IT and security for law firms, accountants and advisors.
We protect client confidences, keep attorneys and staff working from the office, home or court, and help you answer the security questions clients and insurers send you.
A 15-minute call with an engineer who works with law firms.
Trusted by
Sound familiar?
What we hear from law firms.
A firm sells judgment and discretion. Most of that work happens in email and documents, which is exactly where attackers look.
01
The inbox is the case file.
Privileged advice, drafts, filings, medical records and settlement figures all travel by email. If one mailbox is opened by the wrong person, every matter in it is exposed.
02
Clients now check your security.
Business clients and insurers send security questionnaires before they hire or renew. They ask about MFA, encryption and how you would tell them about a breach. A vague answer can cost you the engagement.
03
Nobody bills for IT, so nobody owns it.
Partners have no time for it, and the office manager ends up as the admin by default. Passwords get shared, old staff keep access, and the server in the closet has not been checked in years.
Know what you are up against
The attacks that actually hit law firms, explained.
You don't need to know how hackers work. It helps to know what an attack looks like when it reaches you, why firms are a good target, and the habit that stops most of it.
The attackWhat it looks likeWhy firms get hitWhat stops most of it
01
A fake document link
Called phishing
What it looks like
An email says opposing counsel, a client or a court service shared a file. The link opens a sign-in page that looks real. Whoever types their password there hands over their mailbox.
Why firms get hit
Attorneys and staff open outside documents all day, often under deadline. One more shared file looks like routine work.
What stops most of it
MFA on every account, so a stolen password alone doesn't work. MFA means a second check, like a code on your phone, when someone signs in.
02
Changed settlement instructions
Called business email compromise, or BEC
What it looks like
Right before a settlement or closing pays out, an email asks you to send the funds from your client trust account to a new bank account. It looks like it came from the client or the other side's counsel.
Why firms get hit
Firms hold client money in trust accounts and send it out on dates other people know about. The amounts are large and the thread is full of outside parties.
What stops most of it
Call to confirm any change to payment instructions, using a phone number you already have on file.
03
Ransomware and data theft
Files locked, and a threat to publish
What it looks like
Documents stop opening and a note demands payment. The attacker often copied client files first and threatens to publish them or contact your clients directly.
Why firms get hit
Confidential files are worth a lot to a firm, and court deadlines don't move. That pressure makes firms more likely to pay.
What stops most of it
Backups kept where ransomware can't reach them and tested, plus EDR on every computer. EDR is software that spots attacker behavior and stops it.
04
Access that outlives the job
Former staff, contract attorneys, experts
What it looks like
A contract attorney, an expert witness or a former paralegal can still open the matter folder or the shared mailbox months later. Nobody notices because nothing breaks.
Why firms get hit
Firms bring in outside help for each matter, and removing it is nobody's job once the case ends.
What stops most of it
Access granted by matter, with an end date, and a review when the matter closes.
James, attached are the revised terms we discussed, with our edits to section 4. Please review and sign before 5 PM today so we can file tomorrow.3
The file is too large to attach, so I shared it through our secure portal.4
Nora
Sign in to view document
Illustration. The names, firms and matter are made up.
Up close
What a fake document link looks like.
This email does not ask for money. It asks for a password, which is often how the money request starts later. Here is how to read it.
1The address has one extra dash. The real firm is caldwellross. This one is caldwell-ross. One small mark, and a completely different owner.
2The subject matches real work. Settlement papers, signature pages, a filing. It looks like the next step in a matter that is really happening.
3The deadline is today. A same-day deadline pushes people to click first and think later.
4The button leads to a fake sign-in page. It asks for your email password. A real document from someone you work with rarely needs you to sign in again.
The habit that stops it: if a link asks for your password, close it and open the document from the app or site you normally use. When in doubt, call the sender at a number you already have.
About 68%
of breaches involved a non-malicious human element, such as a person falling for a fake email or making an error.
Source: Verizon 2024 Data Breach Investigations Report (DBIR).
Check your exposure
Check your exposure in 60 seconds.
Seven yes-or-no questions about how your firm works today. You'll see where you stand, and the three moves that would help most.
01
Does everyone, including partners, use MFA on email and remote access?MFA is a second check when someone signs in, like a code on their phone.
02
Before trust account funds go out, does someone call to confirm the account?Using a number you already have, not one from the email.
03
Are backups tested, and stored somewhere ransomware can't reach?“Tested” means someone restored files from them in the last few months.
04
Do you have a simple way to send sensitive documents securely?Encrypted email or a secure link, used without a second thought.
05
When a matter ends or someone leaves, is outside and staff access removed?Contract attorneys, experts, former staff, shared mailboxes and client portals.
06
Are laptops and phones that hold client files encrypted and able to be wiped remotely?Including personal phones that get firm email.
07
Do you have a written breach plan that covers telling clients?Who calls IT, the insurer and outside counsel, and who decides what clients hear.
Nothing you click here leaves your browser.No email, no form.
IT across the life of a matter
From intake to the archive.
Every matter brings new people, new documents and new deadlines. Pick a stage to see what tends to go wrong there and what we put in place.
Intake
A prospective client shares their story and documents before you have even run a conflict check. Some of it is the most sensitive information you will see.
What can go wrong
Intake forms and attachments land in a general inbox that many people can read.
A fake “new client” sends a malicious attachment to get a foothold.
What we set up
A secure intake form or upload link, with access limited to the people who need it.
Email filtering that checks attachments and links before anyone opens them.
Engagement
The engagement letter goes out, the retainer comes in, and the matter gets its folders. Whatever access is set now tends to stay that way.
What can go wrong
Fake payment instructions reach the client, so the retainer goes to an attacker.
Every matter folder is open to everyone in the firm.
What we set up
Email settings (SPF, DKIM and DMARC) that prove mail from your domain really came from you, plus a line telling clients to call before paying.
A standard matter folder with access set by team, and walls for sensitive matters.
Case work
The longest stretch. Large document sets come and go, experts and contract attorneys join, and work happens at home and on the road.
What can go wrong
Discovery files get shared through personal accounts because they are too big for email.
A laptop with case files is lost on the way to a deposition.
What we set up
Secure sharing for large files, with links that expire and a record of who opened them.
Managed laptops and phones: passcode, encryption and remote wipe.
Guest access for experts and contract attorneys that ends on a set date.
Court or closing
Everything has to work on one specific day. Filing portals, remote hearings and the laptop at counsel table.
What can go wrong
A ransomware attack or an outage the week of trial.
Remote hearings on a home network or a laptop that has missed months of updates.
What we set up
Tested backups, so you can restore what you need before a deadline.
Updates installed automatically, and a quick device check before big days.
Settlement and payment
Funds come into the client trust account and go back out to clients, lienholders and other parties. This is what fake payment emails are built for.
What can go wrong
Changed payment instructions arrive by email the day before payout.
One person can both enter a new account and release the funds.
What we set up
A call-back rule for any new or changed account, using a number already on file.
Two-person approval in the banking portal, with MFA for both people.
Archive
The matter ends, but the file has to be kept for years and found quickly if the client or a court asks.
What can go wrong
Outside users still have access to a closed matter.
Old files sit on a drive no one backs up, or in a format that no longer opens.
What we set up
An access review at closing: outside users removed, and we show you the list.
Closed files kept for your retention period, encrypted and searchable, with a yearly restore test.
Software we already support
Keep the tools you already use.
You picked your practice software for good reasons. We look after the accounts, access, backups and connections around it, so it stays secure without slowing down billable work.
ClioPractice management
Staff logins with MFA, client portal access, and removal when someone leaves.
MyCasePractice management
User roles, MFA, and a check on who can see billing and trust records.
Adobe AcrobatPDFs, redaction and signing
Licenses, installs, and training so redactions actually remove the text underneath.
QuickBooksAccounting
Separate logins for each person, MFA, and a check on who has admin rights.
Microsoft 365Email, files and Teams
MFA, email filtering, encrypted email, shared mailboxes and backups of mail and files.
Using something else? Ask on the call, and we will tell you honestly what we can look after.
Clients, insurers and the bar
Questions your clients and insurer will ask, and the honest answers.
Several of these trace back to the ABA Model Rules of Professional Conduct and ABA formal opinions. Each state adopts its own version of the rules, so check yours. Clients and insurers ask the same questions in their own words.
What it means
Comment 8 to ABA Model Rule 1.1 says lawyers should keep up with the benefits and risks of relevant technology. In practice, someone at the firm should know what tools you use and where they could fail.
How we get you to yes
We give partners a short, plain-English review of your systems and risks each year, so the firm can show it is paying attention.
What it means
ABA Model Rule 1.6(c) asks lawyers to make reasonable efforts to prevent unauthorized access to client information. Clients want to hear what those efforts are.
How we get you to yes
MFA, encryption, access by matter, EDR on every computer and tested backups, written down in a short summary you can share with clients.
What it means
ABA Formal Opinion 477R (2017) discusses securing communications of client information. For some matters, plain email may not be enough, and the firm should think about when to use more protection.
How we get you to yes
We set up encrypted email and secure links, and agree with you on which kinds of documents always go that way.
What it means
ABA Formal Opinion 483 (2018) covers lawyers' obligations after a data breach, including stopping it, finding out what happened, and telling current clients when their information is affected.
How we get you to yes
We write an incident plan with you, with who calls whom and who decides what clients hear, and walk your team through it once.
What it means
When someone signs in, they need a second check beyond the password, like a code or a prompt on their phone. Insurers ask because a stolen password alone is then not enough to get in.
How we get you to yes
We turn it on for every account, including partners and shared mailboxes, and give you a report that shows it is enforced.
What it means
Immutable means a backup can't be changed or deleted, even by someone with an admin password. Tested means someone actually restored files from it recently.
How we get you to yes
We set up a protected copy, run a restore test, and write down the date and result for your records.
What it means
Before anyone sends trust account money to a new or changed account, they call the person at a number already on file, and a second person approves.
How we get you to yes
We help you write the policy, train whoever releases funds, and tag emails from outside the firm so look-alikes stand out.
We run IT and security for law firms and professional practices across Southern California.
Yes. Send it before the call. We will tell you which answers are already yes, which are quick fixes and which need more planning. Every yes we help you give comes with evidence you can attach.
We are engineers, not your ethics counsel. We can explain what the ABA Model Rules and formal opinions talk about in technical terms, and put the matching controls in place. Your state bar's version of the rules and your own counsel have the final word.
Most likely. We look after Clio, MyCase, Adobe Acrobat, QuickBooks and Microsoft 365, and the accounts, access and backups around them. For anything else, ask on the call and we will tell you honestly what we can do.
Yes. The risks are much the same: sensitive client files, money moving on known dates, and clients who ask about your security. Tax season adds seasonal staff and a flood of documents, which we plan for.
You talk to an engineer. Tell us how your attorneys and staff work and what is worrying you. You will leave with at least one thing worth fixing, whether or not we work together. We come on site when the job needs it.
