How Accounting Firms Should Market a Cyber Security Advisory Add-On to Clients Who Think 'That's an IT Problem'

07 October 2026·5 min read

Quick answer: Clients wave off cyber security because they hear "IT problem," when what you're actually selling is a financial exposure review — the cost of a breach, the insurance gap, the client-trust damage, and the compliance obligations that land squarely in an accountant's lane, not a tech support one. Position the service as a cyber risk check-up framed in dollars and obligations, not firewalls and passwords, and bill it as advisory work. Below is the pitch script, worked examples by client type, and where this offer genuinely should hand off to an IT specialist instead of overselling an accountant's actual expertise. 📈

Every accounting firm has a client who says "we're fine, our IT guy handles that" the second cyber security comes up — and they're not wrong that IT handles the technical side. What they're missing is that you handle the financial exposure side, and that's the conversation worth having. 💖

What most firms get wrong

Leading with technical language — "penetration testing" and "endpoint protection" immediately signal "not my department" to a business owner.
Pitching it as a tech product instead of a financial review — clients already have an IT provider; they don't have someone checking what a breach would actually cost them.
Treating it as a one-off add-on sell instead of a recurring annual review tied to their existing engagement.
Not connecting it to something clients already understand — insurance adequacy, notifiable data breach obligations, and client trust are all financial and reputational concepts accountants already discuss.
Trying to deliver the technical fix themselves — overstepping into actual IT remediation work the firm isn't qualified to do erodes credibility fast.

The financial-exposure pitch script

"Can I ask you something separate from your IT setup? If your client data was breached tomorrow, do you know what that would actually cost you — not the IT fix, but the notification costs, the potential fines, the clients who'd walk, and whether your insurance would actually cover it? Most business owners haven't had anyone run those numbers. That's what a cyber risk check-up does — it's not about your firewall, it's about your financial exposure if something gets through it. We can run that review as part of your annual advisory work, and if we find gaps, we'll point you to the right specialist to close them."

Worked examples

Sole practitioner's small retail client: A single-location retail business with a POS system and basic customer database. The check-up here focuses on practical exposure: how much customer payment data they actually hold, whether their cyber insurance (if any) matches that exposure, and what a short outage would cost in lost trading days — concrete, bounded numbers a small business owner can act on immediately.

Small firm's professional services client (10-20 staff): A growing consultancy holding sensitive client contracts and financial data. The pitch adds a layer on notifiable data breach obligations and what reporting requirements would mean for them specifically, since a business this size is more likely to be genuinely in scope for formal reporting obligations than a two-person operation.

Multi-partner firm's manufacturing client with multiple sites: A manufacturing client with several locations and a payroll system spanning all of them. Here the review extends to third-party exposure — what happens if a supplier or payroll provider is breached, not just the client's own systems — which is the kind of multi-entity financial exposure question a larger firm's advisory team is well placed to walk through.

How to structure and bill it

Package this as a fixed-fee annual advisory session, separate from compliance work, so it reads as a deliberate service rather than a line item buried in the main engagement. Produce a short written summary (even two pages) covering: data held, insurance adequacy against that exposure, a plain-English note on relevant obligations, and named next steps — with a clear line that technical remediation sits with their IT provider, not the firm.

💡 Heads up: partner with (or maintain a referral relationship with) an actual cyber security or IT specialist before offering this — the value of the accountant's review is spotting the exposure and translating it into dollars, not performing a technical audit you're not qualified to deliver.

Mistakes to avoid

Quoting specific breach statistics or cost figures as universal facts — exposure varies hugely by industry and data held, so keep examples illustrative, not promised.
Positioning the firm as the fix for technical vulnerabilities — stick to the financial and compliance exposure lane, and refer out for the rest.
Pitching this cold to every client in a single email blast — it lands better in the room during an existing annual review meeting, where the financial framing has context.
Letting "that's an IT problem" end the conversation on the first pushback — the script above exists specifically to reframe that exact objection, so don't fold at the first no.

Frequently asked questions

Is this actually within an accounting firm's scope, or does it risk looking like overreach?

Framed correctly, yes — reviewing financial exposure, insurance adequacy and compliance obligations around data is advisory work well within an accountant's scope. The nuance is the boundary: once the conversation moves to actual system security, passwords, or technical remediation, that's where you hand off to a specialist rather than attempting it yourselves.

How much should a firm charge for this kind of review?

That depends heavily on client size and complexity, but the key point is to price it as a distinct, named fixed fee rather than folding it into existing compliance billing — clients value (and pay for) things they can see named on an invoice.

What if the client says they already have cyber insurance and don't need this?

That's actually the best entry point — ask whether their coverage matches their actual exposure, since many businesses hold policies that under-cover their real data risk. Reviewing an existing policy against actual exposure is a lower-friction way in than suggesting they need something entirely new.

Does offering this create liability if we miss something and the client is later breached?

It's worth being honest about this limit: scope the engagement clearly in writing (a financial exposure review, not a security guarantee), and make sure your professional indemnity cover extends to this type of advisory work before offering it at scale. This is a genuine consideration, not just a formality.

Keep reading 🤍

Written by

Kate, founder of Chronically Online

I help Gold Coast and Brisbane businesses grow with branding, websites and marketing that actually works.

Work with me ✦