AI Just Shortened Your Firm's Window to Fix Old Security Gaps
In late August, OpenAI published an open letter calling for a global surge in cyber defense.
More than 100 organizations signed at launch, including Microsoft, Google, Amazon Web Services and CrowdStrike. These are companies that compete hard and rarely agree on anything, which is why this one deserves attention.
The message is direct. AI-enabled attacks are about to become far more common and more capable, and defenders have a limited window to fix the weaknesses attackers will go after first.
For law firms and CPA firms, that warning hits close to home. The gaps the letter calls out are the same ones that show up again and again in professional-service environments.
What the letter actually says
The letter opens with one line: "We have a limited window to strengthen cyber defenses." From there, it makes three core points.
Status quo security won't be enough. Old bugs, excessive permissions, misconfigurations, unpatched software, weak authentication and aging legacy systems have left organizations exposed for years.
Defenders need AI, too. The same technology that speeds up attackers can make core security work faster and cheaper for the people defending against them.
No one solves this alone. Businesses, security providers, governments and AI companies all have a role to play.
The most practical part is addressed to every organization, not just tech companies. It asks leaders to treat cyber defense as an immediate priority, fix the highest-risk weaknesses first, verify that the fixes work, and build in least privilege and strong access controls.
Why this matters for law firms and CPA firms
Professional-service firms sit in a tough spot. You hold exactly what attackers want: privileged communications, tax returns, Social Security numbers, financial statements and deal details.
Most firms also run lean on IT. An internal team or outside MSP is usually focused on keeping systems up and people productive. Security hardening and cleanup often slide down the list.
AI changes the math for attackers. Phishing emails that sound like a real client or partner, faster scanning for unpatched systems, and more convincing wire fraud attempts all get cheaper to produce. Gaps that were low risk a year ago are easier to find and exploit today.
The obligations haven't changed, either. Attorneys have ethical duties of technology competence and reasonable safeguarding of client information. Tax and accounting firms face the FTC Safeguards Rule and the IRS requirement to maintain a written information security plan. "We didn't get to it yet" is a hard answer to give a client, a carrier or a regulator.
Five steps your firm can take now
The fixes the letter points to aren't exotic. They're the basics, done with urgency.
Make it a leadership priority. Put cyber defense on the partners' agenda this quarter, with a named owner and a deadline. It can't live only in the IT queue.
Fix the highest-risk gaps first, then verify. Start with MFA on email and remote access, unpatched systems, and stale accounts. Ask for proof each fix is working, not just a status update.
Tighten access. Staff should reach only the client files they need. Remove admin rights from everyday accounts and shut down former employee and vendor logins.
Protect what you can't patch. Older practice management, document management or tax software often can't be upgraded quickly. Isolate it, restrict who can reach it and monitor it closely.
Raise the bar for new tools, including AI. Before adopting a new platform, ask how it protects client data, what access it needs and whether your data trains its models.
Use the window while it's open
Shield IT Networks works alongside your existing IT team or MSP, not in place of them. They keep your systems running. We focus on your cybersecurity posture and compliance, so the gaps attackers target actually get closed.
Our Cyber Readiness Assessment shows where your firm stands against the weaknesses this letter names, and which fixes matter most. You walk away with a clear, prioritized plan your team can act on.
Comments