Every login verified. No adviser slowed down.
Client name withheld.A private wealth management firm with three offices- Finance
- S · Who should have access?
A password was all it took, from any device.
Phishing-resistant sign-in, from managed devices only.
Two shared admin accounts that everybody knew.
Every admin action signed by a named person.
Every client folder open to the whole firm.
Each client’s files open to the advisers who serve them.
Context
The firm’s advisers work from its offices, from home and from their clients’ kitchen tables. Their inboxes and client files hold exactly what a fraudster wants: balances, account numbers and the authority to move money.
The problem
- A stolen password would have opened email, the client files and the custodian portal, from anywhere.
- The admin accounts were shared, so nobody could say who had changed what.
- The phishing emails reaching advisers were getting better every quarter.
05.1What we did
The work, service by service.
- Identity & accessSign-in that can’t be phishedPasskeys and hardware keys for everyone, fitted to the risk: strong on client data and money movement, quiet on everything else. Shared admin accounts retired.
- Devices & infrastructureOnly managed devices get inEvery laptop and phone enrolled, encrypted and kept current. A device that isn’t managed can’t reach client data, whoever is holding it.
- Data protection & governanceClient files follow the clientFiles labelled by client and sensitivity, with access tied to the adviser relationship rather than the folder they happen to sit in.
05.2Under the hood
The route it runs along.
- 01Adviser
- 02Verified sign-in
- 03Managed device
- 04Client files
05.3What changed
What is different now.
- A stolen password is no longer enough to get in.
- Every change to the firm’s systems belongs to a person.
- Advisers sign in faster than before, from the devices they already carry.