An accounting firm aggregates the payroll, bank details and tax records of every client it serves, then runs on portals, hosted applications and remote desktops that peak exactly when staff are busiest. Darkmoon tests those systems the way an attacker would and proves which paths lead to client money or client data. Managed end to end by ASC-IT's security experts, with the legal framework included.
The firm is the shortcut. Instead of breaching a hundred small companies, an attacker breaches the practice that keeps their books, runs their payroll and knows which supplier gets paid when.
Every payroll cycle, a firm pushes direct-deposit files built from client employee records. A changed bank account in the payroll portal, submitted a day before the run, is paid out before anyone notices the pay slip went to the wrong account.
Clients trust an email from their accountant. An attacker inside a bookkeeper's mailbox sends a supplier bank-detail change or an urgent payment instruction that the client approves because it came from the right address, on the right thread.
Tax season means remote work, temporary staff, document portals full of returns and a team with no time to question a password-reset email. Phishing campaigns against tax preparers are timed to the filing calendar for that reason.
Application-hosting providers, remote-desktop farms and managed file-transfer appliances serve many firms at once. In August 2025 the Cl0p group exploited a zero-day (CVE-2025-6182) in Oracle E-Business Suite to exfiltrate data from hundreds of companies worldwide, including in France.
Darkmoon starts from the identity of your staff and follows every application that trusts it: the portal, the tax software, the payroll run, the file drop.
Where clients upload bank statements, W-2s and identity documents and sign engagement letters: authorization between client accounts, share links, password-reset flows and the e-signature integration.
Desktop or hosted tax-software families, the firm's e-file identifiers and the hosted desktops that run them. Stolen preparer credentials are what fraudulent-return rings look for first.
Payroll SaaS used on behalf of clients, direct-deposit change workflows, employee self-service portals and the exports that feed banks: the systems that move money on a fixed date.
Microsoft 365 or Google Workspace with MFA gaps, legacy protocols, forwarding rules and OAuth grants to third-party add-ins; the staging ground for invoice fraud.
RDS farms, virtual desktops and hosting partners that expose logins to the internet, often with single-factor authentication kept for an older application.
Managed file-transfer appliances, SFTP drops, bookkeeping SaaS connected to client bank accounts, shared drives full of exports: the places where a single flaw leaks every client at once.
The chains we walk in an engagement, each step kept as evidence. Client names, hostnames and credentials are tokenized before anything reaches the model.
A fake portal notification during filing season captures a preparer's password and a one-time code. The attacker downloads client returns from the portal and tries the same password on the hosted tax software. Darkmoon tests the reset flows, MFA coverage and credential reuse that make this chain work.
How the engine worksFifty specialist agents and 142 tools behind a build-enforced allow-list, on the scope you authorize. Every finding is qualified EXPLOITED, CONFIRMED or UNCONFIRMED with the request, payload or screenshot that proves it.
MFA coverage and bypass paths, legacy protocols, mailbox rules and OAuth grants, exposed remote-desktop and hosting logins, credential reuse between the tenant and hosted applications.
Authorization between client accounts, document upload and download, password-reset and e-signature flows, payroll self-service portals and the APIs behind the portal and tax-software integrations.
Managed file-transfer appliances and SFTP drops, bank-feed and bookkeeping SaaS integrations, shared-drive permissions, Active Directory paths from a hosted desktop to the file server and backups.
A process designed to be simple for the client and rigorous on the security side.
Not just an automated scan: a structured, validated and debriefed audit.
Vulnerabilities ranked by severity, technical evidence, business impact and prioritized remediation guidance.
Access by email and OTP code. Contractual documents, report and exchanges centralized, available whenever you need them.
A video call with an expert to walk through the findings, answer questions and guide you on the fixes.
The Privacy Gateway tokenizes every sensitive value (IPs, hostnames, URLs, emails, credentials, internal paths) on your machine before anything reaches the model, and rehydrates it locally. Self-host the whole engine with a local LLM, or let our experts run the managed engagement: in both cases the evidence stays in a space you control.
Accounting firms are not a sector listed in NIS2 Annex I or II. Their security duties come from professional secrecy, from data-protection and safeguards rules in the countries where they file, and from clients that are themselves regulated.
Tax preparers and other non-bank financial institutions fall under the FTC Safeguards Rule (16 CFR Part 314). It requires a written information security program and, for information systems, either continuous monitoring or annual penetration testing plus vulnerability assessments at least every six months (§314.4(d)(2)). A documented test is a direct input to that program.
Where the firm processes personal data of EU or UK residents, Article 32 requires appropriate technical and organisational measures and Article 33 requires breach notification within 72 hours. Payroll and shareholder data of client companies are squarely in scope.
In France, art. 21 of ordonnance n° 45-2138 binds chartered accountants to professional secrecy under the penalties of art. 226-13 of the Code pénal, alongside anti-money-laundering reporting duties to TRACFIN. Firms in other jurisdictions carry equivalent confidentiality duties under their professional codes.
A firm serving an essential or important entity may receive supply-chain security requirements under NIS2 Article 21(2)(d): questionnaires, audit clauses, evidence of testing. The directive itself does not list accounting firms. Cyber insurers ask similar questions before quoting.
This section describes the legal context as of October 2026 and is not legal advice: confirm your obligations with counsel and your professional body. Darkmoon does not certify compliance; it produces documented, reproducible findings you can present to partners, insurers, clients or an examiner as part of your evidence base.
Before the filing season, a CPA firm needs testing evidence for its Safeguards Rule program and an answer for a client that asked about supplier security. It orders a managed engagement on its client portal, the hosted desktop farm that runs its tax software, the payroll platform accounts and the Microsoft 365 tenant. Darkmoon finds a portal that lets any logged-in client enumerate other clients' documents, a hosted-desktop login reachable without a second factor, and a shared mailbox with a forwarding rule nobody created on purpose.
Exploited findings with evidence, a debriefed report in the secure client space, a prioritized fix list for the hosting provider, and testing evidence the firm can file with its information security program.
The price is known before payment. No quote, no surprise. Indicative price, adjusted to the final scope. If the scoping call changes the scope and the price, you are told before anything starts.
Legal framework & authorizations included
The Safeguards Rule (16 CFR Part 314) requires a written information security program and, for information systems, either continuous monitoring or annual penetration testing plus vulnerability assessments at least every six months (§314.4(d)(2)). A documented engagement with evidence covers the testing side; it does not replace the written program, risk assessment or staff training the rule also expects.
Accounting firms are not a sector listed in NIS2 Annex I or II. The directive reaches a firm indirectly when a client is an essential or important entity and passes supply-chain requirements down under Article 21(2)(d). Your direct duties come from secrecy rules, GDPR Article 32 where it applies and, in the US, the Safeguards Rule.
Yes, within the intervention window agreed at scoping. Most firms schedule the engagement before the peak; when that is not possible, the scope excludes production payroll runs and e-file windows, and the test is read-only on live client data.
What the firm controls: the hosted-desktop logins exposed to the internet and their second factor, the accounts, roles and credential reuse between your email tenant and the hosted tax software, the protection of the e-file identifiers and the exports that leave the hosting environment. The provider's shared infrastructure stays outside the scope unless the provider authorizes it; the scoping call settles who authorizes what.
The Pentest on Demand flat rate is €799 per engagement, shown upfront and adjusted to the final scope after the scoping call. The timeline is set in the contractual framework and typically runs a few business days after scoping.
A written authorization for the targets in scope (the legal framework you sign at order time), the URLs, hostnames or network ranges to test, test accounts where authenticated testing matters, and a contact for the scoping call. Our experts confirm the scope and the constraints with you before the engagement starts.
Yes. The report is yours. It documents each finding with its evidence, severity and remediation guidance, so it can be handed to a cyber-insurer, a client's procurement team or an auditor as a dated, factual description of what was found. It is evidence, not a certification.
You get a prioritised fix list with the evidence for each finding, a debrief call to walk through it, and the option to retest once the fixes are in. Teams that self-host can schedule recurring campaigns (Pro) so the same checks run after each change; the Pro remediation agent can also open sandbox-validated fix pull requests for your developers to review.
Guided order, legal framework signed online, flat rate shown upfront, report and debrief in a secure client space.
How client names, hostnames and credentials are tokenized before the model sees anything.
Run the engine on your own infrastructure with a local model when client data cannot leave the firm.
Who is listed, who is reached through supply-chain clauses, and where France stands on transposition.
How Darkmoon handles your data, the evidence it keeps and the controls around tool execution.
Privileged files, escrow payments and partner inboxes: the neighbouring profession's attack surface.
Order a managed engagement on your portal, payroll accounts and hosted desktops, or talk to the team about the scope first.