Author: Chris Adams, CEO

Clients care about their financial information and money being secure. Focus on that, and you’ll pass the SEC exam every time, and never have to touch the incident response plan your compliance officer drafted.

Your compliance officer just finished another exam. Clean report. No findings. The SEC signed off.

That piece of paper tells you nothing about whether your clients’ data is actually safe. Nothing.

Here’s the fact your firm needs to sit with: An RIA can hold a written Reg S-P program the SEC has reviewed, and still have no idea whether its laptops are encrypted or who is inside its email. In the last eighteen months, a dozen SEC-registered advisers filed breach notices in California alone. Every one of them had the binder.

That’s not a hypothetical. That’s not fear-mongering. That’s a fact. Hard stop.

What your firm writes into its Reg S-P policy, what it demonstrates in an audit, what it hands the SEC during a routine filing, none of that measures your true security posture. It’s a plan for what to do after the breach. After the data loss. After the compromise already happened. It’s reactionary by design.

Here’s the real gap. A firm can satisfy the letter of Reg S-P with a solid post-incident process, a documented plan, a clean 30-day notification procedure, and still have no meaningful barrier standing between an attacker and the intrusion happening in the first place. Right now, every RIA in the country is racing to satisfy the new Reg S-P amendments. Almost none of that effort is going toward actually securing the firm.

ATG wants that incident response plan to sit in a drawer. Untouched. Unused. Forever. Zero client notifications, not because you got lucky, but because there was nothing to notify anyone about. Satisfying Reg S-P puts a smile on your CCO’s face. Fine. That’s their job. But it has nothing to do with whether your firm has an actual preventative security framework standing between your clients’ data and the people trying to steal it. Nothing.

Managing partners have hidden behind one excuse for years: “I’m not a technical person.” That excuse is dead. You use technology all day, every day: trading platforms, custodial portals, email, your phone. (And yes, your phone, your laptop, your email need to be highly secured and monitored too. That’s a conversation for another day, but it’s worth saying out loud here.) You are not intimidated by technology. You’re intimidated by the idea that you’re responsible for securing it. Those are different things.

Fraudulent ACH wires don’t happen because attackers are geniuses. They happen because attackers continue to exploit your ignorance, and your choice not to bring your security and your org chart into the modern era.

You don’t need to become technical. You need to understand how the modern org chart is supposed to look, and make sure yours actually matches it. Because right now, at most RIAs, it doesn’t.

Attacks on RIAs and their clients are ramping up at an alarming rate. Now, not next year. Managing partners already know this. They read about it every day. This isn’t a knowledge gap. It’s a choice gap. And too many are choosing not to act, because they have a shield ready: “We passed our SEC exam.”

That shield means nothing to the client whose $150,000 just got wired to an account nobody at the firm recognizes. Passing an exam doesn’t unwind a fraudulent wire. It doesn’t get their money back.

Your compliance officer is not technical. That’s not an insult. It’s their job description. Their job is regulatory. Is cybersecurity part of compliance? In a narrow sense, yes. But running on a cloud-based technology stack, it’s really just strong security practice, full stop. Treating it as a compliance sub-function is where firms get the org chart wrong.

IT should sit under the CFO or the COO. The CISO, or whoever functionally plays that role, should report directly to the CEO, with authority to hold the IT team accountable. Blur that line, and you don’t get efficiency. You get a conflict of interest: the person grading the exam and the person securing the network can’t be the same reporting chain. Your IT team pays for it too, taking direction filtered through someone who isn’t technical, aimed at a target that’s already outdated.

Your stakeholders don’t accept the accounting team’s own report as proof the numbers are right. They want an audited financial statement, from an independent party with no stake in making the numbers look good. Cybersecurity deserves the same standard. Right now, most RIAs run on the equivalent of trusting the accounting team’s own report. The same IT function that builds and maintains the systems is also the one telling you those systems are secure. That’s not oversight. That’s self-grading.

ATG is the independent audit function for your security posture. We work independently of your existing IT support, internal or outsourced, and we report straight to you: the managing partner, the CEO. Not your IT director. Not your compliance officer. Because if we didn’t, there’d be no accountability. Nobody watching the watchers.

We don’t care what your firm’s written plan says. We don’t care what you proved to an examiner last quarter. We care about one thing: protecting your clients’ assets under management.

It comes down to three doors. Device. Identity. Data loss. Those are the pillars that have to be watched every second of every day, and the instant one gets triggered, it gets shut down. Not reviewed next Monday. Shut down, immediately, 24/7. That’s not a philosophy. That’s an operating requirement.

I’ve spent a long time looking for an RIA firm that’s actually getting this right. Not “passing exams” right. Actually right. I found exactly one. My own RIA.

The only reason I have full confidence in him is that he adopted the protocol ATG built. If he hadn’t, I would have fired him. My money and my family’s future don’t get to sit behind hope and a compliance binder. Neither does yours. Neither do your clients’.

Hope is not a security strategy. Ignorance is not a security strategy. “We passed our exam” is not a security strategy. The bad guys are smart. They are organized. They are patient. They are extremely technical. They are sneaky and creative. They are winning.

This message is for managing partners and CEOs. Not compliance officers, not IT directors. Security is a top-down mandate or it’s nothing. If the person running the firm doesn’t require it, adopt it, and enforce it, it does not happen. You cannot delegate this down and hope it sticks. You have to own it.

Your clients trusted you with their life savings. They didn’t audit your cybersecurity plan before they signed. They assumed you had it handled. Make sure that assumption is true, not just on paper, but in practice, every hour of every day.

Compliant is easy. Secure is a discipline. Choose the one that actually protects the people who trusted you.

In Q3 2026 alone, our clients avoided over $1.2 million in fraudulent wire transfers and payments to accounts controlled by criminals.

These attempts started with a phishing email that got an employee to hand over credentials. A second was worse: an attacker hijacked an SMS-based MFA token and walked straight past the “second factor” that leadership assumed was protecting them.

Case in point: Microsoft is retiring SMS and voice as authentication methods in Entra ID. Passkeys became the default sign-in experience as of September 2026. Microsoft-provided SMS and voice delivery is being phased out entirely by February 2027.

Microsoft doesn’t fast-track anything. When a company running identity infrastructure for a meaningful share of the Fortune 100 moves that fast to kill a feature, that’s not a UX decision. That’s an admission that SMS-based MFA has become a major, active liability.

Every financial firm still leaning on a text-message code as its “second factor” should read that as a five-alarm signal, not a line item for next year’s roadmap.

The pivot needs to happen now. Firms need single sign-on consolidated through a real identity provider, paired with phishing-resistant authentication, a hardware security key or a passkey held in a password manager. Not a text message an attacker can intercept. Not a SIM they can swap.

I’m not writing this to brag about the save.

I’m writing it because every one of those catches happened despite how most financial firms are organized, not because of it. And I’m tired of the security industry tiptoeing around the actual cause.

Here it is, plainly: nobody’s arguing that compliance, security, and IT call for different skill sets. Everyone already agrees on that.

Where financial firms get it wrong is the chain of command. They let security report through IT, or through compliance, or through whoever’s convenient, instead of giving it its own accountability straight to the top.

That structural failure, a chain of command built by boards and executive teams with no security expert in the room to challenge it, is why the bad guys keep winning.

The FBI’s BEC numbers climbed again this year. They climbed because security isn’t a priority with the authority to say no.

Employees call IT to fix problems. Compliance checks boxes. Security is the overwatch.

A Security Operations Center watches and monitors continuously. When it finds a problem, it acts before the problem becomes an incident. Everyone else in the org chart reacts.

A good SOC doesn’t solve problems. It stops them before they ever have the chance to happen.

When you bury that function inside IT or hand it to compliance as a side responsibility, you don’t just create an inefficiency. You arm the attacker.

Compliance turns security into a checkbox: policies written, audits passed, breach happens anyway.

IT turns security reactive: respond to the ticket, keep the lights on, worry about the phishing-resistant MFA migration next quarter.

Either way, the one function built to act before the damage is done gets stripped of the authority to act at all.

Let’s be precise about this, because too many boardrooms still conflate two things. A financial firm can pass an SEC exam with flying colors, sail through a compliance audit, and get breached the next morning.

Compliant and secure are not the same thing.

One measures whether you followed the rules on paper. The other measures whether an attacker can get in.

You can score 100% on the first and still be wide open on the second. And if compliance is the only lens your firm uses to judge its own security, you will not find out which one you actually are until it’s too late.

That’s exactly where ATG plants its flag.

We are not in the business of helping you pass an SEC exam. That’s compliance’s job, and it should be, because the SEC has real authority to pull a license or levy a penalty, and someone at your firm needs to own that risk.

ATG is in the business of one thing: making sure client data and the assets under management sitting behind your systems are 100% secured.

Compliance’s job is passing the exam. IT’s job is keeping the lights on. ATG’s job is making sure the data and the AUM are actually secure. Three different jobs. Firms keep collapsing them into two, folding security into whichever one is convenient. It unequivocally needs to be three. Hoping the SEC catches the gap before an attacker does is not a strategy, and it isn’t working, not according to what the FBI is reporting.

Stop Assuming Security Is a Function of Compliance, or Something IT Can Handle

Five years ago, folding security into IT or compliance was almost defensible. Most financial firms were still running on-premise, and the attack surface was mostly contained inside your own walls.

Then COVID hit. Everyone went remote overnight, and firms rushed to the cloud just to keep functioning, which was every cyber criminal’s dream: exposed endpoints, home networks, VPNs stood up in a weekend, employees clicking on anything that looked like a helpdesk request.

That shift is exactly what should have pulled security out into its own independent role. For a lot of firms, it never did.

Everything evolved but the org chart.

Security just stayed assumed into whichever function was already in the room: compliance treats it as a subset of the regulatory checklist, or IT treats it as another ticket type.

Either way, security never becomes its own function. It becomes a chore quietly attached to somebody else’s job description.

Look at the actual job descriptions and you’ll see why this fails on its own terms. The compliance officer’s job description is clear, and it matters: interpret the regulation, file the paperwork, pass the exam.

IT’s job description is just as defined, and it’s a list of fires: fix the printer, resolve the blue screen, replace the broken laptop, order the new monitor, reset the password nobody remembers. That’s a full day before lunch.

Security can’t be a line in either job description. It’s the one thing everyone agrees matters, that almost nobody fully understands the complexity of, and that nobody has the time to prioritize. So it gets kicked down the road, and that’s how security holes get created.

That complexity isn’t static, either. Security is dynamic: threats change, systems change, and everything today is connected to everything else. A vendor’s API, a home network, a cloud app nobody remembers approving: any one of them can be the way in. That interconnectedness is exactly why getting this role right matters more now than it ever has.

So what does real security ownership actually look like, day to day? The CISO, or in ATG’s case the SOC (security operations center), is there to question everything. Every access grant, every application, every third-party connection into the tech stack gets scrutinized and assigned a risk factor.

Nothing gets a pass because it’s convenient, because IT is in a hurry, or because a vendor relationship predates the last security review.

If it touches the tech stack, resides on a laptop, or has a login, it gets questioned. If it can’t justify itself, it gets flagged, restricted, or removed.

This Isn’t a Budget Problem. It’s an Org Chart Problem.

None of this requires a bigger org chart. It requires three decisions your firm’s leadership has probably been avoiding:

Compliance keeps regulatory interpretation and attestation, and loses the authority to run security operations or wave off a security exception.

IT keeps infrastructure and uptime, and loses the authority to slow-walk a security finding because it’s inconvenient for this quarter’s roadmap.

Security, whether an in-house CISO or an outsourced SOC, gets its own reporting line straight to the top, with explicit standing to flag risk in what compliance signs off on and what IT ships.

Most firms don’t actually need to hire a CISO, and not for the reason you’d expect.

Hire one, and the first thing that CISO does is start assigning security roles and responsibilities.

From there, there are only two paths: build a dedicated security team under them, which is expensive and slow to stand up, or hand those roles back to whoever’s already in the building, which almost always means IT.

That second option is the fatal blow. You just spent the budget and the political capital to install independent oversight, and the first real decision that CISO makes recreates the exact conflict of interest this entire piece is about: it hands the security function right back to the IT team.

If you’re too small for a full-time CISO, that’s not an excuse.

It means your outsourced security function still needs to report to leadership independently of whoever runs your IT. It should not live as a line item buried inside the IT services contract, where it has no teeth.

And when I say “outsourced security function,” I don’t mean a single contractor wearing a CISO title. I don’t mean a call center triaging your tickets by whoever happens to pick up.

One person can’t be the security apparatus for a financial firm. The scope of it, the round-the-clock monitoring, the breadth of systems and access to watch: it isn’t a one-person job, no matter how good that person is.

ATG’s answer is a Security Operations Center: a dedicated team of six people assigned to your account, specifically. Not a rotating queue.

The same team handles every email, every phone call, every Teams meeting. They’ve spent the time becoming experts inside your business: your systems, your risk profile, your people. That’s instead of starting from zero on every ticket like a help desk would.

The $1.2 Million Wasn’t a Tooling Win. It Was an Authority Win.

Every one of those catches happened because a team with real independence looked at a transaction or a login and had the standing to say “this doesn’t check out” before anyone hit submit. Compliance wouldn’t have caught this. IT wouldn’t have caught this. Structure did.

The FBI’s BEC numbers do not have to keep climbing every year.

They keep climbing exactly as long as CEOs and managing partners keep treating security as IT’s problem or compliance’s checkbox instead of what it actually is: an independent function with the authority to stop a loss before it happens.

Fix the org chart, and that number starts moving the other way.

Leave it broken, and you’re not unlucky when it happens to you. You’re next.

The FBI’s numbers need to stop climbing. ATG is going to make that happen.

Why overlooked infrastructure quietly becomes your most expensive downtime risk

Out of sight. Out of mind.

That’s how most organizations treat the small room where their network, power, and connectivity live.

When CFOs think about technology risk, the focus is usually on applications, cybersecurity, or cloud spend. Rarely does the conversation include a 100-square-foot data or communications room tucked away in a closet, basement, or unused office. And yet, that overlooked space is often the IT bottleneck collecting dust—quietly accumulating risk until downtime makes it impossible to ignore.

At Adams Technology Group (ATG), we see this pattern repeatedly across mid-market financial and professional services firms: modern software, sophisticated security tools, and cloud platforms running on fragile physical infrastructure. Firms invest heavily in what they can see on dashboards, while the foundation that supports everything else is left unmanaged, undocumented, and undersized.

That oversight creates IT bottlenecks. And bottlenecks create financial loss.

---

Downtime Isn’t an IT Problem. It’s a Financial One.

Industry research estimates that downtime for mid-market organizations can cost anywhere from $5,000 to $15,000 per hour, depending on revenue, regulatory exposure, and productivity impact. For financial and professional services firms, the true cost is often higher and harder to quantify:

• Lost billable hours and stalled workflows
• Missed transactions or delayed closings
• Erosion of client trust and confidence
• Compliance, audit, and regulatory risk
• Emergency IT spend replacing planned investment

What makes these costs particularly frustrating for CFOs is that many outages don’t stem from advanced cyber threats or complex system failures. They originate from basic infrastructure issues: overheating switches, unmanaged cabling, single points of failure, outdated power protection, or unsecured physical access. 

All inside the “forgotten room.”

---

Why CFOs Overlook the Data Closet

The data and communications room doesn’t look expensive. It doesn’t generate revenue. It doesn’t show up in financial reports or performance dashboards.

And that’s precisely the risk.

When infrastructure is treated as a facilities afterthought instead of a strategic asset, it becomes a silent constraint on performance. Minor issues compound over time. What starts as “just a wiring problem” escalates into hours of downtime, rushed decision-making, and unplanned cost.

IT bottlenecks don’t announce themselves.
They accumulate quietly—until they don’t.

---

Eliminating Bottlenecks Starts at the Foundation

At ATG, we modernize and secure critical technology infrastructure to eliminate IT bottlenecks before they impact the business. That work starts at the foundation: the data and communications room.

A properly designed network environment is:

• Reliable — Redundant power, cooling, and connectivity reduce outage risk
• Scalable — Infrastructure grows with the business instead of limiting it
• Secure — Physical and logical controls reduce operational and compliance exposure

When infrastructure is intentionally designed, documented, and maintained, downtime decreases, performance stabilizes, and IT spend becomes predictable rather than reactive.

This is how we eliminate IT bottlenecks.

Reliable. Scalable. Secure.

Because the smallest room in your building shouldn’t quietly become your most expensive downtime risk.