Before the First Billable Minute: The Hidden Authentication Tax on Small Accounting Firms

Every morning at a small accounting practice, there is a ceremony that never appears on any timesheet. The laptop wakes, the VPN client launches, a push notification is approved on a phone, the password vault unlocks with its own master credential and its own second factor, and only then does the accountant sign in to the tax software, the document management system, and whatever client portal sent an overnight request. Before a single return is opened, this professional has performed six or seven authentication events.

We wanted to know what that ceremony actually costs. So we asked.

Timing the Morning Ritual

With the cooperation of staff at three firms — a two-partner tax practice in Ohio, a bookkeeping shop in suburban Dallas, and a five-person CPA firm outside Portland — we timed login routines across a full week in late February, deliberately landing during peak season.

The numbers were consistent enough to be uncomfortable. The average staff member completed 14 to 22 authentication events per day. The full morning sequence, from laptop wake to first work application, ranged from four and a half to eleven minutes. The Portland firm's office manager, who splits her day between a client's QuickBooks file and internal workpapers, described the routine bluntly: "I keep a mental tally of how many times I've typed my master password before lunch. It's usually six."

Extrapolated across a season, the math is unflattering. At an average of eight minutes of daily authentication friction per person, a five-person firm loses roughly 3.3 staff hours per week — more than 40 hours over a standard busy season. At typical CPA billing rates, that is a five-figure amount of capacity spent proving identity rather than producing work.

Where the Friction Concentrates

Not all login steps are equal. The friction clustered in three places:

• VPN reconnections. Every network change — home to office, office to a client site, laptop asleep to awake — triggered a fresh VPN handshake and, at two of the three firms, a fresh MFA prompt. One firm's staff had learned to avoid closing their laptop lids to dodge the cycle, which its own IT contractor described as "the opposite of what we want them doing."
• Password vault round-trips. Because client portal credentials were stored in the vault, each portal login meant unlocking the vault, copying a credential, pasting it, then handling the portal's own second factor. Three factors, one login.
• Session timeouts. The Dallas firm's document system logged users out after 20 idle minutes. Staff reported re-authenticating "constantly" during document-heavy afternoons.

The security intent behind each step is legitimate. But the cumulative design treats every login as though it were the first login of the day, and every user as though they might be an intruder. Fatigued users respond predictably: they approve push prompts reflexively, they store credentials in spreadsheets, they ask IT to weaken timeouts. Authentication fatigue is not merely an inconvenience — it is a security degradation in its own right.

What Better VPN Design Looks Like

This is where VPN selection becomes a workflow decision rather than a pure security one. During our review testing this year, we paid particular attention to features that reduce the ceremony without reducing the protection:

Single sign-on support. VPNs that authenticate through the firm's existing identity provider — Microsoft Entra ID being the most common in small-firm environments — collapse the VPN login into the login staff already perform. One credential event, one MFA prompt, everything downstream inherits it. Of the mainstream business VPNs we evaluated, roughly half now offer SSO on business tiers, and the difference in daily experience is substantial.

Hardware key compatibility. For firms using FIDO2 security keys, a VPN that accepts them means the second factor becomes a single tap rather than a phone retrieval. Staff at the Ohio firm, which piloted YubiKeys mid-season, reported that the tap "feels faster than reaching for my phone," and — importantly — phishing-resistant authentication means the firm can consolidate some of its other login steps with confidence.

Persistent, auto-reconnect tunnels. The best business VPN clients re-establish their tunnel silently after sleep or network changes, without re-prompting. Combined with split tunneling configured by an IT administrator, staff stop thinking about the VPN entirely. The connection simply exists, the way electricity does.

Tools That Earn Their Keep

There is a recurring temptation, in security conversations, to treat friction as the price of safety — as though a tool that costs time is inherently a serious tool. Our week of timing suggests the opposite conclusion. The firms with the smoothest authentication stacks were also the ones with the stricter policies, because well-designed security gets followed and clumsy security gets worked around.

For finance professionals, the standard for any privacy tool should be that it protects client confidentiality while consuming as little attention as possible. A VPN that demands its own username, its own password, its own push prompt, and its own reconnection ritual at every network change fails that standard — not because it is insecure, but because it taxes the exact people it is meant to protect during the weeks they can least afford it.

The authentication tax is real. The good news is that it is largely optional, and the firms that notice it first will bill for the difference.