical reality for law firms, accounting firms, architects, and agencies:
- Your apps are internet-facing by design (cloud access is the whole point).
- Your team works from wherever the work happens (office, home, client site).
- Your clients and vendors need to share files and sign approvals quickly.
- One compromised inbox can become the launchpad for invoice fraud, payroll diversion, or data exposure.
That is why “identity is the new perimeter” is not a buzz phrase. It’s the operating model you are already living in.
The AI Factor: Phishing and Impersonation Got More Convincing
Phishing still works, but it looks different now.
Verizon’s 2025 DBIR executive summary notes that synthetically generated text in malicious emails has doubled over the past two years.
At the same time, the FBI has warned that cybercriminals are using AI-powered voice and video cloning to impersonate trusted individuals and enable fraud schemes.
What that means for a professional services firm is simple: the “tell” is gone. The email can match tone, context, and timing. The voicemail can sound like a partner. The message can reference a real case, a real project, or a real vendor.
Two common 2026 attack patterns we see:
- Deepfake urgency: “I need you to wire this today for the client. I’m in court, do not call me.”
- Hyper-personalized spear phishing: an email that references a real client matter, with a link that looks like Microsoft 365, Dropbox, or your e-sign platform.
If your controls assume people will always spot the scam, your controls will lose.
Why Professional Services Get Hit Harder
In professional services, the damage is not limited to downtime. It is trust, confidentiality, and reputation.
Law firms:
- The stakes include privileged communications, sensitive filings, and escrow or settlement activity.
- A compromised account can turn into quiet monitoring of a matter, then a perfectly timed BEC attempt.
Accounting firms:
- Tax season and payroll cycles create predictable windows for fraud.
- Attackers can impersonate clients (or partners) to reroute refunds, change direct deposit, or approve vendor payments.
Architects and agencies:
- Your intellectual property is the product: plans, creative, strategy, campaign assets.
- Collaboration with contractors and freelancers increases third-party access risk.
This is also why identity attacks are so attractive: one stolen login can unlock multiple systems, file shares, and approval workflows.
The Controls That Actually Reduce Identity Risk
You do not need 50 new tools. You need a tighter identity foundation, then smart monitoring.
Here is the layered approach that works for most firms.
1. Upgrade To Phishing-Resistant MFA
If you are still relying on SMS codes for MFA, treat it as “better than nothing,” not as “done.”
NIST’s digital identity guidance explicitly treats use of the public switched telephone network (PSTN), which includes SMS and voice, as RESTRICTED for out-of-band verification, and it documents real-world interception scenarios such as redirected SMS.
What to use instead:
- Security keys (FIDO2 hardware keys such as YubiKey-style devices)
- Passkeys (device-bound, phishing-resistant sign-in)
CISA’s guidance on implementing phishing-resistant MFA focuses on MFA methods that are resistant to phishing and adversary-in-the-middle attacks.
And the FIDO Alliance notes that passkeys are phishing-resistant and secure by design, reducing phishing and credential theft risk because there is no password to steal.
Practical firm rollout tip:
- Start with leadership, finance, and IT admin accounts first.
- Then roll out to all staff.
- Then require it for vendors with any access to your systems.
2. Treat Every Login Like a Risk Decision
This is where a Zero Trust mindset becomes practical: verify every access request based on identity, device, location, and behavior.
Examples that reduce real-world risk quickly:
- Block “impossible travel” sign-ins (Colorado at 9:02, Europe at 9:07).
- Require stronger auth when someone logs in from an unmanaged device.
- Limit admin rights, and use separate admin accounts for elevated tasks.
- Turn off legacy authentication that bypasses modern MFA controls.
3. Monitor Identity The Same Way You Monitor Servers
Credential theft does not respect business hours.
Managed Detection and Response (MDR) helps by watching for signals like:
- Repeated failed sign-ins, then a success from a new location
- Mailbox rule creation (a common BEC move)
- Unusual access to large file sets or sensitive folders
- New OAuth app consent or token activity that looks abnormal
Verizon’s 2025 DBIR executive summary also ties credentials to broader breach ecosystems, noting how stolen credentials show up in infostealer logs and credential dumps, and how those can correlate with ransomware victimization patterns.
Bottom line: you want to catch account takeover early, before it becomes wire fraud, data exposure, or ransomware.
Close The Gaps With BYOD, Vendors, and Third-Party Access
If your firm uses contractors or allows personal devices, identity security needs one extra layer of discipline.
Verizon’s 2025 DBIR executive summary found that a meaningful share of compromised systems with corporate logins were non-managed devices, which is a common BYOD reality.
Steps that reduce risk without killing productivity:
- Require passkeys or security keys for any non-managed device access.
- Use separate vendor accounts with least privilege (no shared logins).
- Time-box vendor access (only on project days, not forever).
- Review access quarterly. Remove old accounts fast.
- Keep client file shares segmented by matter or project.
H2: Make Your People a Real “Human Firewall” Without Boring Them
Security awareness training works when it is practical, short, and consistent.
Make it real for your team:
- Teach a simple “pause and verify” rule for money, credentials, and file-sharing.
- Use a call-back policy: if the request is urgent, verify via a known number, not the number in the message.
- Run short drills for deepfake scenarios: “Partner voice asking for a wire,” “Client requesting immediate file access,” and “Vendor changing banking details.”
The goal is not paranoia. The goal is muscle memory.
A 30-Day Identity Hardening Checklist for Professional Services Firms
If you want a simple next-step plan, here is a strong starting point:
Week 1:
- Inventory your critical identities (partners, finance, admins, shared inboxes).
- Turn on MFA everywhere it exists.
- Disable legacy authentication where possible.
Week 2:
- Move leadership, finance, and admin accounts to phishing-resistant MFA (security keys or passkeys).
- Enforce stronger sign-in rules for unmanaged devices.
Week 3:
- Audit mailbox rules and forwarding.
- Reduce privileges (least privilege, separate admin accounts).
- Review vendor access and remove anything stale.
Week 4:
- Turn on 24/7 monitoring and alerting for identity events.
- Run a targeted phishing and deepfake drill.
- Document the verification process for wires, ACH changes, and sensitive file releases.
Ready to Take Action?
Your firm’s reputation is not just an asset. It is the foundation of your business. In 2026, protecting that trust means treating identity as the real front door and putting the right controls around who can log in, from where, and under what conditions.
If you are in Central Texas and want a clear, practical roadmap, CMIT Solutions can help you assess your current identity risk and prioritize fixes that make the biggest difference.
Schedule a Cybersecurity Assessment, or request a consultation with CMIT Solutions of San Marcos and New Braunfels today!
FAQ’s About Identity Security for Professional Services Firms
What is identity security in cybersecurity?
Identity security is the set of controls that protect user accounts, login methods, and access permissions so only the right people can access the right systems. It includes strong authentication, least privilege, monitoring, and policies for devices and third parties.
Why are compromised credentials such a common cause of breaches?
Because cloud apps are designed to be accessible. If an attacker steals a valid username and password, they can often bypass perimeter defenses and move quietly inside your systems, especially if MFA is weak or inconsistent.
Is SMS MFA good enough for a law firm or accounting firm?
SMS MFA is better than using only passwords, but it is not the strongest option. Guidance from NIST treats PSTN methods like SMS as restricted for out-of-band verification due to interception risks, so most firms should plan an upgrade to phishing-resistant MFA.
What is phishing-resistant MFA?
Phishing-resistant MFA uses authentication methods that cannot be easily tricked by fake login pages or intercepted in transit. Common examples include FIDO2 security keys and passkeys, which rely on cryptographic authentication rather than shared secrets.
How do passkeys help protect against phishing?
Passkeys are designed to be phishing resistant because there is no password to steal, and the credential is tied to the legitimate site or app. That makes it much harder for a fake login page to capture something reusable.
What should we monitor first to catch account takeover early?
Start with identity signals: unusual sign-ins, repeated failed login attempts, new mailbox forwarding rules, unexpected MFA resets, and unfamiliar app consents. Catching those early is often the difference between a close call and a major incident.
