1st
Formal Security
Assessment
25%
of law firms reported a
security breach (ABA Survey)
security breach (ABA Survey)
$2.9M
average cost of a data
breach in professional services
breach in professional services
#1
wire fraud target by
transaction value
transaction value
43%
of law firms have no
incident response plan
incident response plan
The Threat Landscape
Business Email Compromise & Wire Fraud
BEC attacks targeting real estate closings, M&A transactions, and settlement payments are the highest-financial-impact threat for law firms. Attackers compromise email accounts or spoof attorney addresses to intercept wire instructions and substitute fraudulent account numbers. Funds transferred to fraudulent accounts are rarely recovered.
Client Data & Matter File Theft
Law firms are targeted for client matter files, deal documentation, and litigation strategy: data valuable for insider trading, competitive intelligence, or extortion. Attackers conduct long-dwell intrusions designed to remain undetected while exfiltrating high-value matter files over weeks or months.
Ransomware Targeting Attorney Files
Ransomware groups specifically target law firms because encrypted client files and court deadlines create immediate pressure to pay. Double extortion tactics: encrypting files AND threatening to publish client confidential information: are standard among groups active in the legal sector.
Credential Theft & Remote Access Attacks
Attorneys working remotely and accessing matter management systems from personal devices and home networks create credential exposure. Compromised attorney credentials provide access to client files, communications, and billing systems. Password reuse from personal accounts is a common entry point.
How AI Is Being Used to Attack This Industry
AI-Generated Phishing Targeting Attorneys
AI enables attackers to generate personalized phishing targeting attorneys with emails referencing specific clients, matters, court dates, and opposing counsel: assembled from public court records, bar directories, and LinkedIn. These attacks are far more convincing than generic phishing and specifically target wire instruction intercepts.
Deepfake Voice Impersonation of Clients
AI voice cloning is being used to impersonate clients in calls to their attorneys: providing fraudulent instructions for fund transfers, settlement authorizations, or document releases. An attorney receiving a call from a familiar voice with specific matter knowledge may act on fraudulent instructions without verification.
AI-Powered Document Extraction
AI tools can rapidly identify and exfiltrate high-value documents from compromised document management systems: automatically classifying files by deal type, client, and value to prioritize the most sensitive matter files for extraction. This compresses the attacker's dwell time needed to collect valuable intelligence.
AI-Enhanced Business Email Compromise
AI makes BEC attacks more convincing by enabling attackers to match writing styles of compromised email accounts, generate contextually accurate wire instruction changes, and time interventions to match the actual closing schedules of transactions in progress.
How We Help
BEC & Wire Fraud Prevention
We implement DMARC/DKIM/SPF email authentication, anti-phishing controls, and out-of-band wire instruction verification procedures: the combined technical and procedural controls that prevent wire fraud.
Learn MoreClient Data & Matter File Protection
We implement access controls, encryption, and DLP policies for matter management systems: ensuring only authorized personnel access specific matters and client data cannot leave the firm inappropriately.
Learn MoreSecurity Assessment & Ethics Compliance
We assess your security program against ABA Model Rule 1.6 requirements and applicable state bar guidance: producing the documentation needed to demonstrate reasonable security to clients and bar associations.
Learn MoreRemote Access & Endpoint Security
We implement secure remote access, MFA, and endpoint security appropriate for attorney workstations: including mobile device management for attorneys accessing matters from personal devices.
Learn MoreRFP Security Response Support
We build the security documentation library and questionnaire responses that enable your firm to answer corporate client security requirements: turning security from a sales obstacle into a competitive advantage.
Learn MoreSecurity Awareness Training for Legal Staff
We deliver security awareness training specific to legal environments: phishing recognition, wire fraud procedures, secure client communication, and data handling: designed for busy attorney schedules.
Learn MoreHow We Use AI to Protect You
AI-Powered Email Security
We deploy AI-powered email security that analyzes message content, sender behavior, and communication patterns to detect BEC attempts and impersonation attacks that signature-based filters miss: including AI-generated phishing crafted to match attorney writing styles.
Anomalous Matter File Access Detection
Machine learning baselines normal document access patterns for each user and matter: alerting when unusual bulk access, off-hours activity, or access to unrelated matters suggests credential compromise or insider exfiltration.
Wire Instruction Verification Automation
We implement AI-assisted wire instruction verification workflows that flag changes to payment instructions, require out-of-band confirmation, and alert on communication patterns consistent with BEC interception.
Threat Intelligence for Law Firms
AI-driven threat intelligence monitors for law firm credentials on criminal forums, tracks ransomware groups active against the legal sector, and provides early warning when your firm's email domains appear in phishing infrastructure.
Regulatory & Compliance Requirements
ABA Model Rule 1.6: Confidentiality
ABA Model Rule 1.6(c) requires lawyers to make reasonable efforts to prevent unauthorized disclosure of client information. ABA Formal Opinion 477R provides guidance on securing client communications. State bars increasingly require documented security programs, encryption, and staff training.
View ServicesState Breach Notification Laws
All 50 states require notification to affected clients when their personal information is compromised in a breach. State bar rules in many jurisdictions also require notification to affected clients when their confidential information is exposed. Law firms must be prepared to meet both sets of obligations.
View ServicesClient Contract Security Requirements
Large corporate clients increasingly include security requirements in engagement letters and outside counsel guidelines: requiring MFA, encryption of client data, security awareness training, and incident notification procedures. Firms without documented security programs face growing friction in client retention and new business.
View ServicesCyber Insurance Requirements
Cyber insurance policies for law firms increasingly require MFA, endpoint protection, backup procedures, staff training, and incident response planning as conditions of coverage. Firms without these controls face coverage denial after a breach or premium rates that assume the worst.
View ServicesWhy Organizations Choose garrisonOne
- Legal-Specific Security Expertise: We understand the data types, client relationship dynamics, and ethics obligations that make law firm security distinct from corporate programs.
- Client RFP Security Support: We help firms build security documentation and responses that large corporate and institutional clients expect in security questionnaires.
- Wire Fraud Prevention as Core Focus: BEC wire fraud is the defining financial cyberthreat for law firms. We address it technically and procedurally in every engagement.
- Bar Association Requirement Mapping: We map controls to ABA and state bar guidance so the security program demonstrates ethical compliance.
- Right-Sized for Firm Size: We work with solo practitioners, boutique firms, and AmLaw 200 firms: programs scaled to actual risk and budget.
- Breach Response When You Need It: If an incident occurs, we can respond. An established relationship before an incident means faster containment and better outcomes.
Case Study: Law Firm Security Assessment
Law Firm Security Assessment: Building the RFP Security Response
A mid-size law firm was losing RFP opportunities because they could not answer client security questionnaires. garrisonOne conducted a formal security assessment, built their information security program, and created the documentation library that now supports every security RFP response.
Read the Full Case Study1stFormal Security
Assessment
2New Clients
Won on Security
100%RFP Security
Questions Answered
Our clients started asking about security in RFPs and we had no answers. garrisonOne built our security program and the documentation that answers every questionnaire we receive. We closed two large clients that year partly on the strength of our security posture.
Related Services: Penetration Testing | Compliance Services | Identity & Access Management | Managed SOC | Cloud Security | All Industries
See How We Have Helped Similar Organisations
IAM Overhaul for Professional Services Firm
Professional Services: Automated offboarding and MFA across all systems
Read Case StudyFrequently Asked Questions
Why are law firms targeted by cybercriminals?
Law firms hold valuable data on behalf of clients: M&A deal information, litigation strategy, financial details: and often have weaker security than their clients. Attackers target firms to obtain data for insider trading, competitive intelligence, extortion, or to intercept wire transfers in closings.
What do ABA ethics rules require for cybersecurity?
ABA Model Rule 1.6(c) requires reasonable efforts to prevent unauthorized disclosure of client information. ABA Formal Opinion 477R provides specific guidance on securing client communications. Many state bars have issued additional guidance trending toward requiring documented security programs.
What is BEC wire fraud in the legal context?
In law firms, BEC typically targets wire transfers in real estate closings, M&A transactions, and settlement payments. Attackers compromise email accounts or spoof attorney addresses to intercept wire instructions and substitute fraudulent account numbers. Funds transferred to fraudulent accounts are rarely recovered.
What should we include in a client security questionnaire response?
Client questionnaires typically ask about encryption, access controls, breach notification procedures, security training, third-party oversight, and incident response. A documented information security program with annual assessments, MFA, encryption, and a breach notification procedure covers the majority of requirements.
Do law firms need cyber insurance?
Cyber insurance is highly recommended: law firms are attractive targets and a breach results in significant forensic, notification, and litigation costs. Insurers increasingly require MFA, endpoint protection, backups, and security training as conditions of coverage.
How should a law firm respond to a data breach?
Immediate steps: contain the compromise; conduct forensic investigation to determine what was accessed; notify affected clients per applicable breach notification laws and bar association rules; notify malpractice and cyber insurers; and conduct a post-incident review.
Can a small law firm afford a proper security program?
Yes: security programs for small firms do not require enterprise-scale investment. The highest-impact controls for small firms are MFA for all systems, endpoint protection, encrypted email, secure document sharing, and staff training. We build programs scaled to small firm resources that address the actual risks.
What is the biggest security risk for law firms?
Business email compromise targeting wire transfers is consistently the highest-financial-impact threat. Email account compromise enabling unauthorized access to client matter files is the most common cause of confidentiality breaches. Both are preventable with the right technical and procedural controls.
Resources
Company
Contact
- US: 4752 Euclid Rd Suite 11,
Virginia Beach, VA 23462 - India: Orchard Street, Sector 61,
Gurgaon, Haryana - Phone: (301) 825-5518
- info@garrisonone.com
