Cyber Resilience · Financial advisers
Cyber security for financial advisers
Fixed-price Microsoft 365 security for IFAs and advice firms. We stop the email fraud and account takeover that put client money at risk, protect the data in your mailboxes, and give you evidence of your controls for your network, your insurer or the FCA.
"Hi, I need £40,000 from my ISA for a house purchase this week. I've changed banks, so please pay it to the new account below. I'm in meetings all day, so email is best."
The attacks advisers see
An advice firm sits between clients and their money. You know balances, you can start withdrawals, and your clients trust an email that comes from you. That makes three attacks common.
Client impersonation
A client's own email account is taken over, and the attacker writes to you as them. The tone is right, the history is real, and the request is for money.
Fraudulent withdrawal requests
A request to cash in or withdraw, with new bank details and a reason to hurry. If your process accepts email instructions, this is the attack that tests it.
Platform credential theft
A fake sign-in page for an investment platform or for Microsoft 365. With the password, an attacker can read client records, see valuations and try to move money.
The defence is part process and part technology. Call clients back on a number you already hold before acting on any change of bank details. And make your own mailboxes hard to take over, so an attacker can't use your firm's name to reach clients in the first place.
What the FCA expects of your systems and controls
The FCA doesn't publish a Microsoft 365 checklist, and we're not aware of any FCA rule that requires Cyber Essentials. What it does set are principles and rules about running your firm with adequate controls.
Principle 3
The FCA's Principles for Businesses apply to every authorised firm. Principle 3: a firm must take reasonable care to organise and control its affairs responsibly and effectively, with adequate risk management systems. Email that anyone with a password can open is hard to call adequate.
SYSC
The detailed systems and controls rules live in SYSC. Some apply to smaller advice firms as guidance rather than rules, so check with your compliance support which parts bind you. The operational resilience rules in SYSC 15A apply to banks, enhanced scope SM&CR firms and similar, not to most small advice firms.
Incident reporting from 2027
Under PS26/2, all firms with a Part 4A permission will have to report operational incidents that meet the FCA's thresholds, from 18 March 2027. A mailbox compromise is the kind of event you'll want to spot, and record, quickly.
Appointed representatives
If you're an appointed representative, your principal is responsible for you and should oversee and monitor what you do. Expect your network to set rules, and to ask for evidence.
Data protection applies too. The ICO's guide to data security expects appropriate technical and organisational measures, and calls Cyber Essentials a good starting point.
The controls we put in place
On Self-Service we configure these and leave them in report-only for your own IT person to switch on. On Managed we enforce them and keep them right.
Fixed price, before we start.
One fixed price for a typical 10-user advice firm, agreed before we start. Tell us on the call if your network has its own security requirements and we will work to them.
A full assessment and configuration of your Microsoft 365, controls set to report-only, handed over for your own IT person to run.
We enforce the controls and keep them right, with business-hours incident response and plain-English reporting. Where most firms start.
Everything in Managed, plus 24/7 monitoring, incident response at any hour, and Cyber Essentials alignment.
Prices for a typical 10-user organisation. Managed and Managed Plus run on a 12-month term. Larger firms get exact figures after the consultation. Compare the options control by control →
A real breach, and what we rebuilt.
A UK company trusted with sensitive client data came to us after a phishing attack reached their clients. In just under two months we rebuilt their Microsoft 365 security from the ground up.
&DEV is itself certified to Cyber Essentials Plus across the whole organisation, independently audited, valid until 2 October 2027.
Conditional Access, phishing-resistant MFA for admins and risk-based sign-in blocks, so a stolen password alone no longer opens client files.
Admin accounts under PIM with approval workflows and monitored break-glass accounts, so admin rights are granted only when needed, and logged.
Every device hardened in Intune with Defender for Endpoint, and SPF, DKIM and DMARC enforced, so only trusted devices connect and nobody can spoof the company.
Defender watching for anomalies and OAuth abuse: around 96 controls in all, to a Cyber Essentials Plus-aligned baseline.
Questions financial advisers ask us
01 Does our network cover this?
Usually not the technical part. As an appointed representative, your principal is responsible for overseeing you, and your network may set its own security rules. But unless your network supplies and runs your email and devices, the Microsoft 365 your advisers use every day is yours to configure. We can work to your network's requirements and give you the evidence they ask for.
02 Do we need Cyber Essentials?
We're not aware of an FCA rule that requires it. Your network, a platform or your insurer may ask for it, and the ICO calls it a good starting point for data security. The uplift covers the Microsoft 365 side of Cyber Essentials, and Managed Plus includes Cyber Essentials and Cyber Essentials Plus alignment.
03 What does it cost?
The one-off uplift is £1,800 for a typical 10-user organisation, with a fixed scope. Managed adds £200 a month and Managed Plus £750 a month, both on a 12-month term. Larger firms get exact figures after the consultation, with no obligation.
Book a 30-minute consultation.
A straightforward call with an engineer, not a salesperson. We'll talk through where firms like yours are most exposed and how the uplift would work for you. No system access, no obligation.
