Why security is part of the practice
Rule 1.6(c) of the ABA Model Rules asks lawyers to make reasonable efforts to prevent unauthorized access to client information. ABA Formal Opinion 477R explains that what's reasonable depends on factors such as how sensitive the information is, how likely a disclosure is without more safeguards, and the cost and difficulty of adding them. Formal Opinion 483 adds that lawyers should monitor for breaches, act promptly when one happens and tell current clients when material confidential information is likely involved.
In practice, that means a firm should be able to explain what it does to protect client data and show that it actually does it. We help you build that, and we keep a written record of it.
Business email compromise and wire fraud
Business email compromise is one of the costliest crimes the FBI tracks. Its 2025 Internet Crime Report lists about $3.05 billion in reported losses. Law firms are attractive targets because they send and receive large payments: settlement funds, closing proceeds, retainers and trust account disbursements.
The pattern is usually the same. A criminal steals an email password, often through a fake sign-in page. They read the mailbox quietly for days or weeks. When a payment is coming, they send new wire instructions from the real account, or from a lookalike address, at exactly the right moment. The message looks normal because it is built from real conversations.
How we reduce that risk
- Multifactor authentication on every email account and remote sign-in, using methods that resist phishing where possible.
- Email filtering that catches impersonation, lookalike domains and malicious links before they reach an inbox.
- Mailbox monitoring for warning signs such as sign-ins from unusual places and hidden forwarding rules.
- Domain protection with SPF, DKIM and DMARC, so criminals have a harder time sending email that appears to come from your firm.
- A written verification procedure for any change to payment instructions: call back on a known number, never one from the email. We help you write it and train staff on it.
Protecting devices and data
- Endpoint protection on every computer, watched by our team, so threats are caught and contained instead of discovered weeks later.
- Encryption on laptops and mobile devices, so a lost bag at the courthouse isn't a data breach.
- Patching of operating systems and applications on a schedule, with reporting so you know it happened.
- Access controls that give each person what they need, with ethical walls and restricted matters handled through permissions, not trust.
- Security awareness training in short sessions with realistic phishing tests, aimed at attorneys and staff alike.
When something does go wrong
Every firm should have a short incident response plan before it needs one. We help you write it: who to call, how to preserve evidence, when to bring in your cyber insurer and outside counsel, and how to think about client notice under Formal Opinion 483 and applicable breach notification laws. If an incident happens, our engineers work to contain it and restore systems while your firm makes the legal decisions.
Answering clients and insurers
Corporate clients and cyber insurers increasingly send security questionnaires. We help you answer them accurately, based on what is configured in your environment. If a question exposes a gap, we tell you what it would take to close it.
We also review your security with firm leadership on a regular schedule. Threats change, staff come and go, and new tools get added. A short, recurring review keeps your protections current and gives partners a clear picture without technical jargon.
Questions about cybersecurity
Will MFA slow our attorneys down?
Very little, when it's set up well. Most sign-ins on a firm-managed device are remembered, and approvals happen on a phone in a few seconds. The protection it adds to email is worth far more than the time.
Can you tell us whether we have to notify clients after a breach?
That is a legal decision for the firm and its counsel. We provide the technical facts: what was accessed, when and how. That gives you what you need to apply Formal Opinion 483 and any notification laws.
