GrowCon conversations often focus on offense: winning clients, growing revenue, and building a stronger firm. Luke Kiely, CEO of Complywise and a former cybercrime investigator, came to talk about defense.
In his presentation, “The Real Risk Equation: Protecting Your Firm in the Age of AI, Cyber Threats & Regulation,” Kiely argued that the greatest danger for many accounting firms is not a sophisticated attacker. It is the paralysis that follows when security feels too expensive, too technical, or too big to tackle.
His message to firm owners was direct: You do not need a perfect security system to make meaningful progress. You need someone to take ownership and a working program that addresses the risks your firm actually faces.
Why firms freeze
The familiar risk equation is threat × vulnerability × impact. But Kiely asked the audience to consider another variable: inaction. Twenty years ago, protecting client records could seem as simple as locking a filing cabinet. Today, client information moves through email, cloud software, employee devices, payroll systems, and, increasingly, AI tools. Each new way to work creates another place where the firm must make a decision about access and protection.
Kiely described four pressures that can keep owners stuck:
- Attackers look for easy openings. Phishing messages, reused passwords, and accounts without multifactor authentication (MFA) can give criminals an opening without an elaborate technical attack. He recounted a small hotel that paid a ransom, restored compromised files, and found itself facing the attackers again. His lesson: recovery only works when you understand what you are restoring.
- Security vendors can make the problem feel bigger. An expensive package may sound reassuring, but the right investment starts with identifying your own systems, information, and weak points.
- Compliance requires ongoing work. A written plan matters, but a document alone cannot train employees, control access, test safeguards, or guide a response to an incident.
- The firm has competing priorities. Client deadlines and revenue work demand attention every day. Security tasks are easy to postpone until “next quarter” unless a leader is responsible for them.
A plan is a starting point. A program is what your firm does.
This distinction was central to Kiely’s talk. The IRS’s Publication 4557 guides tax professionals on safeguarding taxpayer data and creating a written information security plan. The FTC Safeguards Rule calls for a written information security program appropriate to a covered firm’s size, activities, and the sensitivity of the information it handles. It includes measures such as risk assessments, access controls, MFA, staff training, testing, and an incident response plan.
For an owner, the useful question is not simply, “Do we have a document?” It is, “Can we show how the protections in that document work in our business?”
That is also why ownership matters. The FTC rule calls for a Qualified Individual to oversee the program. That person can be an employee or a qualified outside provider, but the firm still has responsibility for oversight. An IT vendor can help implement controls; the firm’s leadership must know who is accountable for the program and how its effectiveness is reviewed.
AI makes the boundary around client data more important
Kiely warned that competitive pressure is pushing firms to adopt AI faster than they are setting rules for its use. AI can be useful in an accounting practice, but entering client information into a tool may transmit that information to an outside service. What happens to it depends on the tool, its settings, and its terms.
Before staff use an AI product for client work, firm owners should decide which information may be entered, who can approve tools, and how each provider handles and retains data. Treat AI adoption as part of the same security program that governs your other software and service providers.
Build protection around the firm you actually run
Kiely compared a firm to a living organism. Its circulatory system is the movement of data, billing, and payroll. Its nervous system is the judgment and habits of its people. Its immune system is its policies, safeguards, and incident response. Its membrane is the boundary between client information and the outside world.
The metaphor offers a practical way to start: map where sensitive information moves, identify who can reach it, and find the weak points where it crosses that boundary. Then prioritize the basics. Turn on MFA for accounts that access client information. Limit access to people who need it. Train employees to recognize suspicious requests. Keep recoverable backups and test your response plan. Review providers and AI tools before client data flows through them.
Kiely’s point was not that every small firm needs the same budget or technology as a large enterprise. Protection should fit the firm’s size and risks, while meeting the requirements that apply to it.
Three questions to ask this week
- Who is responsible for our information security program, and when did we last review it? Look for evidence of current practices, not just the date on a written plan.
- Is MFA enabled wherever people access client information? If there are exceptions, identify them and address them with the person overseeing your program.
- What does our cyber insurance policy actually cover and require? Read its conditions and exclusions with your broker or insurer. Do not assume a policy will cover every incident or that any particular lapse automatically voids coverage.
Kiely ended with a challenge: your firm’s safeguards will be tested sooner or later. You have more control when your team tests them first. Name an owner, choose a starting point, and take the next concrete step before a client, an attacker, or an incident forces the issue.
All of us at Universal Accounting Center would like to express our gratitude to Luke for sharing his perspective with us at GrowCon 2026. If you would like to watch Luke’s presentation in full, alongside the other 13 industry leaders who presented in Salt Lake City, you can order recordings of all of the presentations online.
You won’t want to miss what we’ve got planned for you next May in Scottsdale, Arizona at GrowCon 2027! Reserve your seat today, and you can take advantage of our early bird discount with code EB300.
