It’s tempting to buy the licences and switch it on. We’d urge a little patience. Copilot is only as useful, and only as safe, as the data it can reach. If your permissions are messy, it will find the mess.

At Quiss Technology, we’ve spent the past few months talking to managing partners and IT leads about exactly this. Here’s what Copilot for Legal actually does, and the three things we think every firm should sort out before rollout.

What is Microsoft Copilot for Legal?

Copilot for Legal is a set of more than 20 legal-specific skills inside Microsoft Copilot. It works in Word and in Cowork, Microsoft’s workspace for multi-step tasks. It builds on Legal Agent, the contract review tool Microsoft trialled with early-access customers from April. It also brings in plugins from legal tech partners including iManage, NetDocuments, Litera, Harvey and Docusign.

In practice, that means:

• Contract review against your playbook. Copilot checks an agreement against your firm’s standard positions and proposes changes as proper tracked changes in Word, with the formatting left intact.
• Drafting from your own precedents. It can work from approved templates and precedents stored in SharePoint, so nobody starts from a blank page.
• Work across many documents. Comparing key terms across a portfolio of agreements, tracking obligations and deadlines, or building a chronology for a dispute.
• Meetings into records. Pulling out key dates and open questions, and drafting minutes and resolutions from meeting notes.

UK firms are already on board. Microsoft named Clyde & Co as a launch customer, and the firm’s CIO says Copilot adoption across its lawyers is approaching 90%.

Three things to get right before you roll it out

1. Fix your permissions first

Copilot respects your Microsoft 365 permissions. That’s reassuring. It’s also the problem.

In most firms, SharePoint and OneDrive permissions drift over the years. A folder gets shared with “everyone” to hit a deadline. A former partner’s access never gets tidied up. HR files, partner remuneration spreadsheets and sensitive matter documents end up visible to far more people than intended. Nobody notices, because nobody goes looking.

Copilot goes looking. Ask it the right question and it will happily summarise a document the user could technically open but was never meant to see. For a law firm, with duties of confidentiality to clients and obligations under UK GDPR, that isn’t a theoretical risk.

Before you assign a single licence, carry out a proper data discovery and permissions review. Microsoft Purview sensitivity labels and SharePoint Advanced Management will help, but the real work is deciding who should see what, matter by matter.

2. It’s a drafting assistant, not a research database

Copilot for Legal is very good at drafting, summarising and redlining. It isn’t a replacement for Westlaw, Lexis+ or Practical Law, and it certainly isn’t a replacement for a solicitor’s judgement.

It’s worth noting that neither Westlaw nor LexisNexis was among Microsoft’s launch partners. If your fee-earners rely on them for research, that workflow isn’t changing any time soon. Set expectations early, so nobody mistakes a confident-sounding summary for settled law.

3. Keep a human in the loop, every time

Microsoft’s own numbers look encouraging. During the Legal Agent trial, more than 1,800 users generated nearly 100,000 suggested edits and kept roughly seven in ten of them. Microsoft’s internal testing also rated the edits above 90% for fluency.

Now read that the other way round. Around three in ten suggestions were rejected, and the scores come from Microsoft’s own evaluations rather than an independent legal benchmark.

So the golden rule hasn’t changed. Copilot produces drafts; solicitors produce legal documents. Every output needs review by a qualified person before it goes anywhere near a client, because responsibility for the advice stays with the solicitor, whatever tool helped draft it.

From licence to lasting value

Getting Copilot for Legal into your firm is the easy part. Getting real value from it, safely, takes groundwork: tidy permissions, clear usage policies, practical training, and a document management set-up that supports Copilot rather than fights it.

That’s where we come in. Quiss Technology helps UK law firms audit their SharePoint environments, tighten Microsoft 365 permissions and plan Copilot rollouts that partners and clients can trust.

Thinking about Copilot for Legal? Book a data-readiness review with our team, and we’ll show you where your risks are before Copilot does.  – contact one of the team at https://www.quiss.co.uk/digital-academy/

Frequently asked questions

Is Copilot for Legal available in the UK? Yes. Microsoft says the legal capabilities are generally available to Microsoft Copilot customers worldwide.

Will Copilot show staff documents they shouldn’t see? Copilot can only surface content a user already has permission to open. If those permissions are too broad, though, Copilot makes the problem visible very quickly. That’s why a permissions review should come first.

Does Copilot for Legal replace Westlaw or LexisNexis? No. It’s a drafting, review and summarising tool. Neither Westlaw nor LexisNexis was a launch partner, so keep your existing research tools.

Can we pilot Copilot for Legal with a small group first? Yes, and we’d recommend it. Start with one practice group whose matters are well organised, review the results, then widen access once permissions and policies are in place.

Author David Ricketts – https://www.linkedin.com/in/david-ricketts-7437991/

Sources

• Microsoft Launches Copilot for Legal (LawSites, 15 Oct 2026)
• Microsoft Launches Copilot for Legal – Brace for Impact (Artificial Lawyer)
• MC1296877: Legal Agent for Word (M365 message centre)

The post Copilot for Legal: Why UK Law Firms Need More Than a Licence appeared first on Quiss.

Now Microsoft is offering the next step. Copilot sits inside Word, Outlook, Excel and Teams. It summarises bundles, drafts first versions of letters and, increasingly, runs agents that carry out multi-step tasks in the background. For a managing partner or COO drowning in operational friction, it is a compelling pitch.

For most firms, the question is no longer whether to use Copilot. It is how to adopt it without handing over control of three things that matter: your costs, your firm’s knowledge, and your ability to change direction later.

Convenience is valuable. But in AI, convenience you have not governed has a habit of becoming dependency you cannot unwind.

Why this decision is happening now

AI is no longer a pilot project in the legal sector. Law Society figures show the share of UK lawyers using generative AI rose from 46% to 61% in around eight months. Whether or not a firm has a formal AI strategy, its people are already using these tools.

The regulator has noticed. In August 2026 the SRA issued a warning notice on the use of AI, reminding solicitors that their professional duties apply in full, and reported 42 cases of AI misuse in the previous year. Confidentiality, competence and supervision obligations do not pause because a tool is built into Word.

At the same time, Microsoft has changed how AI is paid for. A Copilot licence is a fixed per-user cost, but agents and the newer Copilot Cowork capabilities are billed by usage, through Copilot Credits. That shifts part of AI spend from a predictable line item to a variable one.

Three traps, and the control for each

1. The metered-cost trap

The risk. Agents do not keep office hours. A background agent working through a multi-step task consumes credits every time it acts: Microsoft’s published rates include 1 credit for a classic answer, 2 for a generative answer and 5 for an agent action. For firms working on fixed fees, uncontrolled AI consumption is a cost that lands on the matter, not the client.

The control. Microsoft provides the guardrails, but they are not on by default. Administrators can set spending limits, view consumption in the Microsoft 365 admin centre and cap monthly credits on individual agents. Decide deliberately between pay-as-you-go and prepaid credits, set a hard monthly limit, and review usage alongside matter profitability.

2. The agent lock-in trap

The risk. A firm’s real competitive asset is its know-how: precedents, clause banks, checklists and the way it runs matters. Most of that lives in the document management system, not in Copilot. The lock-in risk comes from what firms build on top: custom agents, prompts and automated workflows that encode the firm’s methods inside one platform’s tooling. Build enough of those without documentation and moving away, or even changing approach, becomes a project in itself.

The control. Keep the source of truth in your document management and practice management systems, in formats you can export. Document every agent and workflow you build: what it does, what data it uses, who owns it. And before committing to any advanced AI tooling, ask one question at the risk committee: what would it cost us to leave?

3. The off-the-shelf-as-strategy trap

The risk. Switching on Copilot feels like digital transformation. In practice, the same tools are available to every competitor on the same terms. Licensing them is an upgrade to your office suite, not a strategy.

The control. Use Copilot for what it does well across the firm: summaries, first drafts, meeting notes, admin. Then invest your effort in a small number of workflows specific to your practice areas, where your precedents and judgement make the difference. That is where advantage comes from, and it is where your firm should own the logic.

A practical checklist before you scale Copilot

1. Fix permissions first. Copilot can see whatever a user can see. Over-shared SharePoint sites and Teams channels become visible in seconds. Review access, apply sensitivity labels and set retention policies before rollout, not after.
2. Write an AI policy that matches the SRA’s expectations. Set out permitted uses, prohibited uses, client confidentiality rules, human review and who is accountable. Make sure supervisors know how to check AI-assisted work.
3. License by role, not by enthusiasm. Give Copilot to the people who will use it, measure adoption through usage reports, and reassign idle licences at renewal.
4. Turn on cost controls. Set spending limits and per-agent caps for metered features, and make one person responsible for reviewing consumption each month.
5. Keep a register of agents and workflows. Record purpose, owner, data used and how it would be rebuilt or replaced.
6. Agree your exit test. For any significant AI investment, document how the firm would extract its data and logic if the vendor’s pricing, terms or direction changed.

Adopt with your eyes open

Copilot is a capable tool, and for most Microsoft 365 firms it will become part of everyday work. The firms that benefit most will not be the ones that switched everything on first, or the ones that held out longest. They will be the ones that adopted deliberately: with permissions in order, costs capped, knowledge kept in systems they control, and a clear view of how they would change course if they needed to.

Use the tools to save time. Keep your hands on the wheel.

Book a Copilot readiness and governance review

Quiss helps UK law firms adopt Microsoft AI safely and cost-effectively. Our readiness review checks your permissions and data exposure, your licensing and consumption settings, and your AI policy against SRA expectations, and gives you a clear plan before you scale. Talk to our team.

Sources:

• Collab365: Microsoft starts metering Copilot agents and Cowork with pay-as-you-go credits
• Stoneridge Software: what Microsoft Copilot and Cowork cost in 2026
• DWF: guide to AI following the SRA warning notice

The post Copilot Without the Lock-in: How Law Firms Can Adopt Microsoft AI on Their Own Terms appeared first on Quiss.

For law firms between 50 and 300 people, that model is under more strain than ever, and more firms are weighing outsourced or co-managed IT as an alternative. Clients, insurers and lenders expect enterprise-grade security. Regulators expect evidence. Fee-earners expect everything to work from anywhere. And the skills needed to deliver all of that are scarce and expensive.

There are three ways to run IT at this size: fully in-house, fully outsourced to a managed service provider (MSP), or co-managed, where your own team and an external partner share the work. None is right for every firm. This article sets out what each model really involves, what the latest UK research says, and how to work out which one fits your firm.

The three models at a glance

In-house. You employ your own IT team, who know the firm, its people and its case management system intimately. You have full control and an instant response. The risk is depth: a team of two or three cannot be expert in everything, and when someone is on holiday or leaves, knowledge walks out with them.

Fully outsourced. An MSP runs your IT end to end: service desk, infrastructure, security and projects. You gain breadth of skills, out-of-hours cover and predictable costs. The trade-off is distance. A provider that does not understand legal workflows, or treats you as one of hundreds of tickets, can leave fee-earners frustrated.

Co-managed. Your internal team stays and owns the relationship with the business, while an external partner provides the depth and scale: round-the-clock monitoring, security operations, specialist projects, licensing, and overflow support. Done well, it combines local knowledge with specialist reach.

What the research says

Four findings from recent UK government research explain why this decision has become more pressing for mid-sized firms.

Mid-sized organisations are attacked more, not less. The government’s Cyber Security Breaches Survey 2025/26, published in April 2026, found that 43% of UK businesses identified a breach or attack in the previous 12 months. For medium-sized businesses the figure was 65%, and for large businesses 69%. A 50–300 person law firm, holding client money and confidential data, sits squarely in the most-targeted group.

The skills gap is widening. The government’s Cyber Security Skills in the UK Labour Market 2026 report, published in September, found that 57% of businesses have a basic technical cyber skills gap, up from 49% a year earlier. Basic here means tasks like configuring firewalls, managing access and detecting malware: the everyday work of a small IT team.

Many organisations are exposed and unsupported. The same report found that almost half of the people responsible for cyber security in UK businesses lacked confidence to deal with a breach and had not outsourced that function. That is the scenario most firms fear: a capable generalist IT manager facing a ransomware incident at 2am, alone.

Specialists are expensive to hire. The median advertised salary for a core cyber security role was about £58,000 in 2025, before recruitment fees, training and the cover needed for holidays and turnover. Few firms of this size can justify a dedicated security analyst, let alone the several people needed for 24/7 monitoring.

None of this means in-house IT is failing. It means a small internal team is being asked to cover a much wider brief than it was built for.

Which model fits your firm?

The right answer depends less on headcount than on what your firm already has, and what it is trying to do next.

Stay in-house if your IT needs are simple and stable, you have a strong team with genuine depth, and you can afford to cover holidays, sickness and resignations without gaps. This is increasingly rare below 300 people, particularly once round-the-clock security monitoring is factored in.

Outsource fully if you have no internal IT, your IT manager is leaving or retiring, or the partners want IT to be a service they buy rather than a function they manage. Choose a provider that understands legal software, matter-centric document management and the evidence your insurers and clients will ask for.

Choose co-managed if you have a good internal team that is stretched. Typical signs:

• Your IT manager spends their week on password resets instead of projects.
• Security monitoring stops at 5.30pm and at weekends.
• Projects like a cloud migration, Copilot rollout or merger integration keep slipping.
• Insurance and client security questionnaires take weeks to answer.
• One person holds knowledge that nobody else could pick up tomorrow.

In a co-managed model, your team keeps what it does best: knowing the partners, supporting fee-earners and setting priorities. The partner takes on what is hard to staff internally, such as 24/7 monitoring, security operations, licence management, specialist projects and overflow support. Both work from the same service desk, so nothing falls between the gaps.

It is also not a permanent choice. Many firms start co-managed to relieve pressure, then adjust the balance as they grow, merge or lose key staff.

Five questions to ask before you decide

1. If our IT manager resigned tomorrow, what would we lose? Write down the systems, passwords and supplier relationships only they understand.
2. Who is watching our systems at 2am on a Sunday? If the answer is nobody, that is when attackers prefer to strike.
3. How long did our last insurance or client security questionnaire take, and could we evidence every answer?
4. Which projects have slipped in the last 12 months because the team was firefighting?
5. What do we actually spend on IT per fee-earner, once salaries, tools, licences and recruitment are included?

The answers usually make the right model obvious. If they point to a strong team that needs more depth rather than a replacement, co-managed IT is worth exploring.

Frequently asked questions

What is co-managed IT?

Co-managed IT is a support model where a firm keeps its own IT staff and shares the workload with an external managed service provider. The internal team handles day-to-day relationships and priorities, while the provider adds specialist skills, 24/7 monitoring and extra capacity.

How is co-managed IT different from outsourced IT?

With fully outsourced IT, the provider runs everything and the firm has no internal IT staff. With co-managed IT, the firm’s own team stays in control and the provider fills specific gaps. Many law firms choose co-managed IT because it keeps knowledge of their people and systems in-house. Read more about IT managed services for law firms.

How much does co-managed IT cost?

It depends on what the partner covers, from out-of-hours monitoring only to a full shared service desk with security operations. Because the internal team is retained, the partner fee is usually smaller than a fully outsourced contract. The useful comparison is the cost of the gap: an extra specialist hire, plus cover for holidays and turnover.

Is co-managed IT right for a small law firm?

Co-managed IT works best for firms with at least one capable internal IT person who is stretched. Firms with no internal IT are usually better served by a fully managed service. See our IT support for law firms and solicitors for both options.

Does co-managed IT improve cyber security?

It can, mainly by adding round-the-clock monitoring and specialist response that small teams struggle to staff. Our cyber security guide for solicitors covers the controls insurers and clients expect.

Talk it through with us

Quiss has supported UK law firms for over 36 years, including through our “One IT, One Team” co-managed service, which works alongside your internal team through a shared service desk. If you would like an informal conversation about which model suits your firm, with no assumption that the answer involves us, get in touch with our team.

The post In-house IT, Outsourced or Co-managed? Choosing the Right Model for a 50–300 Person Law Firm appeared first on Quiss.

This paper argues that the more useful question for Senior Management is not how many hours the team logged, but how much of the value the team actually created was ever captured. The gap between the two, often running to 15% of chargeable capacity or more, is not a problem with the timesheets. It is a financial governance problem and it belongs on the agenda of every partner meeting where margin is discussed.

The Managing Partner’s perspective

Every Managing Partner has sat through a year-end review where revenue is up and profit per partner is flat, or worse, down. The explanations offered are usually the same: salaries have risen faster than fees, software and premises costs continue to climb and clients who accepted a rate increase last year are now pushing back. All of that is true but not the whole story.

What rarely makes it into the conversation is the work that never gets billed at all: the ten-minute favour squeezed in between meetings, the follow-up email answered from a phone between client visits, the scope creep on a fixed-fee engagement that nobody logs because there is no client matter open to log it against.

None of this shows up as a write-off, because it was never captured as time in the first place. It simply evaporates before it reaches an invoice. For a Managing Partner trying to protect profitability without asking an already stretched team to work more hours, this invisible layer is exactly where the opportunity sits. Recovering value that already exists is a far easier conversation than asking clients to pay more or asking staff to do more.

The anatomy of lost time

Most practices still record time in six-minute increments, a convention built for a world of paper files and dictated letters. It was never designed to capture the fragmented, screen-based way accountants actually work today, moving constantly between practice management software, email, Teams messages, spreadsheets, and portals.

Research from Gloria Mark at the University of California, Irvine has found that it takes an average of over twenty-three minutes to fully refocus after an interruption, and a widely cited Harvard Business Review analysis put the average knowledge worker’s daily app-toggling at around 1,200 switches, costing roughly four hours a week in reorientation alone.

None of that reorientation time is malicious or lazy. It is simply invisible to a billing system that only sees discrete, self-reported entries. A six-minute increment cannot capture the fifteen to twenty minutes a day an accountant genuinely loses hopping between a Teams query, an inbox, and a client file, because nobody sits down to log fragments that small.

When multiplied across a team of fee-earners and a working year, that daily revenue leakage is where a meaningful share of the missing 15% actually lives, not in any single dramatic write-off, but in thousands of untracked minutes that never had a chance to become chargeable time.

Industry benchmark breakdown

Realisation rates, the proportion of billed value that a practice actually collects, are one of the few metrics that expose this gap in hard numbers. The Rosenberg MAP Survey, one of the longest-running benchmarking studies in the accounting profession, puts average realisation at 92.5% for firms with net fees under two million dollars, falling to 86.2% for firms with net fees above twenty million dollars. Even at the healthier end of that range, a firm is still failing to convert somewhere between 8 and 15% of the value its people generate into billed revenue, before any further slippage to collection or write-down is counted.

The pattern is consistent across firm sizes and structures: growth in scale does not close the gap and in many cases widens it, because larger firms carry more of the fragmented, cross-team, cross-system work that six-minute time recording was never built to catch.

Benchmarks like these are useful for context, but they understate the problem for any individual practice, since they measure billed value against collected value, not the value that never made it onto a timesheet at all.

It is worth separating the two distinct stages where this value disappears, because they call for different responses. The first is the gap between time worked and time billed, which realisation rates measure directly and which stems largely from discounting, write-downs and the kind of unlogged activity this paper is concerned with.

The second is the gap between time billed and cash collected, a separate leakage point driven by slow client payments and disputed invoices, which most practices already monitor closely through aged-debtor reporting. The two are often discussed as though they were one problem, but conflating them means the first stage, where the bulk of the invisible 15% actually sits, rarely gets the same scrutiny as the second.

What this looks like in practice

A composite drawn from firms of this kind makes the point more concretely than any benchmark alone. Take a 12-partner practice with 40 fee-earners, billing at an average of one hundred and eighty pounds an hour, and reporting a realisation rate around the 88% mark that most full-service firms would consider unremarkable.

On paper, that looks like a rounding error against a healthy top line. In practice, the twelve percentage points sitting below the visible realisation figure, plus the further layer of activity that was never logged as time at all, represents a six-figure sum moving through the practice each year without ever reaching an invoice.

None of that sum is owed by clients who are refusing to pay. It was simply never captured as chargeable in the first place, spread thinly across every fee-earner’s day in the form of a Teams message answered here, a document reviewed there, a query fielded between two scheduled matters. No single instance of it would justify a write-off conversation or a difficult client call. Collectively, it is often the difference between a flat year and a year where partner distributions actually move.

Anticipating the obvious objection

The natural response from a Managing Partner reading this is that the firm already tracks time, so surely this must be accounted for. It is a fair challenge and the honest answer is that traditional time recording captures the work fee-earners remember to log, at the resolution the software allows, which for most practice management systems still means 6 or 15-minute blocks entered after the fact. That system was never designed to catch fragments smaller than its own unit of measurement and it depends entirely on a fee-earner pausing mid-task to record something the system has no way of prompting them to remember.

The gap this paper describes is not a discipline problem that better training or firmer partner reminders will close. Even the most conscientious fee-earner cannot log a switch between a client email and a Teams query in six-minute increments without either rounding generously in the firm’s favour, which few people do consistently, or simply not logging it at all, which is what happens in practice. The issue sits in the measurement tool itself, not in the people using it, and that is precisely why the answer has to be a change in how activity is captured rather than a renewed push for better manual recording.

Real-time margin visibility

The response to this is not to ask fee-earners to log time more diligently. Diligence has limits, and asking already busy people to interrupt their work more often to record it is precisely the kind of context switching that caused the leakage in the first place.

The more durable answer is automated activity capture: technology that observes how time is genuinely spent across Microsoft 365, Teams and practice systems, and reconstructs a realistic picture of chargeable and non-chargeable work without relying on manual entry.

Done properly, this changes the nature of the conversation a Managing Partner can have with the leadership team. Instead of reviewing utilisation after the fact and hoping the numbers are close to accurate, partners gain a live view of where value is being created and where it is being lost. This applies both to traditional hourly matters and fixed-fee engagements, where the real measure that matters, is the true cost of production rather than a billed hour.

That shift from retrospective guesswork to real-time financial governance is what allows a practice to protect partner distributions without simply asking everyone to work harder. It safeguards margin at the source, rather than trying to recover it after the fact through rate increases that clients are already resisting.

Where this leaves practice leadership

None of this requires a Managing Partner to overhaul the firm’s billing or renegotiate every client relationship. It requires an honest look at how much value is genuinely being captured today and a willingness to treat that gap as a financial governance issue rather than an administrative one.

Firms that have taken this view are finding that the 15% hiding in plain sight is not a call for more hours from their teams, but a call for better visibility into the hours already being worked.

Quiss Technology works with practices on exactly this challenge, alongside partners including Cloud Capcha, to bring real-time activity and margin visibility to accountancy firms without adding to the administrative burden on fee-earners. For practices wanting to understand where their own revenue leakage sits, that conversation is a useful next step.

The post The Revenue Leakage Audit Uncovering the invisible 15% compressing accountancy practice margins appeared first on Quiss.

Yet profit per partner appears not to have kept pace, impacted by rising salaries, higher indemnity and case management software costs, to say nothing of the more competitive market with clients who resist rate increases and are comfortable shopping around.

These factors, which have all played their part in squeezing margin, even in firms reporting solid top-line growth, have elicited the instinctive response to look harder at utilisation and billable hours. But that view misses where a meaningful share of the damage is actually happening.

The more useful question for firm leadership is not how many hours fee-earners are recording, but how much of the value they create even makes it onto an invoice. Clio’s 2025 Legal Trends Report puts the gap between the two, the realisation rate, at 88% on average, meaning 12% of everything worked is never billed at all.

A firm can collect almost everything it invoices and still leak a material share of its earnings before an invoice is ever raised. This means it is not a collections problem and this gap belongs on the agenda of every partner meeting where profitability is discussed.

The Managing Partner’s perspective

Every Managing Partner has sat through an annual review where fee income is up and profit per partner either shows no growth, or worse, has gone down year-on-year. The explanations offered will be familiar to many readers – salaries have risen faster than fees, professional indemnity, technology and case management costs keep climbing, and long-standing clients who accepted a rate rise last year are now pushing back or shopping around.

Whilst all of it is true, none of it is the whole story. What is rarely pushed into the spotlight is the work that never becomes chargeable time at all, which will again be familiar.

• the scope discussion that happens on a call and is never converted into a written variation
• the follow-up advice given from a mobile between two client meetings,
• the quick favour for a long-standing client that nobody opens a file to record because there seems no reason to

None of this will ever show up as a write-off, because it was never captured in the first place. It disappears before it ever reaches a bill and for a senior team trying to protect margin without seeking more billable hours from a stretched team, this is precisely where the opportunity sits.

Recovering value that a client is aware of is a far easier conversation to have than asking them to pay more or trying to work out how fee-earners can do more.

Where the gap actually opens

Most firms still record time in six-minute units, a convention built for a world of paper files and dictated letters. It was never designed for the fragmented, screen-based way fee-earners actually work now, moving constantly between case management systems, email, phone calls, Teams messages, client portals and of course, locations.

Research from Gloria Mark at the University of California found that it takes an average of over twenty-three minutes to fully refocus after an interruption, and a widely cited Harvard Business Review analysis put the average knowledge worker’s daily app switching at around 1,200 instances, costing roughly four hours a week in reorientation alone.

A 2020 study from ETH Zurich, built a simulated group office environment and tracked participants’ stress hormones while they worked, having one group repeatedly interrupted by urgent chat messages from a fictional manager.

That group’s cortisol levels rose to nearly double those of a comparable group that wasn’t interrupted in the same way, showing these moments carry a real physiological cost, not just a lost-time one.

What really stood out was that the interrupted group did not report feeling any more stressed, but their conscious sense of pressure barely moved even as their bodies registered a genuine toll. That gap between what an interruption actually costs and what a person notices or remembers about it is a large part of why these moments so rarely make it onto a time sheet.

It isn’t carelessness or idleness. The fee earner often does not register, in the moment, that anything billable just happened and that bit of work is simply invisible to a billing system that only sees discrete, self-reported entries.

A scope shift confirmed on a call is a good example. If a client agrees to widen the brief verbally and nobody writes it down as a variation, there is nothing for even the best billing software to capture, because nothing was ever entered for it to find.

Multiplied across a team of fee-earners and a working year, this is where a meaningful share of the missing 12% actually sits: not in any single dramatic write-off, but in thousands of small moments that never had the chance to become a logged, billable entry.

Industry benchmark breakdown

Realisation rate and collection rate answer two different questions and firms that treat them as one problem still tend to look for the leak in the wrong place. Collection rate measures what a firm actually receives once an invoice has been issued for the work undertaken and recorded. Realisation rate measures what proportion of the work performed ever reaches an invoice.

According to Clio’s 2025 Legal Trends Report, the average law firm collects 93% of what it bills but only realises 88% of the work fee-earners actually undertake, doing so at an average utilisation rate of just 38% of the working day.

A simple test on these two figures shows that if a firm’s collection rate sits close to the 93% average but its realisation rate is well below the 88% average, the billing team is doing its job.

Reaching for solutions to deliver faster invoicing and more diligent chasing will not slow the actual leak, which sits earlier in the cycle. Whether the work gets seen, logged and flagged as chargeable while it is happening, is just as critical as whether the resulting invoice gets paid.

What this looks like in practice

Take a 10-partner firm with 35 fee-earners, billing at a blended rate of £250 an hour, reporting a realisation rate close to the 88% average that most full-service firms would consider unremarkable rather than alarming.

On paper, 12% below a healthy top line looks acceptable. But in practice, spread across every fee earner’s diary in the form of an unlogged scope change here, a phone call favour there, a matter that quietly absorbed more work than was ever costed for, represents a six-figure sum moving through the firm each year without ever becoming an invoice.

None of it is owed by clients refusing to pay or arguing over the invoice, it was simply never captured as chargeable time in the first place.

What to look for this week

The leak only tends to show up when someone asks three questions. When did a client last change the scope of a matter on a call rather than in writing, and did that get logged as a variation anywhere, or did the file just quietly get bigger?

When a fee earner last said a matter was getting complicated or taking longer than expected, did that turn into an actual conversation about budget and cost with the client, or did it just get absorbed into the file?

And the next time a write-off crosses a partner’s desk, does the reason recorded on it explain what actually happened, or just enough detail to close it off?

None of these questions produces a number on their own, but together they tell a Managing Partner whether the pattern is present in their own firm.

Anticipating the obvious objection

From many Managing Partners, the natural response to all of this is that since the firm already records time, it is surely accounted for somewhere. The honest answer is that traditional time recording captures the work a fee-earner remembers to log, at whatever resolution the system allows, entered after the event. That system was never built to catch anything smaller than its own unit of measurement, and it depends entirely on a fee-earner recognising, at the time that something is worth billing and taking time to record it.

This is not a discipline problem. Even the most conscientious fee earner cannot log a scope shift they never registered as chargeable, without either rounding generously in the firm’s favour, which few people do consistently, or simply not logging it at all, which is what tends to happen.

The issue sits in the measurement tool, not in the person using it, which is exactly why the answer has to be a change in how activity gets captured rather than another push for more diligent manual entry.

Real-time margin visibility

The answer is not to ask fee-earners to record time more carefully. Diligence has its limits and asking busy people to interrupt their work more often to log it is close to the same context switching that caused the leak in the first place.

The more durable answer is automated activity capture, technology that observes how time is genuinely spent across email, Teams and practice systems, to reconstruct a realistic picture of chargeable and non-chargeable work without relying on a fee earner’s memory at the end of the day.

Done properly, it changes the conversations within the leadership team, from reviewing utilisation after the fact and hoping the numbers are close to accurate, to a live view of where value is being created and where it is leaking, on hourly matters and fixed-fee work alike.

Where this leaves firm leadership

None of this requires a Managing Partner to overhaul the firm’s billing system or renegotiate every client relationship. It requires an honest look at how much of the value fee-earners create is genuinely being captured today, and a willingness to treat the gap as a visibility problem rather than a discipline one.

Quiss Technology works with firms on exactly this challenge, bringing real-time activity and margin visibility to legal practices without adding to the administrative burden already sitting on fee-earners. For firms wanting to find out where their own realisation gap sits, that conversation is a useful next step.

The post The Realisation Audit – Uncovering the work that never reaches an invoice in law firm billing appeared first on Quiss.

Accountancy firms sit on some of the most valuable data in the UK economy: payroll records, VAT filings, bank details, and the personal tax information of thousands of clients. That combination makes practices of every size — from two-partner firms to national networks — a prime target for cyber criminals, and a sector under mounting pressure to modernise ahead of Making Tax Digital (MTD).

This guide explains exactly what accountancy-specific IT support should include in 2026, why generic IT providers often fall short, and how to evaluate a partner capable of keeping your practice secure, compliant, and productive.

Why Accountancy Firms Need Specialist IT Support

Standard IT support keeps the lights on. Specialist IT support for accountants understands the regulatory calendar, the software stack, and the threat model that’s unique to the profession. That distinction matters more than ever.

According to the UK government’s Cyber Security Breaches Survey 2025/26, 43% of UK businesses — around 612,000 organisations — reported a cyber breach or attack in the past 12 months, and medium and large firms were hit even harder, with 67% of medium-sized businesses and 74% of large ones reporting an incident (GOV.UK / reported via Global Banking & Finance).

Professional services, including accountancy, consistently rank among the sectors with the highest incidence rates, largely because they hold concentrated pools of financial and personal data that would take an attacker far longer to gather by targeting individual businesses directly.

The financial exposure is significant too. Where a cyber-enabled fraud succeeds, the average cost to a UK business is now around £5,900, rising to roughly £10,000 once no-cost incidents are excluded from the average, and phishing is the entry point in over half of these fraud cases (Technology.org).

For accountancy practices specifically, business email compromise leading to payroll diversion fraud has become the leading active threat: an attacker compromises a partner’s mailbox, sets up hidden forwarding rules, waits for a payroll run, then emails a client’s HR contact requesting a last-minute change of bank details. Losses per incident typically run from £25,000 to £120,000.

Put simply, generic “break-fix” IT support isn’t built to defend against this. A specialist provider is.

Core Components of Effective IT Support for Accountants

1. Software Support for Accountancy Platforms

Your IT partner should be fluent in the tools you actually use every day — not just Windows and Microsoft 365, but the accountancy and practice-management software your team relies on, such as Sage, IRIS, Xero, QuickBooks, FreeAgent, and CCH. That means being able to troubleshoot integration issues, manage licensing, support cloud migrations, and liaise directly with software vendors when something breaks mid-deadline.

2. Security-First Managed IT

Cyber security can’t be an add-on for accountancy firms — it needs to be the foundation of the service. A robust package should include:

• Multi-factor authentication (MFA) enforced across every email and cloud account, without exception
• Advanced email filtering and anti-impersonation controls to catch HMRC, Companies House, and payment-fraud phishing attempts before they reach staff
• Managed detection and response (MDR) for round-the-clock monitoring of unusual account or network activity
• Regular vulnerability scanning and penetration testing to catch weaknesses before attackers do
• Cyber Essentials or Cyber Essentials Plus certification, which the Institute of Chartered Accountants in England and Wales (ICAEW) recommends as a baseline for all accountancy practices

3. Making Tax Digital (MTD) Readiness

MTD for Income Tax becomes mandatory from 6 April 2026 for sole traders and landlords with qualifying income above £50,000, with a lower £30,000 threshold following in April 2027. HMRC estimates that more than 860,000 sole traders and landlords will need to move to quarterly digital reporting as a result (Yahoo Finance / The Accountant).

For practices, this isn’t simply a software upgrade — it’s an operational shift. Your IT support provider should help you:

• Confirm every client-facing platform is on HMRC’s recognised software list
• Set up digital links between spreadsheets and bridging software where clients still rely on Excel
• Build workflows for quarterly submissions rather than a single annual filing
• Train staff and clients on the new cadence well before the go-live date

Firms that treat MTD purely as a technology rollout tend to underestimate the workflow and staffing implications; the practices that transition smoothly are the ones that plan MTD as a process change, not just a software update.

4. Backup, Disaster Recovery, and Business Continuity

Financial records carry strict retention requirements, and losing access to them — even temporarily — can halt client work at the worst possible moment, such as during tax season. Effective IT support includes:

• Automated, encrypted, off-site backups tested on a regular schedule
• A documented disaster recovery plan with a clearly defined recovery time objective
• Business continuity planning that covers scenarios beyond cyberattacks, including hardware failure, power outages, and office relocation

5. Cloud Migration and Remote Working

Cloud adoption and hybrid working have become the norm across the profession, but each new remote access point widens the attack surface if it isn’t properly monitored (HDUK). A good provider will help you migrate accounting platforms and file storage to secure cloud environments, deploy virtual desktops so staff can access the same resources from anywhere, and ensure client portals and digital file-sharing tools are configured with proper access controls rather than left open by default.

6. Compliance and Data Protection

Beyond cyber security certifications, accountancy firms must satisfy GDPR, client confidentiality obligations, and increasingly rigorous scrutiny from professional bodies. ICO enforcement action against UK accountants has increased in recent years, with penalties issued for gaps in encryption, MFA, and phishing controls (Connection Technologies). Your IT partner should support GDPR audits, data protection policy documentation, and evidence-gathering for professional body assessments.

Common Questions About IT Support for Accountants

How much does IT support for an accountancy firm cost?

Pricing typically follows a per-user, per-month model, and varies according to the number of users, the complexity of your software stack, and the level of security included. Rather than comparing quotes on price alone, ask exactly what’s included — many “cheap” packages exclude MFA enforcement, MDR, and out-of-hours support, all of which matter for a firm handling financial data.

Is cloud computing safe for accountancy firms?

Yes, provided it’s configured correctly. Reputable cloud providers maintain security certifications and physical safeguards that most individual firms could never replicate in-house, and data stored in properly secured cloud environments benefits from encryption, redundancy, and access controls. The risk isn’t the cloud itself — it’s misconfiguration, weak access controls, or a lack of monitoring.

What happens if my firm doesn’t have a backup solution and suffers a ransomware attack?

Without a tested backup, a ransomware attack can mean permanent loss of client financial records, regulatory breach notifications, and reputational damage that’s difficult to recover from. With current data suggesting ransomware crime against UK businesses has roughly doubled year-on-year, treating backup and recovery as optional is no longer a reasonable risk to carry.

Can IT support help with switching providers?

Yes — and it’s more common than firms expect. A competent provider will run a structured onboarding process: auditing your existing infrastructure, migrating data and licences, and minimising disruption to daily operations throughout the transition, so client-facing work continues without interruption.

Do smaller accountancy practices really need enterprise-grade security?

Size doesn’t equal safety. While the largest firms report the highest breach rates, smaller practices are frequently targeted precisely because they’re assumed to have weaker defences — and a single breach involving client financial data can be existential for a small firm’s reputation, regardless of headcount.

How to Choose the Right IT Support Partner

When comparing providers, look beyond generic reassurances of “24/7 support” and ask about:

1. Sector experience — Can they name accountancy clients and describe the specific software and compliance challenges they’ve solved?
2. Certifications — Are they Cyber Essentials Plus certified themselves, and do they hold ISO 27001 or equivalent accreditation?
3. Response times — What are the contracted response and resolution times, and are they backed by a service-level agreement?
4. MTD and regulatory awareness — Can they speak knowledgeably about MTD timelines, HMRC-recognised software, and data retention rules?
5. Scalability — Can the service flex up during busy periods (such as the January self-assessment deadline) and scale down afterwards?
6. Transparent reporting — Do they provide regular reporting on security posture, ticket resolution, and system health, rather than only reactive support?

Final Thoughts

IT support for accountancy firms in 2026 needs to do more than fix laptops and reset passwords. With cyber threats rising in sophistication, MTD reshaping how practices manage client tax data, and client expectations for security and responsiveness higher than ever. The right IT partner should function as a strategic extension of your practice — combining sector-specific software expertise, security-first infrastructure, and proactive compliance support.

Firms that get this right free up time for advisory work and client relationships instead of firefighting technology problems. Firms that don’t risk falling behind on compliance, or becoming the next cautionary statistic in next year’s breach survey.

The post IT Support for Accountants: The Complete UK Guide appeared first on Quiss.

This guide goes beyond the basic video-calling features. We’ll dive into critical setup decisions, UK regulatory compliance, AI capabilities, and the real-world costs firms need to weigh up before rollout. Whether you’re a managing partner evaluating a modern workplace strategy or an IT lead planning a firm-wide implementation, you’ll find practical, current guidance below.

Why UK Law Firms Are Standardising on Microsoft 365 and Teams

Legal technology has moved well past the experimentation stage. According to a survey by the Law Society of England and Wales, 78% of law firms now use cloud computing services in some form—a shift seen across chambers, high street practices, and national firms alike. Internationally, cloud adoption among firms with more than 50 lawyers has reached 94%, though smaller and solo practices still hover around 65%.

Microsoft 365—and Teams specifically—sits at the centre of this evolution. It is increasingly acting as the primary collaboration hub for legal work, rather than just a video-calling app bolted onto legacy systems.

This shift is driven by two main realities: client demands for transparency and speed, and the rapid maturity of AI. Generative AI usage among legal professionals has surged, with recent 2026 industry surveys placing firm-wide adoption between 42% and 79% (up from below 20% just a few years ago). Because Teams is where staff actually interact with Microsoft 365 Copilot, firms already invested in the Microsoft ecosystem are best positioned to capture that value without introducing unvetted, risky platforms into their data estate.

A Tour of Microsoft Teams for Law Firms

Microsoft Teams brings the applications solicitors, paralegals, and support staff rely on daily—Word, Excel, Outlook, and SharePoint—into a single collaborative space. Rather than constantly jumping between disconnected tools, teams can create, edit, and share documents together in real time, right next to their case chats.

For hybrid and remote working, this is a game-changer. Customisable virtual workspaces support everything from initial client discovery calls to full video consultations, while dedicated channels keep messaging and files contained within a secure, permissioned environment.

Centralised Communication by Matter

• Organise by case, not inbox: Rather than scattering conversations across endless email threads, Teams lets firms organise discussions by case or matter. Solicitors, paralegals, and support staff work from the same channel, keeping deadlines, evidence, and strategy planning documented in one searchable place.
• Ditch the email backlog: Matter-specific and department-specific chat channels remove the friction of internal email chains. Messages are searchable, threaded, and—critically—held within Microsoft’s security perimeter rather than passing through multiple personal inboxes, reducing the risk of data leaks.
• Virtual meetings, recordings, and transcripts: With colleagues, clients, and counsel often split across different locations, virtual meetings are now core infrastructure. Teams supports meetings with automatic recording, live transcription, and AI-generated notes, cutting down on travel time while preserving an accurate record for case files.

Collaboration Features That Improve Legal Workflows

• Seamless, version-controlled document editing: Real-time co-authoring in Word and Excel, with full version history retained automatically, speeds up drafting and review cycles considerably. For litigation and disclosure-heavy matters, having a complete, auditable edit history is essential.
• Integration with legal industry applications: Working with an accredited Microsoft partner makes it possible to integrate existing legal software—like document management systems (iManage) or research platforms (LexisNexis)—directly into Teams. This keeps case content, conversations, and third-party tools in one interface.
• Secure, permission-based case channels: Each matter can have its own channel with permissions configured so only the people working on the case can see the content, supporting the principle of least-privilege access to sensitive files.
• AI-powered innovation with Microsoft 365 Copilot: Copilot has moved from a novelty to a genuine productivity driver. It can summarise meetings from real-time transcripts, scan documents for compliance issues, and support research and first-draft document creation. In recent industry data, 82% of law firm respondents reported efficiency gains from AI. However, legal teams must ensure their setup confirms that client inputs and outputs are not used to train underlying models.
• Efficient task and calendar management: Task tracking across case notes, contracts, and filings keeps larger teams aligned without constant status meetings. Calendar integration with Outlook ensures scheduling stays accurate from any device.
• Working anywhere via mobile and remote access: Legal practice operates across multiple offices, courtrooms, and time zones. Teams’ cloud-based foundation means fee-earners can stay connected securely on the move, helping to protect billable time that might otherwise be lost between appointments.

Security, Compliance, and Data Governance

Security is understandably the single biggest consideration for any UK law firm evaluating collaboration software. The risks are real: up to 40% of law firms have reported experiencing a cyberattack in recent years, with roughly 21% facing at least one attack annually. Encouragingly, over 70% of firms now have a formal data security policy in place and comply with standards like ISO 27001 or GDPR.

Encryption and Data Protection

Files within Teams are encrypted both in transit and at rest. For UK firms handling sensitive case files, client financial records, and privileged communications, this baseline of protection is non-negotiable. Unauthorised users cannot view, share, or edit data stored in the platform.

Meeting UK Regulatory and Compliance Standards

Teams supports compliance with UK GDPR, ISO 27001, and Cyber Essentials, with additional configuration options for data residency so client data remains within UK data centres.

Firms must also factor in the Solicitors Regulation Authority’s (SRA) expectations around client confidentiality and technological competence. A managed service provider with UK legal sector experience can help map Teams’ native controls against these specific requirements. For further reading, the ICO’s guidance on data protection and the SRA’s guidance for firms are useful starting points.

Audit Trails and Zero-Trust

Every file, document, and conversation carries a full version history and detailed access logs, making it straightforward to produce accurate records quickly for audit requests. Furthermore, many firms are now moving towards a “Zero-Trust” architecture as standard practice, treating every access request—internal or external—as something to be verified rather than assumed safe.

What Does Microsoft Teams Cost for a Law Firm?

The honest answer is: it depends on your existing Microsoft licensing and the size of your firm. Because Teams is bundled within most Microsoft 365 Business and Enterprise plans, many firms already have access to it through existing subscriptions rather than needing to buy a separate product.

Key cost factors to weigh up include:

• Licence tier: Business Basic, Business Standard, E3, and E5 plans all include Teams but differ in storage, compliance tooling, and Copilot eligibility.
• Copilot add-on costs: Microsoft 365 Copilot is licensed separately and priced per user, so firms should calculate ROI against fee-earner hours saved rather than treating it as a blanket rollout.
• Migration and integration costs: Connecting existing legal applications (practice management systems, document management platforms) may involve a one-off implementation project.
• Training and change management: The biggest driver of ROI isn’t the software itself, but how well staff adopt it. Budgeting for structured onboarding always pays off.

Because Teams runs on cloud infrastructure, firms typically see lower physical infrastructure costs and IT overhead compared with legacy on-premise systems, while the subscription model supports predictable budgeting during growth or mergers.

Common Questions About Microsoft Teams for Law Firms

• Is Microsoft Teams secure enough for privileged legal communications? Yes, when configured correctly. Teams provides encryption, granular permissions, and compliance support for GDPR and ISO 27001. However, “secure enough” ultimately depends on configuration. Firms should work with a partner experienced in legal sector deployments to set up conditional access, data loss prevention policies, and retention rules.
• Can Teams replace our existing document management system? Not entirely, and it typically shouldn’t try to. Teams works best as a collaboration and communication layer that sits alongside—and integrates with—dedicated legal document management systems like iManage, rather than replacing them outright.
• How does Copilot in Teams help with billable hours? By automating time-consuming administrative tasks—like meeting summaries, first-draft correspondence, and document review flagging—Copilot frees fee-earners to spend more time on substantive legal work. Firms should track this benefit against realistic KPIs rather than assuming automatic time savings from day one.
• Do smaller firms and sole practitioners benefit as much as larger firms? Absolutely. While cloud adoption still lags slightly among solo practitioners (65% compared with 94% among larger firms), smaller practices often see a faster ROI precisely because Teams reduces the need for multiple separate software tools and heavy IT infrastructure.
• What’s the biggest barrier to successful adoption? Staff resistance and unclear governance, not the technology itself. Firms that pair their rollout with structured training, clear usage policies, and a phased implementation plan see considerably better adoption rates than those that simply switch on the platform and hope for the best.

Getting Started: A Practical Rollout Checklist

1. Audit existing licensing: Confirm which Microsoft 365 plan you’re on and whether Teams and Copilot are already included.
2. Map your matter structure: Plan how channels, teams, and permissions should be organised before go-live.
3. Identify integration needs: Map out how Teams will connect with your existing document management, billing, or research tools.
4. Set data governance policies: Establish clear retention, access, and compliance rules before staff start using the platform day-to-day.
5. Plan structured training: Avoid a single “one-and-done” onboarding session; ongoing adoption support drives much better long-term results.
6. Review and measure: Track usage, time savings, and security metrics against clear KPIs in the months following rollout.

How Quiss Technology Supports UK Law Firms with Microsoft Teams

Based in Tamworth, Staffordshire, Quiss Technology has specialised in IT support and business solutions for the legal and professional services sector since 1988. For more than two decades, that expertise has focused specifically on the UK mid-market legal industry. We have a deep, practical understanding of the SRA, UK GDPR, and Law Society requirements that shape how firms across England, Wales, Scotland, and Northern Ireland need to configure their technology.

As a certified Microsoft partner, we help UK firms plan, licence, configure, and roll out Teams in a way that protects the compliance, confidentiality, and connectivity demands unique to legal work.

We see this value play out in practice every day. For instance, when Cardiff-headquartered Redkite Solicitors needed to bring more than 200 users across 16 offices onto a single, secure, collaborative platform, Quiss combined Microsoft Azure Virtual Desktop with Teams. This delivered seamless remote access and closer collaboration across the firm’s dispersed workforce, without compromising on control or compliance.

If you’d like to explore what a Teams rollout could look like for your practice, learn more about our IT support for law firms and solicitors or explore our Microsoft 365 solutions for the legal sector.

When you’re ready, get in touch with our team to arrange an initial consultation.

Sources

• Law Society of England and Wales cloud computing survey, cited via Quiss Technology, Revolutionising Legal Practice — https://www.quiss.co.uk/revolutionising-legal-practice-how-lawyers-and-law-firms-leverage-microsoft-365-for-enhanced-productivity-and-security/
• American Bar Association / Wisconsin Law Journal, AI adoption surges across legal industry, survey finds (2026) — https://wislawjournal.com/2026/02/27/ai-adoption-surges-across-legal-industry-survey-finds/
• Colligo, Microsoft 365 Solution for Legal Teams: Why Adoption Is Growing (2026) — https://www.colligo.com/microsoft-365s-growing-dominance-in-law-firms-legal-departments/
• Miami-Dade Bar, How Microsoft 365 management is a game-changer for law firms (2025) — https://www.miamidadebar.org/how-microsoft-365-management-is-a-game-changer-for-law-firms/
• US Legal Support, The 2026 Legal Tech & AI Outlook (2025) — https://www.uslegalsupport.com/blog/2026-legal-tech-ai-trends/
• sa.global, Top legal technology trends transforming law firms in 2026 (2026) — https://legaltech.saglobal.com/blogs/10-legal-technology-trends-reshaping-law-firms-in-2026/
• Information Commissioner’s Office (ICO), guidance for organisations — https://ico.org.uk/for-organisations/

Solicitors Regulation Authority (SRA), guidance for law professionals — https://www.sra.org.uk/solicitors/guidance/

The post Microsoft Teams for UK Law Firms: The Complete 2026 Guide to Secure Collaboration and Productivity – David Ricketts appeared first on Quiss.

As leaders in professional services, we have been conditioned to believe that every operational headache has a software-shaped solution. If client onboarding is taking too long, buy an intake tool. If fee-earners are struggling to track tasks, roll out a project management app. If communication feels fractured, introduce a new messaging platform.

It comes from a good place—a genuine desire to modernize, move faster, and remove friction. But this reactive “there’s an app for that” mentality has created a paradox. Firms have never spent more money on technology, yet partners have never felt less in control of their data, their security, or their margins.

We don’t have an under-investment problem. We have a technology bloat problem. And it is quietly eroding the profitability of mid-tier firms from the inside out.

The “App for That” Illusion

The trap usually begins when an operational process slows down. It might be a delay in conflict checking, file closing, or billing. Because we live in a world of instant digital fixes, it is incredibly easy to mistake a behavioral flaw or a broken workflow for a technology deficit.

Software vendors are masters at exploiting this impatience. They promise that a shiny new dashboard will instantly align your team. So, the credit card comes out, a new subscription is born, and yet another icon appears on your desktop.

But here is the hard truth: Buying an application without fixing the underlying workflow simply automates and accelerates the existing inefficiency.

Instead of fixing the plumbing, we’ve just attached a louder pump to a leaking pipe.

The Three Hidden Taxes on Your Profit

When a firm accumulates a fragmented “Frankenstein’s monster” of siloed software, the true cost is rarely reflected in the baseline subscription fees. The real damage happens just beneath the surface through three hidden taxes:

1. The Integration Tax

Every time you add a standalone tool, you create a new data island. Eventually, these islands need to talk to each other. Suddenly, your IT resources or external providers are bogged down building custom APIs, managing fragile sync schedules, or fixing broken links. Worse still, if the systems don’t talk, your support staff end up spending hours manually copying and pasting information from Window A to Window B. That isn’t digital transformation; it’s an administrative treadmill.

2. The Cognitive Burden on Fee-Earners

Every application requires a login, a distinct user interface, and a different way of working. When a lawyer or accountant has to jump between four different systems just to progress a single client file, context switching takes a massive toll. It breaks concentration, induces tech fatigue, and steals billable capacity. If your professionals are fighting their tools rather than using them, your technology is actively working against your utilization targets.

3. The Shadow Support Load

A bloated tech stack strains internal IT teams and external helpdesks. Instead of focusing on strategic security infrastructure, data readiness, or resilience, tech support becomes a never-ending game of whack-a-mole: resolving credential conflicts, fixing local synchronization glitches, and managing software updates that break third-party plug-ins.

When Complexity Breeds Vulnerability

Beyond the balance sheet, tech bloat introduces a more insidious risk: a total loss of operational grip and data governance.

When software feels too clunky, complex, or fragmented, human nature takes over. Your staff will naturally look for the path of least resistance to get their daily work done. They will use personal WhatsApp groups to quickly update clients, drop documents into unapproved personal cloud drives to work from home, or keep critical project trackers on localized spreadsheets because the corporate tool is too annoying to navigate.

This is Shadow IT in action. By over-complicating the corporate environment, firms inadvertently drive their teams into unsecure workarounds. In highly regulated sectors governed by strict SRA, ICAEW, and GDPR frameworks, this isn’t just an efficiency issue—it’s an existential compliance risk. If you don’t know exactly where your client data lives, you cannot protect it.

The Shift to an “Optimization First” Mindset

So, what is the antidote? It isn’t to stop innovating; it’s to change how we define innovation.

True operational maturity isn’t about how many tools you can buy; it’s about how much value you can squeeze out of the tools you already own. The vast majority of mid-market firms use less than 40% of the capabilities inherent in their core enterprise suites—like Microsoft 365, Teams, and their primary Practice Management Systems.

Before looking outward for the next shiny piece of software, firm leaders should implement three immediate, pragmatic gatekeepers:

• Enact a Tech Moratorium: Challenge every new software request aggressively. Demand that the department head prove that your existing core infrastructure (M365 or your PMS) physically cannot replicate the desired outcome through minor configuration or better training.
• Audit the “Clicks-to-Value” Ratio: Take a high-value process, like client onboarding. Physically count how many separate software systems a staff member must touch to complete it. If it’s more than two, you don’t have a software deficit; you have an architectural mess.
• Pivot Budget from Acquisition to Adoption: Reallocate the budget earmarked for next year’s new software licenses into targeted, continuous user-adoption training. Teach your people how to deeply leverage the technology already sitting on their desktops.

The Takeaway

Technology should be the invisible scaffolding that lifts your fee-earners up, protects your data, and insulates your margins. If your IT budget is steadily rising while your partners feel more disconnected from their operational reality, it’s time to stop shopping and start streamlining.

True control doesn’t come from owning more tech. It comes from mastering what you have.

If you would like to discuss how Quiss can support an application review, please reach out to andy.hawley@quiss.co.uk

The post The Silent Margin Killer: Why Buying More Tech is Giving Firms Less Control – David Ricketts appeared first on Quiss.

The reason is straightforward. Law firms hold an extraordinary concentration of sensitive assets: confidential client communications, privileged legal materials, financial transaction data, and personal identifying information spanning decades. That combination makes them high-value targets for ransomware operators, nation-state actors, and opportunistic criminals alike.

This article examines 15 of the most significant cyber attacks to have struck the legal industry — including landmark UK cases — analyses the attack types and vulnerabilities exploited, and provides practical guidance for firms looking to strengthen their defences before they become the next case study.

Why Law Firms Remain Prime Targets

Before examining specific attacks, it is worth understanding why the legal sector continues to attract such disproportionate attention from threat actors.

The data law firms hold is uniquely valuable

Unlike most businesses, law firms routinely handle data that is sensitive across multiple dimensions simultaneously. A single matter file may contain personal health records, financial information, corporate strategy details, and privileged legal advice — all in one place, often retained for years. For cybercriminals, that concentration of high-value data dramatically increases the return on a successful attack.

Regulatory and reputational pressure creates leverage

Ransomware operators understand that law firms face severe consequences for data exposure. A breach that results in client confidential information appearing on the dark web does not merely create a regulatory problem — it threatens the firm’s professional indemnity insurance, its SRA standing, and its ability to retain clients. That pressure makes firms more likely to pay ransoms quietly and less likely to disclose incidents publicly.

Security investment has not kept pace with threat growth

According to research cited by Infolegal, nearly 75% of the UK’s top 100 law firms have already experienced a cyber incident. Yet 35% of firms still lack adequate cyber mitigation planning, and the majority of mid-market firms operate without a dedicated security operations capability. The NCSC has published a specific Cyber Threat Report for the UK Legal Sector, underscoring just how seriously the national security establishment views the threat.

The 15 Most Significant Legal Industry Cyber Attacks

15. DPP Law Ltd — ICO Fine for Dark Web Exposure (2022/2025)

Attack type: Brute force / lateral movement
Location: Merseyside, UK
Cost: £60,000 ICO fine, plus remediation costs
Data accessed: 32GB of highly sensitive client data

In June 2022, DPP Law suffered a cyber attack that took down its IT systems for over a week. A third-party investigation found that attackers used a brute force method to access an administrator account, then moved laterally across the firm’s network to extract more than 32GB of data — including confidential case files that subsequently appeared on the dark web.

Critically, DPP did not initially recognise the data loss as a personal data breach and failed to report the incident to the ICO until 43 days after becoming aware, only discovering the dark web publication when contacted by the National Crime Agency. The ICO fined the firm £60,000 in 2025, citing the absence of multi-factor authentication, inadequate monitoring, and the delayed notification as aggravating factors.

Key lesson: Firms must report personal data breaches to the ICO within 72 hours of becoming aware. Legacy systems without modern authentication controls represent a critical and exploitable vulnerability.

14. Levales LLP — Health Data Breach (2024)

Attack type: Unauthorised access
Location: Hampshire, UK
Cost: Undisclosed, ICO enforcement action
Data accessed: Personal and health data of over 8,000 individuals

In 2024, Levales LLP — a criminal and military law firm — suffered a breach exposing the personal and health data of more than 8,000 individuals. The ICO found that the firm had failed to enable multi-factor authentication across its systems and had not adequately overseen the security practices of its third-party IT provider.

The case is a clear example of third-party supply chain risk, and of the specific vulnerability that arises when firms outsource IT management without retaining oversight of security controls.

Key lesson: Firms cannot outsource accountability for data security to their IT providers. Contractual obligations must be supported by active oversight and regular security audits.

13. NewLaw Legal / Targeted Campaign Against UK Firms (2024)

Attack type: Targeted credential and ransomware campaign
Location: Cardiff, UK, and London
Cost: Undisclosed
Data accessed: Undisclosed

Research published by Law Society Gazette in 2024 revealed a coordinated campaign targeting law firms and chambers across the UK. Security consultancy One Brightly Cyber identified evidence on the dark web of a campaign beginning 22 May 2024, during which one Magic Circle firm suffered 41 credential breaches in a single day. Cardiff-based NewLaw Legal became publicly known as a victim, with callers greeted by a message confirming a cybersecurity incident. London chambers Brick Court also confirmed it had been targeted.

The 2024 Professional Services Threat Landscape report by Trustwave warned that professional services firms “often become targets for nation-state threat actors,” adding an additional layer of concern beyond purely criminal motivation.

Key lesson: Credential-based attacks are increasingly coordinated and industry-specific. Password hygiene, multi-factor authentication, and dark web monitoring are no longer optional.

12. Tuckers Solicitors — Ransomware Attack (2020)

Attack type: Ransomware
Location: London, UK
Cost: Undisclosed
Data accessed: Almost one million files, including court bundles

The Tuckers Solicitors attack in 2020 saw nearly one million files encrypted, including highly sensitive court bundles — documents prepared for criminal proceedings. The firm notified the ICO and affected individuals. The case was notable for the nature of the data involved: court bundles contain some of the most sensitive personal and legal information that exists, including witness statements, medical evidence, and details of alleged offences.

The attack demonstrated that criminal law firms face a particularly acute risk, given that the data they handle is not only commercially sensitive but potentially dangerous to individuals if released.

Key lesson: The sensitivity of the data held — not merely its volume — determines the severity of a breach. Criminal law firms must apply security proportionate to their unique data risk profile.

11. Orrick, Herrington & Sutcliffe — Breach of Breach Victims’ Data (2023)

Attack type: Data exfiltration
Location: San Francisco, USA
Cost: Undisclosed; multiple class-action lawsuits
Data accessed: PII and health data of more than 637,000 individuals

In a particularly ironic attack, Orrick, Herrington & Sutcliffe — a firm that specialises in representing data breach victims — had its own systems compromised in March 2023. Threat actors accessed a file share storing sensitive documents relating to the firm’s data breach clients, including credit card information, login credentials, Social Security numbers, and medical data.

The breach resulted in multiple class-action lawsuits, illustrating that even firms with deep expertise in breach response are not immune to attack. The hack underscores that holding third-party breach data creates its own distinct risk category.

Key lesson: Firms that hold aggregated sensitive data on behalf of breach victims must treat that data as an especially high-value target and apply correspondingly higher levels of protection.

10. Grubman Shire Meiselas & Sacks — Celebrity Law Firm Ransomware (2020)

Attack type: Ransomware (REvil)
Location: New York, USA
Cost: Disputed; reportedly $365,000 USD paid
Data accessed: Sensitive entertainment industry client files

In May 2020, the REvil ransomware group targeted entertainment law firm Grubman Shire Meiselas & Sacks, leaking data relating to high-profile clients including Lady Gaga and threatening to release information about additional celebrities. The attackers initially demanded $21 million USD before doubling their demand to $42 million.

The case illustrated the reputational dimension of law firm ransomware attacks. Even where operational recovery is achievable, the threat of client data disclosure creates pressure that is entirely separate from the technical incident.

Key lesson: Ransomware attacks on law firms carry reputational risk that extends well beyond the firm itself to its clients. This dual leverage — operational disruption plus client data exposure — is precisely why law firms are such attractive targets.

9. Proskauer Rose — Unsecured Cloud Server (2023)

Attack type: Data breach via unsecured third-party cloud infrastructure
Location: New York, USA
Cost: Undisclosed
Data accessed: 184,000+ files including NDAs, financial deals, and M&A documents

In April 2023, Proskauer Rose disclosed that a third-party vendor had stored more than 184,000 files on an unsecured Microsoft Azure cloud server — publicly accessible to anyone who knew where to look. The data included non-disclosure agreements, financial deals, and documents relating to high-profile acquisitions. Critically, the data had been left exposed for six months before threat actors accessed it.

This was Proskauer Rose’s second significant breach, highlighting the compounding reputational and operational damage that results from repeated incidents.

Key lesson: Cloud security is not automatically provided by cloud platforms. Firms must actively configure and audit cloud storage security, and must establish clear contractual accountability with third-party vendors.

8. HWL Ebsworth — ALPHV/BlackCat Ransomware Attack (2023)

Attack type: Ransomware (ALPHV/BlackCat)
Location: Australia
Cost: Undisclosed
Data accessed: 4TB+ of data, 2.2 million files

In April 2023, one of Australia’s largest law firms suffered a major ransomware attack by the ALPHV/BlackCat group — a Ransomware-as-a-Service (RaaS) operation with links to Russian criminal networks. The firm, whose clients included ANZ bank and the Australian federal government, did not disclose the breach initially. Disclosure came when ALPHV/BlackCat published details on a dark web forum.

The stolen data included employee IDs, financial reports, accounting data, client documentation, credit card information, and a complete network map — the last of which is particularly valuable for enabling further attacks. In June 2023, 1.45TB of data was published publicly on the dark web.

Key lesson: RaaS groups operate with professional efficiency and actively use non-disclosure as leverage. Firms that delay or avoid disclosure may find attackers making the disclosure for them — on far worse terms.

7. Jenner & Block / Proskauer Rose — W-2 Phishing Attacks (2016/2017)

Attack type: Phishing (Business Email Compromise)
Location: USA
Cost: Undisclosed
People affected: 2,359

Two separate Business Email Compromise (BEC) attacks on major US firms resulted in the inadvertent transmission of employee W-2 tax forms to unauthorised recipients. In each case, an email that appeared to originate from a senior executive requested payroll data as part of what appeared to be a routine internal process.

These cases remain relevant because BEC attacks have grown significantly more sophisticated. AI-generated voice and video deepfakes now enable attackers to impersonate executives with alarming credibility, making the “verify via a second channel” principle more important than ever.

Key lesson: Business Email Compromise exploits authority and urgency. Firms must implement callback verification procedures for any request involving financial data, payroll information, or fund transfers.

6. GozNym Malware — Banking Credential Theft (2016)

Attack type: Phishing and banking malware
Location: Washington D.C. and Massachusetts, USA
Cost: $117,000 USD
People and companies affected: Undisclosed

Two undisclosed law firms were targeted using the GozNym banking malware, which combined a phishing email with keystroke logging to capture banking credentials. Criminals then transferred funds to accounts under their control, with one firm losing $76,000 and the other $41,000.

GozNym was part of a wider criminal network responsible for targeting thousands of organisations with the potential to cause over $100 million in losses. The network was subsequently dismantled through an international law enforcement operation coordinated by the US Department of Justice.

Key lesson: Financial transaction fraud targeting law firms is highly automated and scalable. Dual-authorisation controls on fund transfers and real-time anomaly detection are essential mitigations.

5. Moses Afonso Ryan Ltd. — Three-Month Ransomware Lockdown (2016)

Attack type: Ransomware
Location: Providence, Rhode Island, USA
Cost: $700,000+ USD
People and companies affected: Unknown

The ransomware attack on Moses Afonso Ryan Ltd. stands out not for the ransom paid, but for its operational duration. The firm’s billing system and documents were locked for three months, preventing the firm from billing clients or accessing financial records. The resulting loss of $700,000 in client billings illustrates that the operational cost of a ransomware attack can far exceed the ransom demand itself.

Key lesson: Business continuity planning is as important as prevention. Firms should model the cost of extended operational disruption — not just the ransom — when making security investment decisions.

4. Cravath Swaine & Moore / Weil Gotshal & Manges — Insider Trading Hack (2016)

Attack type: Malware for corporate espionage
Location: New York, USA
Cost: $4+ million USD in insider trading profits; $8.8 million SEC fine
People and companies affected: Partners at both firms; multiple public companies

Three Chinese nationals targeted two of New York’s most prestigious law firms with the specific intent of accessing M&A information to facilitate insider trading. By gaining unauthorised access to partners’ email, they read confidential communications about pending transactions and traded on that information across at least seven matters.

The SEC subsequently fined the perpetrators $8.8 million — more than double their trading profits. The case is significant because it established that law firm cyber espionage is not merely a data protection issue: it is a securities law issue with serious legal consequences for third parties.

Key lesson: M&A and corporate law firms hold information that is market-sensitive in addition to being confidential. The theft of that information creates cascading legal liability well beyond the firm itself.

3. DLA Piper — NotPetya Global Ransomware (2017)

Attack type: Ransomware/wiper (NotPetya)
Location: Ukraine (origin), global spread
Cost: Millions of dollars in overtime, rebuilding, and lost billable hours
Data accessed: No confirmed data loss; systems and email disabled globally

In June 2017, DLA Piper became one of the most prominent victims of the NotPetya malware, which originated in Ukraine and spread globally through the firm’s flat network structure. The attack disabled the firm’s telephone systems, email, and document access worldwide. The firm’s IT department subsequently worked 15,000 hours of paid overtime and was required to wipe and rebuild its entire Windows environment.

NotPetya is technically a wiper masquerading as ransomware — no decryption key was ever intended to be provided. It has been attributed to the Russian military intelligence service (GRU) and represents state-sponsored cyber warfare spilling into the private sector.

Key lesson: Nation-state cyber operations can devastate law firms as collateral damage. Firms must segment their networks, maintain offline backups, and have incident response plans that do not assume the availability of any digital infrastructure.

2. Appleby — The Paradise Papers (2016/2017)

Attack type: Hack or insider attack
Location: Bermuda
Cost: Undisclosed
People and companies affected: 120,000+; 13.4 million files exposed

In 2016, Bermuda-based offshore law firm Appleby suffered a major breach that resulted in 13.4 million files reaching the International Consortium of Investigative Journalists (ICIJ). The documents were reviewed by 96 media organisations and 381 journalists worldwide, collectively known as the Paradise Papers.

The breach followed the Panama Papers (see number one) and exposed similar patterns of offshore financial activity. Appleby denied insider involvement, but the volume of data and the manner of its distribution led many observers to question that assertion. The firm subsequently pursued legal action against The Guardian and BBC before reaching a confidential settlement.

Key lesson: The legal and reputational consequences of a major data breach can extend over years, encompassing litigation, regulatory scrutiny, and sustained media exposure. Incident response must account for this extended timeline.

1. Mossack Fonseca — The Panama Papers (2016)

Attack type: Hack or insider attack
Location: Panama City, Panama
Cost: Firm closed in March 2018
People and companies affected: 300,000+; 11.5 million documents

The Panama Papers remains the most consequential data breach in the history of the legal profession. In April 2016, approximately 11.5 million documents from Panamanian law firm Mossack Fonseca were obtained by journalists from Süddeutsche Zeitung, who subsequently shared them with the ICIJ. A team of 107 media organisations in 76 countries reviewed the documents over the following weeks.

The documents detailed the widespread use of shell companies and complex offshore transactions to facilitate tax fraud and avoidance for clients including heads of state, politicians, and high-net-worth individuals. Governments around the world used the documents to recover more than $1.2 billion in unpaid taxes and penalties. Iceland’s prime minister resigned within days of publication. Mossack Fonseca itself closed its doors in March 2018 — a direct consequence of the breach.

The technical vector for the attack remains contested. Analysis by security researchers suggests the firm was running an outdated version of WordPress and an unpatched Drupal installation — basic vulnerabilities that an attacker or insider could have exploited without sophisticated tools.

Key lesson: The Panama Papers demonstrated that a single breach can end a law firm entirely. Basic patch management and vulnerability hygiene — unglamorous but essential — can prevent catastrophic outcomes.

The Attack Vectors Targeting Law Firms: A Pattern Analysis

Reviewing the attacks above reveals consistent patterns that firms can use to prioritise their defences.

Ransomware dominates, but data extortion is growing

Ransomware remains the most operationally disruptive attack type. However, Arctic Wolf’s 2026 Threat Report noted an 11x growth in data extortion incidents — where attackers exfiltrate data and threaten to publish it without necessarily encrypting systems. This approach is particularly effective against law firms, where client confidentiality is foundational.

Third-party and supply chain risk is underappreciated

Several of the attacks above — including Proskauer Rose (cloud misconfiguration) and Levales LLP (IT provider oversight failure) — originated not in the firm’s own systems but in the security failures of vendors. According to the ICO, firms remain accountable as data controllers regardless of where the breach occurs.

Phishing and Business Email Compromise continue to evolve

The phishing attacks described above would now be significantly harder to detect. AI tools allow criminals to craft personalised emails, deepfake voice calls, and — increasingly — video calls that convincingly impersonate colleagues or clients. Awareness training must evolve at the same pace as these techniques.

Insider threats are a significant and underreported vector

Research from NetDocuments found that more than half of data breaches at UK legal firms are caused by insiders, whether through accidental disclosure or deliberate action. Nearly 75% of all breaches involve some element of human error. Privileged access management, data loss prevention tools, and a security-aware culture are the primary mitigations.

What UK Law Firms Must Do Now

Meet your SRA and ICO obligations proactively

The SRA expects firms to take proactive steps to mitigate cyber risk and to report serious incidents. The ICO requires notification of personal data breaches within 72 hours. Firms that fail on either front face fines, enforcement action, and professional negligence exposure. The proposed Cyber Security and Resilience Bill will extend these obligations further, making compliance planning a board-level priority.

Implement the basics — they still matter

The Panama Papers may have been enabled by an unpatched WordPress plugin. The DPP Law breach was facilitated by the absence of multi-factor authentication. The foundational controls — MFA, patch management, network segmentation, and offline backups — prevent the majority of attacks and are the minimum standard that regulators and insurers now expect.

Invest in 24/7 monitoring and detection

Mid-market law firms cannot staff a Security Operations Centre internally. Managed Detection and Response (MDR) services provide the continuous monitoring, threat hunting, and incident response capability that these firms need — without the cost and recruitment challenge of building it in-house. The cost of a breach, measured in regulatory fines, lost billings, ransom payments, and reputational damage, consistently exceeds the investment required to prevent it.

Train your people — and keep training them

Nearly 75% of breaches involve human action, whether accidental or deliberate. Security awareness training must be continuous, realistic, and tailored to the specific social engineering techniques targeting law firms — including authority-based phishing, fake invoice fraud, and conveyancing fraud.

Plan for the incident, not just the prevention

Only 26% of law firms believe they are “very prepared” to respond to a cyber incident. Incident response planning — including who to call, what to preserve, how to notify the ICO, and how to communicate with clients — must be established before an attack, not during one.

Authoritative External Sources

1. NCSC Cyber Threat Report: UK Legal Sector
2. ICO: DPP Law Monetary Penalty Notice
3. Infolegal: The Rising Threat to UK Solicitors
4. PDA Legal: Law Firm Data Breach Statistics 2025
5. Tripwire: UK Legal Sector Breach Analysis

The legal sector’s cyber risk is not diminishing — it is accelerating. The firms that recognise security as a core business function, rather than an IT overhead, will be the ones that retain client trust, maintain regulatory standing, and remain operational when an attack occurs. The question is not whether your firm will be targeted, but whether it will be prepared.

The post The Top 15 Legal Industry Cyber Attacks: What UK Law Firms Must Know in 2026 appeared first on Quiss.

It is not a talent gap.
>It is not a gap in client demand.
>It is a gap in how effectively technology is being used.

Every day, we work closely with Managing Partners, Finance Directors, and Operations Leads across professional services. What we consistently see is not a lack of investment in technology—but a lack of utilisation.

Most firms have already “moved to the cloud.”
Very few have actually transformed how they operate.

This distinction is now becoming a defining factor in profitability, efficiency, and long-term competitiveness.

Below are three patterns emerging across the sector that every accountancy leader should understand.

1. The Real Constraint Is Leadership, Not Technology

In many firms, inefficiency has become normalised.

• Slow systems during peak periods

• Disconnected workflows between platforms

• Manual workarounds for routine processes

• Friction in remote access and collaboration

These are often accepted as operational realities rather than solvable problems.

The issue is not capability—it is exposure.

When leadership teams are shown what a fully optimised accountancy environment looks like—automated document flows, integrated client dashboards, seamless collaboration—the reaction is almost always the same:

“Why are we not already doing this?”

Technology does not transform a firm on its own. Leadership does.

The firms moving fastest are not those with the largest IT budgets. They are the ones where a partner or director has made a clear decision that the current state is no longer acceptable.

Without that top-down mandate, even the most advanced tools become underused—or ignored entirely.

2. Most Firms Are Sitting on Untapped Microsoft 365 Value

Across the sector, Microsoft 365 is widely deployed—but rarely fully leveraged.

Firms are often paying for a powerful ecosystem while using only a fraction of its capability.

Common patterns include:

• Microsoft Teams is used for internal chat, but not integrated into client workflows or notifications

• SharePoint is treated as a basic file repository rather than a structured document management system

• Power BI was explored at the leadership level, but disconnected from live practice data

• Copilot used informally, without governance or defined use cases

In many cases, firms with premium licensing are still relying on manual processes—emailing documents for approval, chasing client information, and duplicating data across systems.

The opportunity here is significant.

Improving utilisation of existing tools often delivers a higher return than investing in new platforms—without adding complexity or cost.

For many firms, the most valuable technology investment is not new software, but structured adoption of what they already have.

3. Cybersecurity Is Lagging Behind AI Adoption

There is a growing imbalance across the profession.

Interest in AI and automation is accelerating rapidly.
But foundational cybersecurity is often still incomplete.

In conversations with firm leadership, investment priorities frequently favour new AI capabilities. Yet, when examined more closely, many firms still lack:

• Comprehensive Multi-Factor Authentication across all systems

• Consistent staff training on phishing and social engineering

• A tested and documented incident response plan

• Clear visibility of where sensitive client data is stored and accessed

This creates a serious risk.

AI does not fix weak operational foundations—it amplifies them.
If data is disorganised, duplicated, or insecure, AI will simply accelerate those problems.

Accountancy firms hold highly sensitive financial and personal data, making them prime targets for increasingly sophisticated cyber threats.

Strong security and clean data structures are not barriers to innovation. They are the prerequisites for it.

The Firms Pulling Ahead

A clear pattern is emerging.

Firms that treat technology as a strategic asset are beginning to:

• Increase effective billable capacity without increasing headcount

• Reduce administrative overhead and process friction

• Improve client experience through faster, more consistent delivery

• Strengthen resilience against operational and cyber risk

• Attract and retain higher-quality talent

Meanwhile, firms that continue to treat IT as a support function are seeing margins gradually compressed by inefficiency and rising expectations.

The tools required for transformation already exist. The differentiator is the decision to use them properly.

Where to Start

For most firms, the first step is not a major system overhaul.

It is gaining clarity on three areas:

• How your current technology is actually being used

• Where inefficiencies are embedded in daily workflows

• Whether your security and data foundations are genuinely robust

From there, meaningful improvements can be made quickly—often using tools already in place.

A Practical Next Step

If any of these patterns reflect your current environment, it may be time to take a more structured look at how your firm is operating.

At Quiss Technology, we work with accountancy practices to assess, optimise, and secure their technology environments—turning existing systems into measurable drivers of efficiency and profitability.

A focused review of your current setup can often reveal immediate opportunities for improvement, without requiring significant new investment.

You can learn more or request a discussion at: www.quiss.co.uk

The post The Technology Gap Quietly Eroding Accountancy Firm Profitability appeared first on Quiss.