By Ivan Samuel, Cyber & Technology Insurance at Howden
The scale of the threat
Cyber risk has moved from an IT concern to a boardroom one. A 2026 survey of professional firms found that 65% now rank cyber-attacks as their single biggest business risk, ahead of economic pressure, professional negligence claims and regulatory change combined.
Threat intelligence data backs this up. Analysis of intrusion activity across UK industries recorded 3 billion intrusion prevention events against law firms, accountants, consultants and engineering practices in the first half of 2026 alone, the highest volume of any sector tracked, with 460 organisations actively detecting ransomware campaigns during the same period. Nationally, the government's own breaches survey found phishing was involved in 79% of all reported UK business attacks, making it by far the most common route in. Separate research recorded a 130% increase in cyber incidents year-on-year, naming AI as a key driver of that growth, a trend that is changing the shape of social engineering across every profession mentioned below.
Three factors make professional services distinctly exposed:
Trust-based, high-value transactions: client money, completion funds and payment instructions routinely move through professional firms, making them prime targets for fraud rather than just data theft.Confidential and privileged information: legal privilege, financial records, personal data and design IP all carry a value to attackers that goes well beyond the cost of the data itself.Rapid adoption of AI and digital tools: client portals, practice management systems and AI drafting tools are expanding the attack surface faster than many firms' security policies can keep up.
When a cyber claim does land, the financial impact is no longer marginal. UK insurers paid out £197 million in cyber claims in 2024, a 230% year-on-year increase, driven largely by ransomware and business interruption.
Solicitors
Client account fraud is the defining cyber risk in legal practice. A 2024 report found that successful cyber-attacks against UK law firms rose 77% in a single year, from 538 to 954 incidents. The regulator's own 2020 review of law firms hit by cybercrime found that firms had to repay more than £4 million of client money, of which £3.6 million was recovered through insurance and the remainder repaid directly by firms out of their own funds. Although these figures span recent years rather than today, the current market trend points to a clear acceleration in attack volumes, meaning the true figure is likely considerably higher now. Conveyancing transactions, where six-figure sums move between client accounts at a fixed completion date, remain the single biggest target.
Business email compromise redirecting completion funds to fraudulent accounts remains the most common attack vector.Ransomware against case management systems can halt fee earning entirely, forcing firms to notify clients of delayed completions.Firms are increasingly expected to evidence active cyber governance, not just basic IT competency.
Left unaddressed, the exposure goes well beyond the immediate loss, with firms facing regulatory intervention and reputational damage that is hard to recover from in a trust-based profession.
Accountants
Accountancy practices hold exactly the kind of data attackers want most: payroll, tax records and client banking details, often for hundreds of clients in one system. Fixed HMRC and Companies House deadlines add pressure that attackers actively exploit, since firms under time pressure are more likely to act on a fraudulent instruction without checking it twice.
AI generated phishing is now harder to spot, often replicating a colleague's or partner's tone and formatting convincingly.Cloud accounting platforms and client portals widen the number of access points that need to be monitored.A breach landing during a filing period compounds financial loss with statutory deadline risk.
The fallout extends beyond the breach itself, risking disruption during reporting season and conflicting with the confidentiality and due care principles set out in the ICAEW Code of Ethics.
Architects
Architecture practices hold two things that make them attractive targets: valuable design IP and large volumes of client and project data, often shared across a wide project supply chain through BIM platforms. Architects' own professional body has acknowledged that several prominent UK practices have been hit by serious ransomware attacks in recent years. Separately, industry research found 41% of architects are now using AI on at least some projects, a fast-growing area regulators and insurers are still catching up with.
Ransomware can lock design teams out of BIM models and CAD files, directly halting project delivery.Client and project data shared across multi-firm teams multiplies the number of ways in.Insurers increasingly expect evidence of basic controls before covering a claim.
Practices that fall short face missed deadlines and contractual penalties and risk a cyber insurance claim being declined if appropriate safeguards were not demonstrably in place at the time of the incident.
Engineers
Engineering firms sit on two valuable assets: intellectual property in the form of designs, specifications and simulations built up over years of R&D and, increasingly, a direct line into physical infrastructure through operational technology on live projects. The clearest illustration is Arup, the UK headquartered global engineering and design firm, which lost $25 million in early 2024 after fraudsters used deepfake video and audio to impersonate its CFO and other senior staff on a video call, convincing a Hong Kong based employee to authorise the transfer 10. No systems were compromised; the attack succeeded purely through convincing human deception.
Design files, patents and simulation data represent years of R&D and are a direct target for IP theft.AI-generated deepfakes are making executive impersonation fraud significantly harder to detect.Firms working on infrastructure projects face growing crossover risk between IT and operational technology.
The cost of inaction is twofold: direct financial loss at the scale seen at Arup, and the longer-term erosion of competitive advantage and client trust if stolen IP reaches a rival.
Getting ahead of the threat
Across every profession mentioned above, the pattern is the same. Attackers are not just targeting systems; they are targeting the trust that professional services firms are built on. As regulatory expectations continue to evolve, demonstrating active cyber governance, and not just technical defences, is becoming a professional as well as a commercial necessity.
|
2026.jpg "The cyber threat facing professional services")
