Matt Seeds

Managing Director

MATT SEEDS

SUMMARY

Your firm holds what attackers hunt for, confidential client files and client money on the move. This article covers why that raises your risk, which cyber security solutions answer both the attack and the audit, how to tell a specialist provider from a generalist, and where to start.

I’ve never met a practice manager who’d let a $12 variance slide. You reconcile your trust account to the cent, month after month, because that’s what your clients trust you to do. Now picture an email arriving from a client you’ve looked after for six years. It quotes the right matter or client reference number, signs off the way they always do, and asks you to send tomorrow’s transfer to a new BSB. Everything about it feels familiar.

Only the BSB is new.

Whether your office looks down on St Georges Terrace or sits off Colin Street, that email lands the same way. The ASD Annual Cyber Threat Report 2024-25 found cybercriminals now use generative AI to write more than convincing phishing emails. Meanwhile, clients, insurers and regulators are asking harder questions about how you protect their data.

Phishing emails are now so convincing that spotting them is a skill you’re taught, not something that comes naturally. Even a trained eye needs controls working behind it. The cyber security solutions worth paying for balance both sides of that ledger.

WHY WOULD HACKERS TARGET MY ACCOUNTING OR LAW FIRM?

Hackers target your firm because it holds tax file numbers, identity documents and case files, and moves client money weekly. That puts you higher on their list than a retailer twice your size.

In my experience, attackers choose by payoff rather than size, and one tax return hands them a TFN, bank details and a home address. ASD found business email compromise fraud made up 15% of cybercrime reported by Australian businesses, with medium businesses losing $97,200 per report on average. I’ve covered the wider case in why cyber security is critical for growing businesses.

Now think about that AI-written email, which only has to fool one person. At a retailer, that person might approve a stock order, but at your firm they could release settlement funds, and it takes no malware, just the trust your clients spent years building.

Here’s the first test to give your MSP. The right provider will ask how money leaves your trust account before they ask how many laptops you run. \

Hacker targeting Perth law and accounting firms, aiming darts at tax file numbers, identity documents and case files

WHAT CYBER SECURITY SOLUTIONS DOES MY ACCOUNTING OR LAW FIRM NEED?

Your firm needs cyber security solutions that decrease the risk of an attack and leave a record. General protection isn’t enough when you answer to clients, a professional body and an insurer.

You already know this from your own books. It’s the difference between money in the bank and a reconciled ledger. Only one survives an audit. Antivirus and a spam filter are the money in the bank, while access logs, training records and a response plan are the ledger.

That’s the second provider test, and I’d put it to every IT quote on your desk. A generalist sells you the protection, but a provider worth hiring also shows you the record.

WHAT CYBER SECURITY OBLIGATIONS DOES MY FIRM HAVE?

Your firm’s cyber security obligations come from your confidentiality duties, professional body and insurer, and each expects proof that client data is protected.

If you practise law, the Legal Practice Board of WA already keeps an eye on your trust account, and if you run a tax practice, the Tax Practitioners Board expects confidentiality. The Essential 8 isn’t new, but insurers increasingly use its language at renewal. None of it is designed to trip you up. It all comes back to one question, can you prove it?

WHAT SHOULD MY FIRM’S CYBER SECURITY COVER?

Your firm’s cyber security should cover role-based access, login monitoring, awareness training and incident response planning, each helping to decrease attacks and proving it.

Antivirus and a spam filter are the money in the bank. These four are the ledger, and if one is missing, that’s the gap your insurer will ask about.

4 controls that keep your security reconciled

  1. Limit trust and case files to staff who need them, and log who opens them.
  2. Monitor logins and mailboxes to catch attackers early and keep an audit trail.
  3. Train staff to question payment change requests, and record the training.
  4. Plan your first 24 hours after an incident, including who you notify.

WHAT SHOULD I EXPECT FROM CYBER SECURITY SERVICES IN PERTH?

Cyber security solutions protect your firm by assessing where your security falls short and planning how to close the gaps, from email and identity to devices and incident response. For accounting and law firms, that includes cyber security consulting aligned to the Essential 8.

Here’s how Inspired IT’s cyber security services in Perth then balance each line in your ledger. Email protection lowers the chances of that fake BSB request reaching your team, and credential monitoring flags the login from a city your staff have never visited. A 24/7 Security Operations Centre isolates threats,Microsoft 365 backup keeps client files recoverable, and the client portal holds your insurer’s paperwork.

For the third provider test, ask what the provider holds itself. My team holds ISO 27001 and SMB1001 Gold (Level 3) certification, and I’m happy to be held to it.

Inspired IT cyber security consultant in Perth asking can you prove your cyber security solutions work

WHAT DOES THIS LOOK LIKE FOR A FIRM LIKE MINE?

For a Perth accounting or law firm, good cyber security means an experienced team handling day-to-day IT, a secure home for client data and a clear compliance roadmap.

A Perth financial planning firm of about 50 staff can show how that plays out.

From IT firefighting to a compliance roadmap

HPH Solutions came to Inspired IT with a key staff member stuck troubleshooting everyday IT instead of strategic projects. My team took over day-to-day support, replaced the on-premises server with a secure setup and advised on security and compliance. Risk dropped significantly, and HPH Solutions now has a clear roadmap. Financial planning isn’t accounting or law, but the risk is just as high.

Read the case study

Your firm won’t look exactly like HPH Solutions. But if your best people are spending their afternoon’s fixing IT instead of billing clients, that’s the first variance worth closing.

WHERE TO START

Start with a reconciliation.

I’d begin by asking where you sit against the Essential 8 and your insurer’s questions, line by line, which is the last provider test. If a provider can’t show you the variance, they can’t close it. Once every line balances, that Thursday email stops tightening your chest. If you’d like a hand, book a conversation through the cyber security page, or see how IT consulting services keep it balanced.

Managing Director

MATT SEEDS

Matt founded Inspired IT after years working inside MSPs, where he saw the opportunity created by modern cloud technologies and the need for a better kind of IT partner.