Is Antivirus and MFA Enough for a Professional Services Firm? What You’re Missing

By BCyber Security Team | CISSP, CISM Last updated: 28 September 2026

No — for most professional services firms, antivirus and MFA are necessary, but they are not enough on their own. If you hold client records, use Microsoft 365 or Google Workspace, manage confidential matters, or need to evidence security to auditors and clients, you also need governance, logging, backup, access control, training, and incident response.

That is not just theory. Across BCyber’s platform inventory of 23 policies, 9 processes, 50 courses, 950 published articles, 539 knowledge hub entries, 11 clients, and 14 fact-find assessments, the same pattern appears repeatedly: firms often have the “front door” controls in place, but not the operational evidence to prove they work when challenged. This article is based on that practical experience, plus current guidance from the ASD / ACSC, APRA, NIST, and ISO 27001.

Verification note: BCyber platform figures and product references in this article are drawn from internal platform data and service catalogue records current at the time of publication.

Why “enough” is the wrong question

If you are asking, “Is antivirus and MFA enough for a professional services firm?”, the more useful question is, “Enough for what, exactly?” Enough to reduce some common risks is one thing, but enough to protect sensitive client data, satisfy contractual expectations, and stand up in a security questionnaire is something else entirely.

Professional services firms sit on a concentration of trust: legal documents, financial records, identity data, project files, and privileged communications. That makes them attractive targets for phishing, business email compromise, credential theft, cloud account abuse, and insider-driven data exposure. In our experience supporting firms that handle regulated and sensitive data, the highest-impact incidents are increasingly identity- and cloud-led, not “classic malware” events.

That distinction matters because the attack surface now includes:

• email and collaboration platforms,
• identity providers and SSO,
• third-party applications connected via OAuth,
• privileged admin portals,
• and poorly controlled file sharing.

These are the places where simple antivirus does very little and MFA alone is only part of the answer.

What antivirus and MFA do well

Antivirus: useful, but reactive

Antivirus still has a place because it can detect known malicious files, suspicious behaviour, and some forms of endpoint compromise. In modern environments, it often sits inside a broader endpoint protection / EDR stack, which may also provide telemetry, isolation, and response actions.

For a professional services firm, that matters on managed laptops, shared workstations, and remote endpoints where staff handle email, documents, and client portals. It can stop commodity threats and reduce spread, but it is not designed to govern the business.

From a technical perspective, antivirus is limited by:

• signature dependence,
• heuristic confidence thresholds,
• fileless and in-memory tradecraft,
• abuse of trusted binaries (“living off the land”),
• and encrypted or cloud-delivered payloads.

So while antivirus is a good control, it is not a complete control environment.

MFA: strong protection for accounts

MFA is one of the most valuable controls a firm can deploy because it makes stolen passwords much less useful. It helps protect Microsoft 365, Google Workspace, VPNs, remote access portals, and privileged accounts from straightforward credential theft.

In practice, the strongest MFA deployments are paired with:

• conditional access,
• phishing-resistant factors where possible,
• legacy authentication shutdown,
• privileged access segregation,
• and device compliance checks.

That alignment is consistent with the NIST Cybersecurity Framework and with the ACSC Essential Eight, where identity hardening is part of a broader security posture, not the only control in play.

Even so, MFA has blind spots:

• prompt fatigue and approval bombing,
• adversary-in-the-middle phishing,
• token theft/session hijacking,
• weak enrollment governance,
• and inconsistent policy coverage across apps and admin roles.

SMS MFA is better than no MFA, but it is not the strongest option for high-risk accounts. For finance, legal, or administrative users, stronger authentication methods and tighter conditional access are usually warranted.

Why these controls became standard

Antivirus and MFA became standard because they address two of the most common attack paths: malicious code on devices and credential theft. They are often the first things clients ask about, and they appear early in audits and cyber insurance reviews because they are easy to recognise and explain.

For a professional services firm, that distinction matters. Foundational controls create a baseline, but they do not by themselves prove the firm can operate securely under pressure. They do not cover:

• data classification,
• backup recovery,
• monitoring and logging,
• incident workflows,
• privileged access management,
• retention,
• or evidence collection.

Those are governance and operations issues, and that is where many firms discover the gap between being protected and being defensible.

Where the real gaps appear

Modern attacks bypass traditional defences

The most common failure is assuming an attack must look like classic malware to matter. In practice, phishing can steal a session token even when MFA is enabled, and attackers can then use the session as if they were the legitimate user. In cloud-first environments, the value is often in the mailbox, SharePoint site, shared drive, or case management system — not the endpoint itself.

That is why firms in:

• financial services often see business email compromise and invoice diversion,
• healthcare see records exposure through over-shared collaboration folders,
• and government-facing suppliers see account abuse and misconfiguration leading to disclosure risk.

In Australia, this is precisely why the Essential Eight emphasises controls like application hardening, patching, MFA, daily backups, and least privilege, rather than relying on a single product category. Similarly, APRA CPS 234 expects regulated entities — and their material service providers — to maintain capability to detect and respond to security incidents in line with information security risks.

A practical scenario: finance firm email compromise

A boutique accounting firm uses Microsoft 365 with MFA enabled. A partner clicks a convincing invoice update link, approves a proxy sign-in prompt, and the attacker creates a forwarding rule to exfiltrate all client correspondence related to payroll and tax matters.

Antivirus never fires. MFA did its job at the login layer — but not at the session layer, mail rule layer, or anomaly-detection layer.

That is why firms need:

• mailbox rule monitoring,
• impossible travel detection,
• consent-grant reviews,
• privileged account segmentation,
• and response playbooks for mail compromise.

A practical scenario: healthcare practice data leakage

A healthcare practice moves patient correspondence through a cloud collaboration platform. A contractor retains access after the engagement ends, syncs files to an unmanaged device, and later downloads them without triggering an endpoint malware event.

Again, antivirus is not the issue. The issue is joiner-mover-leaver discipline, access review, device trust, and auditability.

A practical scenario: government contractor access sprawl

A supplier supporting a state government program uses shared admin credentials for convenience. MFA is enabled at the perimeter, but privileged access is not separated, logs are retained only briefly, and account reviews are ad hoc.

This becomes a governance failure, not just a technical one. In practice, that is where firms fail audits: not because a control is absent, but because it is not provable.

What a professional services firm actually needs

Governance that owns the risk

A firm needs someone accountable for cybersecurity decisions, even if that role is shared across IT, operations, and leadership. Policies for access, devices, retention, acceptable use, and incident response should not sit in a folder and gather dust.

BCyber’s own operational model reflects this reality through structured governance assets such as:

• GRACE Portal for central visibility, executive reporting, compliance tracking, and real-time monitoring,
• Paradigm for GRC automation, policy mapping, and compliance mapping,
• and Privacy in Depth for privacy obligations, including Australian Privacy Act-driven requirements.

Where many firms struggle is not policy creation — it is operationalising policy. That is why BCyber maintains 23 policies and 9 processes in its platform inventory, alongside training and knowledge resources, so controls can be assigned, reviewed, and evidenced.

For firms aligning to ISO 27001, this maps neatly to governance, risk treatment, internal audit, corrective action, and management review. For firms working to the Essential Eight Maturity Model, governance determines whether the technical controls are consistently configured and maintained.

Access control and least privilege

Least privilege is one of the simplest ideas in security and one of the easiest to under-implement. Staff should only have access to the systems and data they need for their role, and privileged access should be separately controlled and reviewed.

A stronger access model includes:

• RBAC/ABAC where appropriate,
• separate privileged admin accounts,
• just-in-time elevation,
• periodic access recertification,
• and removal of dormant or orphaned accounts.

Profiler, BCyber’s behavioral intelligence platform, is particularly relevant here. It supports behavioral analysis, insider threat detection, access pattern monitoring, risk scoring, and user activity analytics. That kind of visibility helps identify when a user’s access pattern no longer matches their normal role — a common precursor to misuse, compromise, or insider risk.

Logging, monitoring, and alerting

If a firm cannot see what happened, it cannot investigate what happened. Logging should include:

• sign-ins,
• admin actions,
• mailbox rule changes,
• privileged elevation events,
• file access where feasible,
• endpoint alerts,
• and security configuration changes.

This aligns with NIST guidance on continuous monitoring and incident handling, and it is essential under APRA CPS 234, which expects security controls to be tested and the entity to remain aware of material vulnerabilities.

BCyber’s GRACE Portal is designed to centralise this kind of operational visibility through cross-product analytics, executive reporting, compliance tracking, and real-time monitoring. For smaller firms, the key is not the brand of the tool — it is whether the logs are centralized, retained, and actionable.

Backup and recovery that actually works

Backups are only useful if they can be restored. A firm should protect cloud data as well as on-premises data, including:

• Exchange or Gmail,
• SharePoint, OneDrive, Google Drive,
• line-of-business systems,
• and identity-related configuration where possible.

Immutable or otherwise protected backups reduce ransomware and deletion risk. Separate credentials for backup administration also matter, because the attacker who controls production access should not automatically control recovery.

This is consistent with ACSC Essential Eight guidance, which emphasises daily backups and restoration testing. It is also a recurring topic in BCyber’s training catalogue, including courses aligned to resilience, incident readiness, and governance awareness delivered through the platform’s 50 courses and associated knowledge resources.

Training and incident response

People are not the weakest link; they are the first line that needs support. Training should cover:

• phishing,
• invoice fraud,
• suspicious requests,
• data handling,
• and escalation paths.

Different roles need different emphasis. A partner, a finance lead, a receptionist, and a records officer face different attack patterns, so the content should reflect role-based risk. BCyber’s 50 courses and 539 knowledge hub entries are a good example of how education needs to be ongoing rather than annual and generic.

Incident response should be written, assigned, and tested. It should cover:

• containment,
• communications,
• legal review,
• client notification,
• evidence preservation,
• and recovery.

BCyber’s CyberTriage platform is relevant here because it provides AI-powered incident response and a 4-minute triage workflow for threat containment, investigation, and resolution. That kind of capability supports faster initial assessment, but it still needs a documented response process behind it.

For scenario testing, Perfect Storm helps model compound threats, simulate impact, and test resilience through war-gaming. This is particularly useful for firms that need to prove they can respond under pressure rather than simply discuss a response plan.

Compliance and client assurance change the baseline

“We use MFA” is not enough for procurement

Clients increasingly want to know not only whether controls exist, but whether they work consistently. Security questionnaires often ask about:

• MFA coverage,
• backup frequency,
• logging,
• incident response,
• encryption,
• retention,
• and vendor oversight.

That is especially true when serving regulated or sensitive sectors. In Australia, the relevant compliance lens may include:

• APRA CPS 234,
• the ACSC Essential Eight,
• the Privacy Act 1988 and Australian Privacy Principles,
• NIST CSF as a management framework,
• and ISO 27001 for ISMS structure.

The exact obligations vary, but the standard expectation is the same: controls must be demonstrable, not merely declared.

Reference frameworks and government resources

Authoritative resources worth using directly include:

• ACSC Essential Eight: https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight
• APRA CPS 234 Information Security: https://www.apra.gov.au/cps-234-information-security
• NIST Cybersecurity Framework: https://www.nist.gov/cyberframework
• NIST SP 800-53: https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final
• ISO/IEC 27001 overview: https://www.iso.org/isoiec-27001-information-security.html
• OAIC Australian Privacy Principles: https://www.oaic.gov.au/privacy/australian-privacy-principles

Evidence of effectiveness is what auditors and clients notice

Evidence can include:

• policy documents,
• MFA enforcement reports,
• access review records,
• backup test results,
• incident response exercise notes,
• vulnerability remediation evidence,
• and logs showing central monitoring.

BCyber’s platform inventory and service design support this model through:

• GRACE Portal for executive reporting and compliance tracking,
• Paradigm for policy automation and compliance mapping,
• Profiler for user activity analytics,
• and Privacy in Depth for privacy governance and Australian Privacy Act-aligned obligations.

This is one reason BCyber’s work tends to align well to firms that need provable governance for client diligence, audit readiness, and board reporting.

Cyber insurance also rewards discipline

Insurance is not a substitute for security, but underwriting and claims reviews increasingly depend on whether a firm can show basic controls are actually in place. Inconsistent MFA enforcement, poor backup practices, or missing documentation can complicate claims even if an incident was not preventable.

That means evidence matters beyond internal comfort. A firm that can document:

• control ownership,
• testing cadence,
• exception handling,
• and recovery validation

is in a much stronger position than one that only remembers controls verbally.

What a practical baseline looks like for most firms

The minimum stack that deserves serious attention

For most professional services firms, the practical baseline starts with strong identity and email protection:

• MFA everywhere, especially for privileged users,
• removal of legacy authentication,
• conditional access,
• risk-based sign-in policies,
• and mailbox forwarding restrictions.

On endpoints, modern protection should go beyond basic antivirus where possible:

• application control,
• patch management,
• device encryption,
• screen lock controls,
• and mobile device management.

On cloud and data platforms:

• secure Microsoft 365 or Google Workspace configuration,
• external sharing controls,
• sensitivity labels where appropriate,
• retention rules,
• and backup scope aligned to business criticality.

The operational layer is part of the baseline too

A baseline is not complete without:

• centralized logging,
• alert triage,
• vulnerability scanning,
• periodic access reviews,
• vendor risk management,
• and joiner-mover-leaver discipline.

This is where BCyber’s broader ecosystem becomes relevant:

• GRACE Portal for unified visibility,
• Paradigm for GRC automation and policy mapping,
• TopSpin for cybersecurity storage forecasting and capacity planning,
• CyberTriage for rapid incident response,
• Profiler for behavior monitoring,
• and Perfect Storm for scenario modeling.

Together, these products align to a practical operational model: see the risk, map the control, test the response, and prove the outcome.

How to decide what your firm needs

Risk drives the right baseline

The right answer depends on the data you hold, the clients you serve, and the obligations you have accepted.

Examples:

• Financial services firms need tighter privilege control, audit logging, and incident response because fraud and impersonation risks are immediate.
• Healthcare providers need stronger data classification, access controls, and privacy governance because record sensitivity and notification obligations are high.
• Government contractors need stricter evidence and monitoring because procurement and assurance requirements are often explicit.

If the loss of email, client files, or finance systems would materially affect operations, the baseline should be stronger. If exposure of confidential information would trigger legal, contractual, or regulatory consequences, the baseline should be stronger still.

A simple decision framework

Use four questions:

1. What data do we hold?
2. What would happen if it were lost or exposed?
3. Which legal, contractual, or regulatory obligations apply?
4. Can we detect, respond, and recover quickly enough to matter?

If the answer to any of these is unclear, the firm likely has a gap that tools alone will not close.

About BCyber

BCyber helps firms move from point controls to provable cyber governance. Its platform ecosystem includes:

• GRACE Portal,
• Paradigm,
• Profiler,
• TopSpin,
• CyberTriage,
• Perfect Storm,
• and Privacy in Depth.

BCyber has also been recognised as:

• 2025 Finalist — Cybersecurity Professional Of The Year for Karen Stephens, Co-Founder & CEO,
• 2025 GRC Provider of the Year — Finalist,
• and 2025 AI Innovator - Cyber Security — Finalist.

Key Takeaways

Antivirus and MFA are essential, but they are not enough for most professional services firms. Modern attacks often target identity, cloud services, email workflows, and human behaviour rather than obvious malware alone.

To be defensible, a firm needs:

• governance,
• least-privilege access,
• logging and monitoring,
• tested backups,
• staff training,
• and an incident response capability that can be evidenced.

If you hold client data or need to answer to auditors, clients, insurers, or regulators, the real question is whether your security can be demonstrated. A defensible baseline is built from policy, configuration, monitoring, recovery, and review. Antivirus and MFA belong in that baseline, but they do not finish it.