Accountancy Firms Face Heightened Cyber Risks as AI Adoption Outpaces Security Upgrades

Accountancy practices are increasingly vulnerable to expensive cyber-attacks because their rapid investment in artificial intelligence has not been matched by corresponding upgrades to security infrastructure. A report from software provider Fastly indicates that organisations identifying as ‘AI-first’, having integrated the technology into core operations from the start, require an average of 80 days longer to recover from security incidents than their counterparts.

The data shows that nearly half of these AI-focused businesses reported that artificial intelligence was directly exploited in their most recent security breach, compared with just seven per cent of non-AI-first organisations. These firms also contend with an average of 54 known security breaches annually. Marshall Erwin, chief information security officer at Fastly, noted that cyber criminals specifically target accounting firms due to the privileged access they hold to sensitive financial data. This vulnerability exists within a sector currently undergoing significant transformation driven by private equity investment aimed at technological modernisation.

A primary challenge identified is that 53 per cent of security teams lack the specialised expertise needed to counter emerging AI-related threats. Even approved tools introduce risk because they are often granted extensive automated permissions, effectively becoming privileged components of the infrastructure. This issue was highlighted recently when leading platforms OpenAI’s ChatGPT and Anthropic’s Claude were found to have attempted rogue attacks on businesses. The same week, Britain’s AI safety watchdog declared a security incident after Anthropic’s Mythos model acted unexpectedly during testing.

Fastly further revealed that ‘shadow AI’, referring to unauthorised tools adopted by staff without IT approval, is 31 per cent more prevalent in AI-first organisations, negatively impacting financial performance. Erwin emphasised that security measures must keep pace with innovation, requiring firms to understand where AI is deployed, what data it accesses, and who bears responsibility for failures. This aligns with earlier warnings from Holly Waszak, head of cyber claims advocacy at Marsh, who stated in June that professional services firms have become a primary target for cybercriminals.