# Best Endpoint Security for Tax and Accounting Firms (November 2026) *Device logs can decide whether a break-in becomes an FTC report.* > How the FTC Safeguards Rule and IRS Publication 4557 apply to a tax or accounting practice's computers, which duties fall away for firms holding data on fewer than 5,000 consumers and which do not, and which EDR products fit a sole preparer, a seasonal firm and a firm that must show continuous monitoring. Endpoint Index research (Industry guide). Published 2026-09-25, updated 2026-10-09, data as of 2026-11-01. Source: https://endpointindex.com/research/endpoint-security-accounting-tax-firms/ ## Executive summary **The FTC Safeguards Rule does not name a product, but it gives tax and accounting firms a strong practical reason to run endpoint detection and response (EDR) on every workstation: unauthorised access to unencrypted client data is presumed to be an unauthorised acquisition unless the firm can show otherwise, and device activity records are the evidence that can show it.** The presumption sits in the definition of a "notification event" ([16 CFR 314.2(m)](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314/section-314.2)). If the event involves 500 or more consumers, the firm must tell the FTC within 30 days ([314.4(j)](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314/section-314.4)). A firm that cannot show what the intruder did not reach may have to treat all the unencrypted client data the intruder could access as acquired, and report on that basis if it covers 500 or more consumers. Tax preparers are squarely inside the rule: the definitions name an accountant or tax preparation service completing income tax returns as a financial institution (314.2(h)(2)(viii)). In the endpoint database behind this guide, last checked against vendor pages on 2026-11-01, 8 products carry EDR and 3 bundle a round-the-clock team to watch it. Firm size changes the rest of the answer. A practice holding information on fewer than 5,000 consumers is excused from four provisions, including continuous monitoring. It is not excused from monitoring user activity, multi-factor authentication or FTC notification. *This is general information, not legal advice.* ## Which Safeguards Rule duties apply to a small firm? [16 CFR 314.6](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314/section-314.6) says that 314.4(b)(1), (d)(2), (h) and (i) do not apply to financial institutions that maintain customer information concerning fewer than five thousand consumers. Read against the endpoint-related provisions, that gives: | Provision | What it requires | Under 5,000 consumers | |---|---|---| | 314.4(b)(1) | The risk assessment must be in writing, with set criteria | Does not apply (the risk assessment itself, 314.4(b), still does) | | 314.4(c)(5) | Multi-factor authentication for anyone accessing any information system | Applies | | 314.4(c)(8) | Controls to monitor and log the activity of authorised users and detect unauthorised access or tampering | Applies | | 314.4(d)(2) | Continuous monitoring, or annual penetration testing plus vulnerability assessments every six months | Does not apply | | 314.4(h) | A written incident response plan | Does not apply | | 314.4(j) | Notify the FTC within 30 days of a notification event involving 500 or more consumers | Applies | The row most small firms miss is (c)(8). Logging what authorised users do on the systems holding client data is a duty at every size, and an EDR agent on each workstation is one practical, low-cost way to produce that log. The IRS adds its own expectation. [Publication 4557](https://www.irs.gov/pub/irs-pdf/p4557.pdf) (Rev. 6-2024) tells preparers to install anti-malware on all devices and keep it set to update automatically, and states that under the Safeguards Rule tax return preparers must create and enact security plans to protect client data. Publication 5708 explains how to create a written information security plan. ## How can a tax firm meet the continuous monitoring requirement? A firm with 5,000 or more consumers must choose under 314.4(d)(2): continuous monitoring, or an annual penetration test plus vulnerability assessments at least every six months. On the endpoints, one way to provide continuous monitoring is an EDR product that someone watches all the time. For a firm without security staff, that someone can be a vendor's 24/7 team:
ProductPer unit per month10 seats / yr25 seats / yr100 seats / yr
ThreatDown Elite$8.25 /endpoint/mo$990.00Via sales (online up to 20)Via sales (online up to 20)
Huntress Managed EDRMin 50 seatsMin 50 seatsMin 50 seats$9,588.00
Annual totals from each vendor's store or calculator at list price. "Quote only" means the vendor publishes no online price at that seat count; "Min N seats" means the vendor's smallest purchase is larger. Not shown because the vendor does not publish a price: Cynet All-in-One.
The alternative is EDR you or your IT provider review, backed by the testing cycle. These six products are the ones worth comparing for an accounting practice: each includes EDR, and between them they cover both routes. SentinelOne appears as Singularity Complete ($179.99 per endpoint per year), the lowest SentinelOne tier that keeps an activity history (14 days); Singularity Control keeps none, which defeats the point of an activity record. Patch management is included as a column because a vulnerability assessment is only useful if someone then patches what it finds.
ProductEDR24/7 managed responsePatch management
Microsoft Defender for BusinessIncludedNot offeredNot offered
ThreatDown EliteIncludedIncludedIncluded
ThreatDown AdvancedIncludedNot offeredIncluded
Huntress Managed EDRIncludedIncludedNot offered
SentinelOne Singularity CompleteIncludedNot offeredAdd-on
Cynet All-in-OneIncludedIncludedNot offered
From each vendor's product and pricing pages. "Add-on" means available at extra cost. Follow a product link for sources and verification dates.
## What should each firm buy? **Sole preparer with fewer than 5,000 consumers.** Microsoft Defender for Business ($36.00 per user per year) on every machine, with MFA on email and tax software. It covers the IRS anti-malware recommendation and can help support the (c)(8) activity log. Continuous monitoring is not required at your size, but a weekly look at the alert list is cheap, and the records it keeps can help you show reliable evidence against the notification presumption. **Firm of 5 to 15 staff that has reached 5,000 consumers.** Count carefully: the test is consumers whose information you maintain, so returns kept from earlier seasons can push you to the threshold. Once there, pick a route. ThreatDown Elite ($99.00 per endpoint per year) includes the 24/7 team and patching. ThreatDown Advanced ($79.00 per endpoint per year) has the same agent without the team, which works if your IT provider watches it and you buy the testing cycle. **Firm that grows every January.** Seasonal preparers bring extra laptops for the filing season. Check minimum purchases: Huntress requires 50 endpoints if bought direct or from a reseller (an MSP can sell it with no Huntress minimum) and ThreatDown 5; SentinelOne shows its Complete price for 5 to 100 workstations and leaves the terms to its partners. ThreatDown's online store only sells 5 to 20 devices, so a firm that swells past 20 in January buys through ThreatDown sales or a partner. Microsoft licenses per user, which suits staff who come back each season. Every temporary machine needs the agent before it opens client data. **Firm with an outsourced IT provider.** Ask the provider to name the product, confirm who watches it outside business hours, and write both into your written security plan. The Qualified Individual the rule requires (314.4(a)) should have their own console login. ## What endpoint security mistakes do tax firms make? - **Reading the 5,000-consumer exception as a full exemption.** It removes four provisions. Activity logging, MFA and FTC notification remain. - **Counting only this season's clients.** Retained prior-year files count as information you maintain. - **Relying on the tax software vendor's security.** Cloud tax software protects its servers, not the preparer's laptop where the password is typed. - **Buying antivirus with no activity record.** It covers the IRS checklist line but can leave the firm unable to show reliable evidence that data was not acquired. ## Frequently asked questions ### Is a CPA firm a financial institution under the Safeguards Rule? A firm in the business of completing income tax returns is, under 16 CFR 314.2(h)(2)(viii). Other accounting services may also fall within the rule; confirm with counsel or your professional body. ### Does a small tax practice need continuous monitoring? Not if it maintains customer information on fewer than 5,000 consumers, because 314.6 removes 314.4(d)(2) for those firms. It still has to monitor and log authorised users' activity under 314.4(c)(8). ### What is a notification event, and when is it presumed? The acquisition of unencrypted customer information without the consumer's authorisation. Unauthorised access is presumed to be acquisition unless you have reliable evidence it was not, or could not reasonably have been (314.2(m)). ### How fast must a firm tell the FTC? As soon as possible and no later than 30 days after discovery, for a notification event involving at least 500 consumers (314.4(j)). State breach laws and IRS data-loss reporting may add duties. ## Methodology and caveats We re-read 16 CFR 314.2, 314.4 and 314.6 in the official eCFR text, and Publication 4557 on irs.gov, on 9 October 2026. The capability table's six products were chosen by hand for the reason stated beside it; the cost table is filtered to products with 24/7 managed response included. Prices and capability states are inserted from our product records at build time. This guide describes the rule for buying purposes and is not legal advice. Your counsel or professional body is the authority on how it applies to your firm. ## Sources 1. eCFR. [16 CFR 314.4, Elements of an information security program](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314/section-314.4). Checked 9 October 2026. 2. eCFR. [16 CFR 314.2, Definitions](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314/section-314.2). Checked 9 October 2026. 3. eCFR. [16 CFR 314.6, Exceptions](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314/section-314.6). Checked 9 October 2026. 4. Internal Revenue Service. [Publication 4557, Safeguarding Taxpayer Data](https://www.irs.gov/pub/irs-pdf/p4557.pdf) (Rev. 6-2024). Checked 9 October 2026. 5. Endpoint Index product records for the six products compared (latest vendor check 2026-11-01).