<>
Professional services firms face cybersecurity exposure. Threat telemetry released by SonicWall on August 12, 2026, reveals that the sector generated three billion intrusion prevention system events during the first half of 2026. This marks the largest attack volume of any tracked industry as malicious actors increasingly target privileged client data and administrative networks.
Three Billion IPS Events Flood the Sector
According to the SonicWall Professional Services Protect Brief, law firms, accountancies, consulting practices, engineering firms, and managed service providers dealt with a massive influx of threat activity. The three billion IPS events recorded in the first half of the year outpaced every other vertical tracked by the firm.
SonicWall researchers attribute this volume to the nature of the data stored within these organizations. Professional services firms hold confidential client records, privileged communications, and sensitive financial data. Managed service providers carry an additional risk profile because they possess administrative access to the infrastructure of dozens of downstream client organizations.
Targeting VoIP and Exposed SIP Endpoints
According to the findings, the sector logged 332 million SIPVicious hits during the first half of 2026.
SIPVicious is a scanning and exploitation tool targeting Session Initiation Protocol infrastructure, which governs Voice over Internet Protocol phone systems. Professional services stands out as the only vertical tracked by SonicWall experiencing this specific signature at such a scale.
Researchers note that distributed phone systems across multiple offices and remote workers often feature exposed SIP endpoints that lack necessary authentication enforcement and network segmentation. When attackers breach an exposed phone system residing on the same network as document management platforms, they gain an immediate foothold into core business systems.
Ransomware and Managed Service Vulnerabilities
Beyond network scanning, ransomware operators actively target the sector’s administrative capabilities. According to SonicWall data, professional services organizations encountered 69.9 million ransomware hits in the first half of 2026.
Ten active ransomware families operated simultaneously across 460 organizations within the sector. The campaign included intrusions by advanced ransomware strains such as Ryuk and Sodinokibi.
Because managed service providers hold administrative credentials across multiple client environments, a single compromised MSP network allows attackers to bypass defenses at numerous downstream organizations through a single breach.
>
Worth a look