"We've Never Been Hacked": Inside the Denial That Keeps Small Accounting Firms Exposed

Every firm partner we interviewed for this piece was, by all accounts, good at their job. Their clients spoke warmly of them. Their returns were filed on time. And when the subject of VPNs came up, each of them reached for the same sentence, delivered with the confidence of a man citing precedent: we've never had a problem.

This article is about that sentence — why it survives, what it costs, and why we believe it has become the most expensive phrase in small-firm accounting.

The Five Rationales, Annotated

We spoke with partners at firms ranging from a two-person bookkeeping shop to a 40-CPA regional practice. Their objections, paraphrased:

"Our software provider handles security." A reasonable assumption, until you remember that the connection between your office and that provider is yours. Encrypted application portals do nothing for files emailed as attachments, or for the public Wi-Fi session at the airport where a partner reviewed a workpaper last month.

"VPNs slow everything down." This was true in 2015. Modern WireGuard-based services routinely benchmark within a few percent of raw connection speed. One partner, when asked when he had last used a VPN, admitted it was "during a demo at a conference, maybe 2018."

"We're too small to be a target." Attackers do not read firm size; automated scanners do not check revenue. Small firms are, if anything, preferred targets precisely because they hold valuable data behind thin defenses.

"Our cyber insurance covers us." Increasingly, it doesn't — not unless you can demonstrate the controls the policy presupposes. As we have noted before, carriers now routinely ask about VPN use and network security in underwriting questionnaires. Answering "no" has consequences at renewal.

"Clients don't ask about this." We will come back to this one, because it is both the most common and the most outdated.

The Psychology of the Unbroken Streak

Survivorship bias does most of the heavy lifting here. A firm that has operated unbreached for twenty years interprets that streak as evidence of safety, when it is equally consistent with evidence of luck. Cybersecurity researchers call this the "it hasn't happened yet" fallacy; in accounting, it pairs neatly with a professional culture that treats risk as something measured in audit workpapers, not home routers.

There is also a status dimension. Partners who built their practices on personal relationships can experience security infrastructure as an implied insult to that trust. One interviewee told us, with visible discomfort, that a VPN "suggests to clients that something might be wrong." Our view is the opposite: a visible security posture tells clients that their data is treated as the asset it is.

What the Denial Actually Costs

The financial record is unambiguous. Settlements and remediation costs from accounting-sector breaches routinely reach six figures for firms far smaller than the ones we interviewed. Beyond the direct costs, consider the ancillary ledger: forensic investigation, client notification letters, state regulator inquiries, professional liability premium increases, and the quiet attrition of clients who never send a termination letter — they simply stop calling.

Set against that, a business-grade VPN deployment for a small firm costs roughly the price of a few hours of billable time per year. The cost-benefit analysis is not close. What keeps the denial alive is not economics; it is the absence of a forcing function. Nothing has gone wrong yet.

Trust as a Line Item

Here is the argument we would make to the holdouts. In a market where every firm claims competence and discretion, demonstrable security is becoming a differentiator — the way a peer review rating or a SOC-adjacent posture signals seriousness to sophisticated clients. When a prospective client — particularly one from a regulated industry like healthcare or financial services — asks how their data is protected in transit, "we've never had a problem" is not an answer. A documented security stack, with a VPN at its core, is.

We are not naïve about the difficulty of changing a partner's mind in a profession that prizes precedent. But precedent in this case is a matter of timing. The breach that has not happened is not evidence of immunity. It is a countdown with an unknown end date — and the firms that treat client data protection as a marketable discipline, rather than a grudge purchase, will be the ones still standing when the streak breaks somewhere else.