Case Study: Vulnerability Test for a South Midlands Accountancy Firm
When we were asked to help a South Midlands accountancy firm understand how exposed they were, we didn’t begin with assumptions or inside knowledge. We ran a vulnerability test without prior detail of their systems or network configuration—so the results would reflect what a real attacker could realistically find.
From the outset, the engagement highlighted a serious concern: we identified multiple networks and traversal paths that would allow movement across the wider environment. In an incident, that often turns a small initial compromise into something far more damaging—because attackers don’t just “break in”, they can spread.
As we progressed, we found infrastructure that should have been secured but wasn’t. Across the estate, devices such as switches, printers, and routers were identified with default passwords still in place. These types of weaknesses are frequently targeted first because they can be exploited quickly, often without leaving obvious traces.
We also tested how effectively the firm could detect suspicious activity. Using at least four different investigation tools, only one was picked up by the IT team’s monitoring and security systems. Practically, that means warning signs were not being reliably seen—so an attacker could potentially operate longer before anyone realised.
At the boundary, we identified another high-risk issue. The firm had no outbound internet filtering, meaning web access wasn’t controlled. That increases exposure to phishing, malicious domains, and drive-by compromise—especially in professional environments where users may access external sites as part of day-to-day work.
When we consolidated the technical findings, the scale of risk became clear. We identified around 900 CVSS vulnerabilities across the full estate, spanning critical, high, medium, and low severity. While not every vulnerability leads to an immediate breach, this volume signals systemic patching and hardening gaps—exactly the type of environment that criminals look for because it’s easier to find a route in.
What it could have meant financially
The most important part wasn’t just “what we found”, but what it could cost the business if it were exploited. For accountancy firms, the financial consequences of a successful attack commonly include:
- Business interruption and recovery costs (forensics, incident response, restoring systems, downtime impacting client work)
- Data breach costs (investigation, legal and notification activity, communications, potential regulatory effort under GDPR)
- Reputational damage and churn (clients losing confidence, longer procurement/contract reviews, partner scrutiny)
- Ongoing security remediation (hardening, segmentation, monitoring upgrades, patching programmes)
Given the combination of default credentials, lateral traversal opportunities, limited detection coverage, and unfiltered outbound access, the likelihood of an incident—and the potential severity if it occurs—were both elevated. In business terms, that can translate into costs ranging from tens of thousands of pounds for a contained incident, to hundreds of thousands if the firm faces ransomware, meaningful data exposure, or extended downtime—plus additional remediation costs afterward.
By the end of the assessment, the firm had a clear, evidence-based view of where the real risk lay: insecure device access, insufficient visibility, uncontrolled internet egress, and a large backlog of vulnerabilities. Most importantly, the results provided a practical starting point for prioritising remediation in a way that directly reduces both the probability and potential financial impact of a cyber incident.