Win the next client. Protect every one you already have.
Law, accounting, advisory, insurance brokerage, consulting. Each new client is a new confidential file and a new payment relationship — which is why growth and exposure arrive together in a firm, and why one incident is never one breach.
We work on both halves under one relationship, sized for a practice rather than a bank, with a specialist security bench behind it.
Grow
- Be verifiable when a referral checks you out
- Be findable for the specific work you want
- Demonstrated expertise, since expertise is the product
- An owned channel beyond word of mouth
Protect
- Payment and trust-transfer controls
- Managed IT and endpoints using ESET or Sophos
- Testing and incident readiness with Zeplynx
- Evidence for insurers and client questionnaires
Why one incident is not one problem
The cascade a firm faces, in the order it arrives.
The multiplier is the point. A retailer losing data has a problem with its customers. A firm losing data has a problem with every client, their regulator, its own regulator, and the insurer for both.
The attack built specifically for your sector
Fraud follows money, and professional services firms move large sums, to new accounts, on a known date, under time pressure. Few targets are more attractive.
Payment-instruction fraud, as it actually unfolds
A real estate closing, a settlement disbursement, a large retainer transfer. The attacker does not break anything. They wait, then send one email.
Weeks earlier
A mailbox is compromised — yours, the client’s, or the other side’s. Nothing happens. They read.
Learning the file
Amounts, dates, names, tone, who signs off, and exactly when funds will move.
The day before
One message, correctly threaded, with updated banking details and a plausible reason.
Discovery
Days later, when someone asks where the money went. Recovery odds are already low.
Staff training does not reliably stop this, and firms should stop expecting it to. The email is genuine, arriving on a real thread at a plausible moment, using correct names and figures. Only a procedural control defeats it: no change to payment instructions is ever accepted on written communication alone, verified by telephone on a number held before the file opened.
Privilege and client confidence
Confidentiality obligations in professional practice sit above general privacy law, and they survive the end of the retainer.
The practical question is who can reach the files. Former staff, a previous IT provider, a departed contractor, a cloud application someone connected in 2022 and nobody revoked.
Security questionnaires with engagements
Corporate clients increasingly audit their advisors, and a questionnaire now arrives alongside the engagement letter rather than after it.
Answering optimistically is the dangerous move. Those responses are contractual representations, and a firm unable to evidence what it claimed is in a worse position than one which answered modestly.
Deadlines do not pause for an outage
Limitation periods, filing dates and closing dates continue regardless of whether your systems are available.
For most firms the recovery-time question matters more than the prevention question, and almost nobody has answered it in hours and days rather than in general terms.
Two policies, both asking questions
Professional liability and cyber cover can both engage in a single incident, and each application asks what controls were in place.
Treat those applications as technical questionnaires with contractual weight, because a claim can be challenged against what was attested. Verify before ticking.
Growth is where the exposure comes from
Everything above describes risk, and risk is rarely why a firm calls us. Growth is — a second office, a lateral hire, a larger client, a practice area the partners want to build.
Each of those adds confidential files, payment events and people with access, and none of them prompts anyone to revisit controls chosen when the firm was half the size.
Read it this way: a firm doubling its client base has doubled the confidential files it must notify on, roughly doubled the occasions money changes hands, and added people who each need access to matter files. Growth did not create the exposure. Growth multiplied it.
Grow
How firms actually win work now
- Referrals still close, but they no longer convert on their own. A recommendation sends someone to look you up. If what they find is thin or out of date, the introduction quietly fails at the last step.
- Expertise is the product, so demonstrating it is the marketing. Written positions on the problems your clients actually have outperform any description of your services.
- Specificity beats breadth. Nobody searches for a general practitioner. They search for the exact matter in front of them, in their own words.
- Assistants now shortlist advisors. Those answers are assembled from sources a model can find and quote. A thinly documented firm is not losing the comparison; it was never in it.
- Referral concentration is the quiet risk. Where one rainmaker or one source produces most of the work, the channel leaves when they do.
Protect
What each of those adds to your exposure
- More clients, more files to notify on. The notification surface scales directly with the client list, and so does the cost of a single incident.
- More matters, more payment events. Fraud follows the number of occasions money moves rather than the size of the firm.
- A published org chart is reconnaissance. Your people page gives an attacker names, roles, seniority and your email format. Useful for clients, equally useful for impersonation.
- Laterals and departures move access. Hiring at pace creates accounts quickly and removes them slowly, and the files follow people who leave.
- Larger clients audit you. Winning bigger work brings security questionnaires, and the answers are contractual representations.
What we actually do for a firm
Both halves, under one relationship. Most firms begin on whichever side is hurting, then close the other once they can see the gap between them.
Credibility on inspection
A referral sends someone to look you up. This is where most firms lose work without ever knowing.
- Website that reflects the firm you are now
- People pages that stand up to scrutiny
- Accurate, complete directory and profile presence
- Fast, accessible, correct on a phone
Findable for the right work
Specific matters, in the language a client uses, rather than a list of practice areas.
- Search presence for the work you want more of
- Local and regional visibility
- Structured content assistants can quote accurately
- Service pages written around the client problem
Demonstrated expertise
In professional services the expertise is the product, so showing it is the most honest marketing available.
- Written positions on real client problems
- Editorial support for partners who have no time
- Client communication and newsletters
- Speaking and event material
An owned channel
So the firm is not entirely dependent on who happens to refer this quarter.
- Enquiry tracking and attribution
- Contact list you own rather than rent
- Measurement a managing partner can read
- Honest reporting on what is not working
Managed IT & protection
The day-to-day layer. Endpoint protection using ESET or Sophos, with patching, device management and recurring review.
- Security posture review
- Microsoft 365 or Google Workspace configuration review
- Access review: who can reach client files, and why
- Recurring reporting for the partners and the technician
Detection & response
EDR, XDR and fully managed detection. The question worth asking a provider is who answers the alert, since detection without response is an alarm in an empty building.
- Behavioural monitoring across workstations and servers
- Correlation across endpoint, email and identity
- Mailbox rule and forwarding monitoring
- Managed option with analyst triage and escalation
Security testing
Delivered with our specialist bench. Increasingly requested by corporate clients as a condition of engagement.
- Vulnerability assessment
- Network and web application penetration testing
- Physical and front-desk procedure testing
- Red and purple team for higher-risk firms
Advisory & readiness
The documentation a firm is now expected to produce on request, and the plan nobody writes until the week after they needed it.
- Payment and funds-transfer control design
- Incident response planning and tabletop exercises
- Client security questionnaire support
- Evidence packs for insurers and auditors
Why both sit with one provider. The firm winning larger clients and the firm answering their security questionnaires are the same firm. Bigger work brings more scrutiny, a published people page is both a credibility asset and a reconnaissance document, and every new matter is both revenue and a payment event.
Handled separately, each side optimizes for itself and the gap widens between them. That gap is the thing we are actually hired to close.
On the specialist work. Penetration testing, red team engagements and incident response are delivered alongside our security partner Zeplynx. You keep one relationship and one point of contact, with a specialist bench behind it. Nothing is tested, changed or monitored without your written approval of the scope.
How an engagement begins
Five steps, and nothing is monitored, tested or altered before step four is signed.
Discovery
The concern driving the conversation, and the outcome you need.
Environment review
Users, devices, servers, offices, cloud services and existing tools.
Direction
The tier or project matching your firm, rather than a template.
Scope confirmed
Coverage, authority, escalation contacts and deliverables, in writing.
Deliver & report
Findings walked through for the partners and for whoever maintains the systems.
Begin with the payment controls
If you do one thing after reading this page, write down the rule governing changes to payment instructions and give it to everyone who can move funds. It costs nothing, and it closes the attack most likely to reach your firm. We are happy to help you draft it whether or not you engage us.
On regulatory references. This page describes professional and privacy obligations in general terms for education, and is not legal advice. Confidentiality duties, reporting expectations and insurance requirements differ by profession, by regulator and by province. Whether your particular arrangements comply is a determination for you and your professional advisors. Our methodology and limitations statement explains how we reach the positions we take, and our data governance guide covers where client information is actually stored.