- Home
- Industries
- Consulting
Your clients trust you with their secrets,
so attackers target you.
Consultancies, law firms, accountants and advisers hold deal data, strategy and privileged files from many clients at once. We watch around the clock, harden the platforms you work in and respond with discretion.
Why professional firms are targeted.
One firm can hold the confidential data of dozens of clients, which makes it worth more than any one of them.
Business email compromise
Attackers take over partner mailboxes during deals and redirect funds or documents. Partner-level messages carry authority nobody questions.
Deal and data room exposure
Virtual data rooms and shared sites hold financials, customer lists and IP. A breach can derail a transaction.
Nation-state collection
Firms advising on sanctions, trade and regulatory matters are targeted for advance knowledge of what their clients will do.
Collaboration platform sprawl
Shared Teams, SharePoint and guest access blur the line between firm and client data, and permissions drift.
Consultants on client networks
Staff work on client sites and devices, carrying deliverables and access that must be controlled engagement by engagement.
The duties your profession and clients set.
Canadian law and professional rules first, then the obligations clients pass down through contracts.
| Framework | Who it applies to | What we help with |
|---|---|---|
| PIPEDA and provincial private-sector privacy laws | Firms handling personal information of clients, employees and third parties | Breach investigation, safeguards assessment and breach records |
| Quebec Law 25 | Firms handling personal information of Quebec residents | Confidentiality incident investigation, the incident register and privacy impact assessment input |
| Law society rules of professional conduct | Lawyers and paralegals, under their provincial law society | Safeguards for confidential client information, and forensic investigation when it is exposed |
| CPA rules of professional conduct | Chartered professional accountants and their firms | Protection of confidential client information and incident investigation |
| OSFI Guideline B-10, third-party risk | Applies to federally regulated financial institutions, which pass requirements to advisers and service providers | Evidence that satisfies a bank client's vendor assessment |
| SOC 2 and ISO 27001 client requirements | Firms whose clients require independent assurance of security controls | Readiness assessment and ongoing control evidence through Forseti |
Controls that keep engagements separate.
Information barriers
Access controls, document management settings and DLP policies that keep engagement teams and client data apart.
Data room security
Review of virtual data room configuration, access and download monitoring for high-stakes transactions.
Discreet response
Incident response and forensics handled confidentially, with privilege considerations agreed with your counsel.
How we help professional firms.
MSOC
Autonomous detection and response around the clock, including the mailbox and identity attacks that precede BEC.
Learn more →Microsoft security assessment
Every Microsoft 365 and Entra control examined and mapped to recognised standards, with the fixes in priority order.
Learn more →Email security
Stop the phishing and impersonation that lead to mailbox takeover and payment fraud.
Learn more →Data loss prevention
Engagement-aware policies that enforce information barriers and stop privileged files leaving.
Learn more →M&A cyber diligence
Find out whether a target is already compromised, in a format that informs the deal.
Learn more →eDiscovery
Defensible collection and preservation for litigation, regulatory and internal investigations.
Learn more →What buyers ask.
We are a professional firm, not a bank. Are we really a target?
You hold your clients' most sensitive information in one place. That makes you a shortcut to all of them, and attackers know it.
We run on Microsoft 365. Isn't that secure by default?
The platform is capable; the defaults are not enough. A Microsoft security assessment shows which controls are off and what to change first.
If something happens, can you keep it confidential?
Yes. We work under engagement terms agreed with your counsel and share findings only with the people you name.
A client wants evidence of our security controls.
We assess you against what they asked for, whether SOC 2, ISO 27001 or a vendor questionnaire, and maintain the evidence through Forseti.
Talk to someone who understands professional duty.
Put a specialist on a call to scope monitoring, Microsoft 365 hardening or deal diligence. No charge, no commitment.