Small Firms, Big Targets

James Green, a member of the Professional Accountant editorial team, spoke with Farooq Naiyer, Chief Executive Officer of NKST, at the NKST Conference at the Marriott, Toronto, Ontario.

NKST is a cyber security research and collaboration platform that brings together security leaders across industries and geographies through roundtables, summits and research programs, including the Toronto CISO Roundtable and the Vancouver NKST Summit. Mr. Naiyer has more than 20 years of experience in cyber security, privacy, technology compliance and assurance. He has served as Global Lead for Technology and Cyber Assurance at Munich Re and as CISO of ORION, Canada’s largest research and education network, and has held C-suite roles at financial institutions in the Middle East and South Asia.

What does an AI-enabled phishing or business email compromise attempt look like today?

Naiyer: Phishing is possibly the most common attack vector out there. Many people in cyber security treat it as a straightforward attack, but in my experience, it is becoming far more sophisticated. Cyber criminals are using generative AI to make their emails more convincing and more targeted, and they are doing a pretty good job of it.

Accounts payable staff are a frequent target. They receive an email that appears to come from a supplier, from an address that looks like the supplier’s domain.

What should a small or mid-sized firm be doing about it?

Naiyer: SMEs are targeted the most, and perhaps they’re the ones who don’t get the right attention. Start with a basic cyber security policy, precise and to the point. But the key thing is security awareness. Employees, partners and leaders need to go through a rigorous awareness program, backed by phishing simulation testing. The goal is that everyone, contractors included, can tell a legitimate email from a phishing attempt.

Where are the blind spots in a multi-vendor cloud stack, and how should practitioners vet software vendors?

Naiyer: Coming from governance, risk and compliance, and audit and assurance, my key recommendation is a rigorous due diligence process for onboarding vendors. You don’t need to be a big organization to do it.

Ask whether they go through regular certification, and whether they conduct vulnerability assessments and penetration testing. Do they have a business continuity plan? What certifications and attestations do they hold, and are those updated annually? Insist on a right-to-audit clause.

One of the most common back doors today is third-party APIs. Integrating with third-party APIs and SaaS providers is an inherent risk. We had a client whose third-party API provider was breached.

The same rules apply to generative AI, agentic AI and chatbot services: you need guardrails. AI adoption is happening so fast that it’s hard to keep a handle on, and that is a big risk.

“Integrating with third-party APIs and SaaS providers is an inherent risk in itself.”

Farooq Naiyer

If a mid-sized practice were hit with ransomware during tax season, what should already be in place?

Naiyer: There are two sides: proactive and reactive. Proactively, you need a practical incident response plan and playbook. It’s easier said than done, but it’s the first step. Identify your critical processes, people and suppliers, and build the plan around scenarios such as ransomware, a breach or an outage. Then test it through tabletop exercises, so that when a real incident happens everyone knows what to do.

Once the plan is in place, go to a cyber insurer. Before underwriting, they’ll ask the same questions: Do you have a policy? A plan? Processes? As with car insurance, good answers can reduce your premium.

Also sign an incident response retainer with a firm that works with cyber insurers and law firms. Your first call may be the IR provider or your lawyer, but those are the two calls to make, and the process kicks in from there.

For a partner or sole practitioner with no IT department, what are the highest-impact steps?

Naiyer: For small organizations, not having an IT team is no surprise. But at least one person must be accountable: someone in operations or finance, or the CEO.

If you outsource, use reliable Canadian companies with feet on the ground and real experience. This is someone who will be managing your crown jewels. Avoid providers without a physical office or good references. With so much reliance on technology, you need people who are truly reliable.

What should accountants be able to tell clients about data protection?

Naiyer: Canada is pushing hard on data sovereignty. The federal government has introduced an AI-first policy, and any public policy on AI relies heavily on where data is managed.

Canadian businesses should work with providers who host data in Canada. If they use other providers, they need reasonable assurance that data won’t leave Canada’s physical boundaries. I say physical because your cloud could be anywhere. Do this before you sign up with a SaaS provider. Hosting in Canada is about data protection first and supporting local companies second.

Read across Mr. Naiyer’s answers and one point keeps surfacing: almost every risk arrives through someone the firm already trusts. The phishing email comes from a supplier’s lookalike domain. The breach comes through a third-party API the practice never considered part of its own infrastructure. An AI assistant plugged into the accounting stack inherits whatever trust sits behind it. For firms whose client relationships are built on trust, that is an uncomfortable symmetry.

What makes it manageable is that his prescriptions are not technical. Train your people and test them. Ask vendors hard questions and write down the answers. Know who you will call at 2 a.m. before you need to. Name one person as accountable, even if that person is you. Ask where the data physically lives. None of it requires an IT department or a security budget.

For RPA members running firms of one, three or four, the realistic starting point is narrow: pick the person who owns it, run a phishing test this quarter, and find out where your cloud vendors keep your clients’ data. The pace of AI adoption may be hard to keep up with. The fundamentals aren’t.