SonicWall Research Finds Professional Services Firms Overruled by Their Own Cybersecurity Gaps as Attackers Target the Sector’s Privileged Data

SonicWall today released its 2026 Professional Services Protect Brief, a vertical-specific companion to the SonicWall 2026 Cyber Protect Report, revealing that law firms, accountancies, consulting practices, engineering firms and managed service providers generated 3 billion IPS events in the first half of 2026, the largest absolute attack volume of any industry SonicWall tracks, and that 460 organizations in the sector are actively detecting ransomware campaigns, the broadest exposure of any vertical.

Every year, attacks look more sophisticated. In most ways they are; AI has made them faster, cleaner, and harder to spot at a glance. But the underlying methods have not changed. Attackers are still walking through the same unlocked doors. In professional services, those doors are open by design. Client portals, document management platforms, billing systems and collaboration tools are built to be accessible, and that accessibility is also the vulnerability.

“Professional services holds the kind of data that carries built-in leverage,” said Michael Crean, SonicWall SVP of Managed Services. “Client records tied to active legal matters, financial transactions, privileged communications, and for MSPs, administrative credentials into dozens of other organizations’ networks. We're not talking about harmless background data. For the client, it represents massive financial, legal, and reputational risk. Attackers know this value, and the data bears that out.”

SonicWall’s Professional Services Protect Brief draws on data from SonicWall’s global network of more than one million security sensors to document the specific attack patterns, exploitation vectors and ransomware campaigns defining the professional services threat landscape in the first half of 2026.

Key Findings from the 2026 SonicWall Professional Services Protect Brief

• Professional services generated 3 billion IPS events in the first half of 2026, the largest absolute attack volume of any industry SonicWall tracks.
• SIPVicious VoIP exploitation generated 332 million combined hits (signatures ranked #3 and #6 by volume) — a scale unique to this sector among all tracked industries.
• Professional services recorded 69.9 million ransomware hits in the first half of 2026, more than any other vertical.
• Ten active ransomware families operated simultaneously against the sector, including Filecoder (19.1 million hits across 113 organizations), Gandcrab (11.9 million) and Ryuk (10.5 million).
• Apache Log4j2 (Log4Shell) generated 107 million hits, 2.5 years after public disclosure and emergency patching across the industry.
• Directory traversal, malformed request probes and remote code execution signatures account for 72% of all IPS volume in the sector.

An MSP Breach Is Never Just One Breach

Professional services firms hold a category of data that is uniquely valuable: client records tied to active legal matters, financial transactions, privileged communications, and, in the case of MSPs, administrative credentials for the networks of dozens of client organizations. That leverage is what drives ransomware targeting in the sector, and the MSP dimension compounds it. An MSP breach potentially provides access to every client environment the MSP manages, and ransomware groups understand the arithmetic.

“An MSP breach is not one breach, it’s potential access to every client environment that MSP manages,” continued Crean. “Ryuk and Sodinokibi don’t show up in professional services by accident. They specifically target organizations that hold administrative access to other organizations, because one compromised credential can cascade into dozens of networks at once. That’s not spray-and-pray, that’s a calculated market decision.”

Zero Trust in Practice: A Legal Industry Case Study

XimpleIT, a Colorado-based MSP specializing in legal industry clients, deployed SonicWall Cloud Secure Edge across its law firm customer base after a client breach caused by an unpatched legacy VPN. By replacing broad network trust with application-level, continuously verified access, XimpleIT eliminated implicit trust and prevented lateral movement across client environments, precisely the architecture shift this brief recommends for a vertical built on privileged communications and client records.

“Having somebody, a real person, who checks in regularly, provides assistance implementing new solutions, and helps us win deals is a big differentiator,” said Juan Serna, Founder and IT Director, XimpleIT, a SonicWall partner. “That is rare. SonicWall gives us the platform and the partnership to walk into a law firm and tell them, with confidence, that their data is protected, not just monitored.”