AI phishing and email fraud
Tuned email defenses, lookalike-domain watch, and a callback before any bank or refund detail changes or tax documents go out.
Protect · Test and fix
Services
Security for accounting firms in the AI era.
We build and run security programs for small CPA, tax, and accounting offices. Every Managed program includes three AI parts as standard.
What we defend against
Five problems we're built to solve.
Deepfake wire and payment fraud
A callback, passphrase, and second-approver rule your team practices, for payments and login resets alike. A convincing fake call is not enough to move money.
Protect · Recover
Client data leaking into AI tools and note-takers
Approved AI tools, client data kept out of the rest where your licensing supports it, and approval required for new note-takers and apps.
Protect · Prove
Ransomware and account takeover
Controls that make takeover harder and limit the damage, plus restore checks and a written incident response plan.
Protect · Recover
Proving security to carriers, clients, and regulators
A current WISP, AI use policy, AI tool register, and reporting, plus questionnaire help within reason.
Prove
We also cover vendor oversight, staff changes, seasonal accounts, and the documentation the FTC Safeguards Rule expects.
The offer
Snapshot. Foundation. Baseline. Managed.
01 · Free Security Snapshot
See what stands out first.
Avery runs a light, passive review of what's public about your firm and tells you plainly whether Foundation is next.
No credentials. No agents on your network. No intrusive testing. Not a penetration test.
02 · Accounting Security Foundation
Paid entry. Know where you stand.
- Your environment mapped, with who owns what
- A WISP and incident response plan that match reality
- A remediation roadmap, briefed to the partners
- Verification protocol for payments, bank changes, documents, and login resets
- Note-taker and app-permission lockdown in Microsoft 365, Teams, and Zoom
- AI use policy: which tools, what data, who approves
Typically 2 to 6 weeks. Fees set before work begins.
03 · Security Baseline
Build Your Security Baseline
We turn your security roadmap into action. Close critical gaps, strengthen existing protections, and put the right safeguards in place so your firm is ready for ongoing management.
- Close priority roadmap items, often with your IT
- Harden or deploy the controls Managed will operate
- Produce evidence Prove keeps current
- Major migrations or legacy cleanup scoped separately
04 · Managed Accounting Security
We run the program every month.
- Protect:
- Email, identity, endpoint, and Microsoft 365 controls tuned for AI phishing, practiced verification, and awareness training.
- Recover:
- Backup coverage review, restore checks on agreed critical systems, and a current incident response plan.
- Test and fix:
- Continuous Security Validation and lookalike-domain watch. Full pentests scoped separately.
- Prove:
- A current WISP, monthly operations note, and quarterly partner summary, with evidence ready for cyber insurance renewals, client security questionnaires, and compliance requests.
- Contact:
- Avery, your named security contact, business hours.
Annual engagement, delivered monthly.
AI protection, standard in Managed
Stop AI attacks: Email defenses and verification built on published FBI and FinCEN guidance.
Control staff AI use: Approved tools, with client data kept out of the rest where your licensing supports it.
Prove it: AI use policy, staff sign-offs, and tool register, ready for carrier, client, and regulator questions.
Scoped only when needed
Depth work, scoped when needed.
- Full penetration test or deep application testing
- Incident response retainer, forensics, or 24/7 SOC
- Helpdesk replacement or backup as a product
- Major platform migrations or legacy cleanup
- Compliance certificates or audit opinions
Start with a Free Security Snapshot.
Avery tells you plainly what stood out and whether Foundation is next.