A competing accounting firm in the same city was hit by ransomware. Their clients lost access to their documents for three weeks. Our client called us the next day. Within five working days his firm had a 3-2-1 backup, a segmented network, MFA everywhere and the first phishing training behind them.
Context: an industry where data is everything
The client has been running the firm for fourteen years. A twelve-person team handles around 180 clients — mostly small businesses, sole proprietorships and a few larger entities. Every day, thousands of invoices, dozens of tax filings and personal data of the clients' employees pass through the office. The kind of data whose loss does not just paralyse the firm — it triggers GDPR violations, regulatory sanctions and, worst of all for an accountant, a loss of client trust that takes years to build.
We started under unusual circumstances. A competing firm in the same region was attacked by ransomware. The attackers encrypted every file on the server and on every employee's machine, including the local backups. They asked for ransom in bitcoin. The firm did not pay; they tried to recover from Microsoft 365 — only to find out they had not configured retention, so OneDrive had faithfully synced the encrypted versions of every file. Three weeks of work stopped, dozens of clients delayed on their filings, the first lawsuits filed.
Our client saw this, picked up the phone and said: "What do I need to do so this doesn't happen here?"
Starting point: everything on one drive
We did the audit in one day, breaking the reality down into individual pieces. The state of play was typical for an SME that has never had an incident:
- Backup: one, local, on an external drive under the bookkeeper's desk. Done "when someone remembers". The most recent one was from the previous quarter.
- Passwords: typical, swapped via Excel, some written on sticky notes under monitors.
- MFA: nowhere. Access to M365 — login plus password and that was it.
- Network: a single flat office network, every device on the same VLAN, including a printer whose firmware had not been updated in three years.
- Endpoint protection: stock Windows Defender, no central management, no logs.
- Awareness: zero. Nobody had ever done a phishing training; every "invoice" attachment got opened.
In other words: had the same attack hit this firm, the outcome would have been identical. Possibly worse.
Prioritisation: what to fix first
A complete cybersecurity rollout for a firm this size is a multi-month project — security policy, regular pentests, SIEM, 24/7 monitoring. The client did not have months. The client was in a panic, justifiably. So we agreed on a five-day rescue plan that closes 80% of the realistic risk and leaves the rest for later phases.
Selection rule: start with the things whose absence means the firm gets cut off from its data if attacked tomorrow. The rest — important but can wait.
Solution: 5 days, 5 areas
5-day rescue plan
Day 1 — 3-2-1 backup
We rolled out the 3-2-1 strategy: three copies of the data, on two different media, one off-site. In practice: Veeam Backup for Microsoft 365 with 90-day retention (copy in the Veeam cloud), a Synology NAS in the office (local copy with immutable snapshots — even ransomware cannot delete them), plus a daily NAS replica to a second client location. RPO 24h, RTO 4h for the most critical data.
Day 2 — Network segmentation
We split the flat network into four VLANs: accountant workstations, admin (the office lead), guests (Wi-Fi for visitors), IoT (printers, cameras). Inter-VLAN communication only through the firewall with explicit rules. The printer — which attackers use as the entry vector in 60% of incidents — is now in an isolated VLAN with no internet access.
Day 3 — MFA + password manager
We enabled MFA on every account: Microsoft 365, banking access, the accounting software, the client portal. We rolled out a password manager (1Password Business) — no more sticky notes and no more passwords.txt. Every password regenerated, long, unique.
Day 4 — Endpoint protection + monitoring
We replaced stock Defender with a centrally managed endpoint security suite with a console where the admin sees in real time who is logged in, what updates are missing and whether anything suspicious has been detected. We turned on monitoring for the basic events (logins, foreign-IP access attempts, software installs) with alerts going to the admin's mailbox.
Day 5 — Phishing training
The last day was the team training. Not a boring slide deck — a hands-on workshop: we showed real phishing emails from the past few weeks, walked through the giveaways, ran a simulation by sending the team a fake "new invoice" message. Three people clicked. After the training, in the next simulation a few weeks later, one person clicked. That is a real difference.
Results 12 months after rollout
A small epilogue: six months after rollout, an email landed in the office with a fake invoice carrying a macro malware. Endpoint security stopped it, an alert went to the admin, the case closed in 15 minutes. Without backup and segmentation that same email could have ended the way it did at the competitor a year earlier. Instead, it ended with two log lines.
You cannot guarantee an attack will never come. You can guarantee that, when it does, it does not stop the company for three weeks.
What's next
After the initial rollout we moved into the maintenance phase: quarterly backup restore tests (every three months we restore one file from the cloud and confirm it works), monthly endpoint security reports, biannual phishing simulations for the team. In 2026 we plan a BYOD policy (the client started hiring remote staff) and full DLP on client personal data.
Cybersecurity is not a project with a closing date. It is a rhythm — small, regular activities that together build real resilience. But that rhythm starts with those first five days, when you stop being an easy target.
Does your firm hold customer or employee data? Let's talk for 30 minutes about what to lock down first — no commitment, no sales pitch.
Book your free consultation →