The Professional Firm Tech Stack: What’s In It, and What We Find When We Take One Over

Reviewed by Peter Bertran, Chief Client Officer, DKBinnovative

 

Most firms can name every product they run. Far fewer can say which one authenticates against which, who reviews the permissions, or when a restore was last tested end to end.

That second set of questions is the one that decides how a firm’s week goes. Technology in a professional practice rarely fails inside a product. It fails in the space between two of them, and that space tends to belong to nobody.

The document system has to authenticate against something. The billing platform has to be backed up in a way you can actually restore. The email tenant has to be the same tenant the practice management tool trusts. Get any one of those joins wrong and the symptom surfaces somewhere else entirely, which is why they sit unfixed for years.

So this is the stack layer by layer: what these firms run, what we find when we inherit one, and what a working version looks like. The findings below are drawn from our own engagements, including a five-year engagement with a three-office North Texas CPA firm and a business email compromise at a wealth management firm.

What Software Do Most Law Firms Use?

Most law firms run a practice management platform such as Clio, MyCase or Actionstep for matters, time and billing, a document management system such as iManage or NetDocuments, Microsoft 365 for email and files, a legal research tool such as Westlaw or LexisNexis, and an e-signature service. The software is rarely the problem. The problem is that these products are usually bought separately, at different times, by different people, and nobody owns how they fit together.

What Software Do Most Accounting and RIA Firms Use?

Accounting firms typically run tax preparation software such as UltraTax, Lacerte or ProSystem fx, QuickBooks for client bookkeeping, a document portal for client exchange, and Microsoft 365. RIAs run a portfolio accounting or performance reporting platform, a CRM such as Redtail or Wealthbox, a custodian portal, and Microsoft 365. In both cases the line-of-business application is the one nobody can lose access to, and it is usually the one with the weakest integration story.

The Seven Layers, and What We Find in Each

The order below is deliberate. It runs from the layer everything else depends on to the layer most firms buy first.

1. Identity

What it is: Microsoft Entra ID or on-premises Active Directory, usually both, deciding who is allowed into everything above it.

What we find: At the CPA firm, multifactor authentication was not enforced, legacy authentication was still enabled, and stale Active Directory accounts were still live. In a separate post-acquisition engagement, a compromised Microsoft 365 account had been in use by an attacker for more than a year, quietly provisioning Azure virtual machines to run phishing campaigns and generating over $10,000 in fraudulent cloud charges before anyone noticed.

What good looks like: MFA enforced with no exceptions, legacy authentication disabled outright, and quarterly account hygiene that actually removes departed staff. At the CPA firm we run that review every quarter and reset privileged passwords as part of it.

2. Email

What it is: Microsoft 365 in nearly every DFW professional firm we see, and the single most attacked surface in the stack.

What we find: The CPA firm had logged 150+ Microsoft 365 and Outlook disruptions consuming over 200 hours of support time before we arrived. Separately, a wealth management firm suffered a business email compromise that redirected a client payment to a fraudulent account. Email is where the money actually leaves, and the FBI IC3 annual reports put business email compromise among the costliest categories of cybercrime year after year.

What good looks like: DMARC and DKIM deployed across every domain the firm owns, not just the primary one, plus alerting on mailbox forwarding rules and delegate changes. Those two rules catch most BEC in hours rather than months.

3. Document management

What it is: iManage, NetDocuments, SharePoint, or a file server somebody has been meaning to retire since 2019.

What we find: Permissions that grew by accretion. A folder opened up for one project in 2021 and never closed. For litigation practices the more serious finding is a legal hold that cannot be applied reliably because the same matter exists in two systems.

What good looks like: One authoritative repository, permissions reviewed on a schedule rather than on request, and preservation that a custodian cannot override.

4. The line-of-business application

What it is: Practice management, tax software, portfolio accounting. The thing the firm cannot work without.

What we find: This is the layer most IT providers quietly decline to support. The application gets treated as the software vendor’s territory, so tickets are forwarded rather than resolved, and the firm ends up managing that relationship itself during the weeks it can least afford to.

What good looks like: Your provider holds genuine competence in the specific platform you run, and owns the problem rather than routing it onward. Faults get diagnosed and fixed in-house, paired with proactive update management so the same issue stops recurring.

5. Backup and recovery

What it is: The layer everyone assumes is fine.

What we find: The most alarming finding in five years of that CPA engagement: server backup jobs had been failing repeatedly across multiple years, with client financial data exposed the entire time and no durable fix. The jobs reported. Nobody read the reports.

What good looks like: Azure Backup with daily restore points, continuous monitoring of the jobs themselves, and a restore you have actually performed. A green backup status is a claim. A completed restore is evidence.

6. Endpoint and network

What it is: Laptops, the office network, and whatever is filtering traffic.

What we find: At the CPA firm we detected live active threats already present on endpoints during onboarding. Not historical indicators. Active. At the wealth management firm, containing the compromised account took ten minutes, but auditing all 20 endpoints to confirm the blast radius took five hours, and that only worked because there was tooling to audit with.

What good looks like: EDR with 24/7 monitoring behind it, DNS-layer filtering, and network segmentation. We run SentinelOne and Cisco Umbrella, on Meraki infrastructure with VLAN segmentation where the firm has its own network. CISA Cyber Essentials is a reasonable baseline to measure yours against.

7. Monitoring and advisory

What it is: Whether anyone is watching, and whether anyone is planning.

What we find: A fully reactive break-fix model with no patch management schedule, no tax-season planning and no technology roadmap. Decisions made at the moment of failure, by whoever was in the room.

What good looks like: Continuous monitoring, a patch calendar that knows what month it is, and quarterly vCIO reviews. For the CPA firm that meant pausing non-critical updates during peak filing periods, which is a scheduling decision rather than a technical one, and it is the sort of thing only a provider who understands the practice will think to do.

The Pattern Underneath All of It

Read those findings together and one thing connects them. Not a single item on the list is exotic. There is no zero-day, no sophisticated adversary, no failure of technology.

Backups failing for years. MFA not turned on. Legacy authentication left enabled. Accounts belonging to people who left. A forwarding rule nobody alerted on. Every one of these is a known problem with a known fix, sitting unaddressed because the stack had no owner.

That is the actual finding after five years and 1,256 tickets at one firm: professional firms do not usually fail because they bought the wrong software. They fail because seven layers were assembled by different people over a decade and nobody was responsible for the whole.

What a Working Stack Looks Like

The same CPA firm, after the work: backups modernized onto Azure with daily restore points and monitored continuously. MFA enforced firm-wide, legacy authentication eliminated, active endpoint threats contained through EDR. Quarterly Active Directory hygiene across all three offices. DMARC and DKIM across every domain. A patch schedule that pauses during tax season. Quarterly vCIO reviews replacing decisions made in a panic.

The numbers underneath that: 1,256 tickets resolved over five years, 2,164+ hours of support for 52 staff across three offices, more than 65% resolved same-day or next-day, and average resolution under one day. Through five tax seasons, without disrupting one of them.

That is the whole argument. Not better software. The same software, owned properly.

How to Audit Your Own Stack This Week

You do not need us to do the first pass. Seven questions, one per layer, and you can ask them all in an afternoon.

1. Identity. Is MFA enforced on every account with no exceptions, and is legacy authentication disabled? Ask for it in writing.
2. Email. Does anything alert when a mailbox forwarding rule is created?
3. Documents. Who reviewed folder permissions last, and when?
4. Line-of-business app. When your tax or practice management software breaks, does your IT provider fix it or forward it?
5. Backup. What is the date of the last completed restore test, and what broke during it?
6. Endpoint. Is there EDR, and is a human watching it outside business hours?
7. Advisory. When did someone last show you a technology roadmap you had not asked for?

Any question you cannot answer is a layer without an owner. That is the finding, and you just produced it yourself. If you want a framework to hang the answers on, the NIST Cybersecurity Framework maps cleanly onto these seven layers.

Frisco, Plano and Irving

Plano firms tend to have the deepest layers and the oldest ones. Established practices carry file servers, legacy authentication and permission structures that predate anyone currently working there. The CPA engagement above is the North Texas pattern exactly. Our Managed IT Plano team does most of these untanglings, and our Managed IT Plano security practice handles what the audit turns up.

Frisco firms are typically newer and cloud-native, which moves the problem rather than removing it. The stack is cleaner but governance is thinner: fewer legacy servers, more unmanaged SaaS bought by whoever needed it. DKBinnovative is headquartered in Frisco, and our Managed IT Frisco team sees this pattern constantly, while our Managed IT Frisco practice for financial and professional firms covers the compliance layer that sits on top of it.

Irving and Las Colinas firms get audited by their own clients. The corridor’s corporate tenant base runs vendor due diligence that asks about exactly these seven layers, which means a Las Colinas firm often discovers its gaps through someone else’s security questionnaire. Our Managed IT Irving practice works from 7301 State Hwy 161, and our Managed IT Irving team handles the evidence side.

Frequently Asked Questions

What software do most law firms use?

Most law firms run a practice management platform such as Clio, MyCase or Actionstep, a document management system such as iManage or NetDocuments, Microsoft 365 for email and files, a legal research tool such as Westlaw or LexisNexis, and an e-signature service. The software is rarely the problem. The problem is that these products are bought separately, at different times, and nobody owns how they fit together.

What software do accounting and RIA firms use?

Accounting firms typically run tax software such as UltraTax, Lacerte or ProSystem fx, QuickBooks, a client document portal and Microsoft 365. RIAs run portfolio accounting or performance reporting, a CRM such as Redtail or Wealthbox, a custodian portal and Microsoft 365. The line-of-business application is the one nobody can lose access to and usually the one with the weakest integration story.

What is the most common IT problem you find at professional firms?

Backups that have been failing without anyone noticing. In one five-year CPA engagement, server backup jobs had failed repeatedly across multiple years with client financial data exposed the whole time. The jobs reported their failures. Nobody was reading the reports.

Should our IT provider support our practice management or tax software?

Yes, and many will not. Generalist providers treat line-of-business applications as the vendor’s responsibility, which is technically correct and useless during filing season. Ask a prospective provider directly whether they hold application-level competence in the specific platform you run.

How long does a stack assessment take?

A few weeks to assess all seven layers and produce findings. If remediation is needed, full onboarding for a professional firm typically runs 45 to 90 days depending on how much legacy infrastructure is involved.

Do we need to replace our software to fix these problems?

Almost never. Nearly every finding in this article was resolved on the software the firm already owned. The fix is ownership of the whole stack, not replacement of the parts.

Working With DKBinnovative

We have supported professional firms across Dallas-Fort Worth since 2004, which is 22 years, currently spanning 2,632+ end users across 55+ companies with a 78% first-call resolution rate and 98.14% client satisfaction. We standardize on Microsoft Azure and Microsoft 365, and deploy Hatz.AI where firms need governed AI that keeps client material inside their own tenant.

Call (888) 352-4832 or book an assessment.

Related reading: Case study: multi-office CPA firm · Case study: financial services crisis in 24 hours · Investment & Professional Firms · Managed IT for Law Firms · Managed IT for Accounting & CPA Firms

External references: Microsoft Entra MFA, Exchange Online basic authentication deprecation, FBI IC3 annual reports, CISA Cyber Essentials, NIST Cybersecurity Framework.