Protect the firm’s email domain
Check direct spoofing and email-domain protection
Check SPF, DKIM, and DMARC, understand enforcement gaps, and learn what evidence to request about your firm’s email-domain protection.
Read this firstResources
Practical cybersecurity guidance for law firms
Read plain-language guidance on email security, wire fraud, public exposure, and the controls clients and insurers ask about.
Office manager’s checklist
Verify the safeguards that protect your firm’s work.
Assign an owner, request evidence, and record what is working, needs attention, or remains unverified.
Start here
Five practical tasks for busy law-firm decision-makers.
If you do not want to sort through every article, begin with the five topics that often shape a first conversation: domain protection, client evidence, Microsoft 365 verification, employee offboarding, and staff readiness.
Respond to a client questionnaire
Gather evidence before checking the box
A practical guide to answering client security questionnaires with evidence, clear ownership, and honest statuses for law firms.
Read this firstVerify Microsoft 365 safeguards
Review sign-ins, sharing, forwarding, and recovery evidence
A practical Microsoft 365 security checklist for small law firms: ask for evidence of sign-in protection, access, sharing, forwarding, logs, and recovery.
Read this firstOffboard an employee
Remove access and hand over client records
Assign departure tasks and record completion with a free printable PDF and editable CSV worksheet. No email or sign-in required.
Read this firstTest staff readiness
Measure reporting and follow-up, not just completion
Learn how law firms can test phishing readiness, support staff reporting, document results, and choose a managed campaign without overstating what one exercise proves.
Read this firstPut staff readiness into practice
Help your team practice the safer response.
Choose online cybersecurity training for lawyers and staff through weekly email challenges. For authorized simulated emails and campaign reporting, choose managed phishing testing.
Latest posts
Browse the full resource library
2026-10-30
Baker McKenzie and Troutman Pepper Locke Data Breaches: Lessons for Law Firms
Baker McKenzie and Troutman Pepper Locke data breach notices describe social engineering and released documents. What law firms should verify and practice.
Read article2026-10-28
Law Firm CybersecurityLaw Firm Cyberattacks: Less Time to Protect Client Files
Reuters highlights rising law firm cyberattacks. New research shows why firms should verify remote access, client-file permissions, and incident response now.
Read article2026-10-26
Your Law Firm May Hold Sensitive Data on People Who Never Hired You
A law firm breach affected health information tied to nearly 197,000 people. Learn what firms should verify about sensitive client-supplied data.
Read article
2026-10-26
ResourcesSigns Your Law Firm Needs a Cybersecurity Assessment Now
Learn seven signs your law firm may need an assessment, what it reviews, how the process works, and what an independent report can—and cannot—show.
Read article2026-10-24
ResourcesHow to Evaluate AI Tools for Your Law Firm Before Uploading Client Documents
Evaluate the exact AI product and account tier, data terms, permissions, human approvals, vendor evidence, and pilot conditions before using client information.
Read article2026-10-24
ResourcesLaw Firm Cybersecurity Checklist: What Your Office Manager Should Verify
A practical law firm cybersecurity checklist for verifying accounts, staff departures, email, client files, payments, training, recovery, and evidence.
Read article2026-10-24
ResourcesMicrosoft 365 for Law Firms: What to Check Before Sharing Client Files
Before sharing a client file in Microsoft 365, verify intended recipients, guest access, link scope, expiration, permissions, downloaded copies, and matter confidentiality.
Read article
2026-10-21
Vulnerability AlertYour WordPress Site Can Be Fully Updated and Still Vulnerable
A PHP vulnerability can put a law firm website at risk before disclosure. Learn how to verify the patch and investigate activity dating back to Oct. 17.
Read article2026-10-16
That Court Filing Email Could Be a Trap: A Law Firm Verification Checklist
Fake court filing notices can lure law firm staff to malicious websites. Use this checklist to verify filings through PACER or CM/ECF and report suspicious emails.
Read article2026-10-11
Law Firm CybersecurityFake IT Support Calls: A Law Firm Callback Script and Verification Checklist
Use an independent callback, ready-to-use scripts, a printable checklist, and a private support-contact worksheet before granting remote access.
Read article2026-10-08
Law Firm CybersecuritySheppard Mullin Breach: Why Document Requests Need Verification
Sheppard Mullin says one attorney was deceived into disclosing documents. Learn how small law firms can verify requests and reduce the risk of data theft.
Read article2026-10-05
ResourcesLaw Firm Employee Offboarding Checklist: Access and Records
A practical law-firm offboarding checklist to remove access, preserve client records, and verify completion—with a worksheet for owners and office managers.
Read article2026-10-02
Law Firm Incident Response Plan Template
Know who to call and what to do when your firm faces a cyber incident. Get a free 17-page fillable plan with response checklists, worksheets, and a practice exercise.
View PDF resource2026-09-28
Law Firm CybersecurityMFA for Law Firms: How to Verify Account Protection
Learn how law firms enforce MFA for attorneys, verify account and app coverage, document exceptions, and prepare evidence for cyber insurance questions.
Read article2026-09-26
Wire Instruction Verification Checklist for Law Firms
Verify wire instructions before sending settlement or closing funds. A practical law-firm checklist for callbacks, payment approval, records, and fraud response.
Read article2026-09-22
ResourcesLaw Firm Security Questionnaires: What Evidence to Gather
A practical guide to answering client security questionnaires with evidence, clear ownership, and honest statuses for law firms.
Read article2026-09-22
ResourcesMicrosoft 365 Security Checklist for Small Law Firms
A practical Microsoft 365 security checklist for small law firms: ask for evidence of sign-in protection, access, sharing, forwarding, logs, and recovery.
Read article2026-09-20
ResourcesYour Law Firm’s Next Fake Client Email May Be Flawless
AI makes impersonation more convincing and raises new client-data risks. Learn how law firms can verify safeguards, train staff, and secure their use of AI.
Read article2026-09-15
Law Firm CybersecurityYour Law Firm's Client Files Could Become Someone Else's Bargaining Chip
Three groups have named U.S. law firms in reported extortion claims. Learn what is known and what your firm should ask about protecting client files.
Read article2026-09-13
Phishing Training for Law Firms: What to Test and Measure
Learn how law firms can test phishing readiness, support staff reporting, document results, and choose a managed campaign without overstating what one exercise proves.
Read article2026-09-11
Data SecurityYour Law Firm’s Network Wasn’t Breached. Could Its Documents Still Reach the Dark Web?
Client documents can be at risk beyond your office network. Learn what law firms should verify about cloud access, sharing links, and account security.
Read article2026-09-08
Website SecurityLaw Firm WordPress Security: What Two Exploited Flaws Mean for Your Website
Two serious WordPress vulnerabilities show why law firms should verify plugin versions, patch status, and website ownership with their providers.
Read article2026-09-04
Quinn Emanuel and McDermott Breaches: One Account Can Be Enough
Quinn Emanuel and McDermott reported social engineering breaches involving one user. Here is what smaller law firms should verify now.
Read article
2026-09-03
Law Firm CybersecurityWe Found Your Law Firm's Remote Desktop Online – Will a Hacker Be Next?
A public Remote Desktop login can expose a path toward client data and firm systems. See what we found – and what your firm should do next.
Read article2026-09-03
Law Firm CybersecurityYour Law Firm’s VPN Is Supposed to Keep Attackers Out. What If It Is the Door They Use?
A law firm VPN can expose the systems it is meant to protect. Learn why ransomware groups target VPNs and what your firm should ask its MSP.
Read article2026-08-31
Vulnerability AlertRunning Exchange or SharePoint On-Premises? What Your Law Firm Should Check
Check whether your law firm still operates on-premises Exchange or SharePoint, confirm versions and patches, and ask your IT provider for evidence.
Read article2026-08-28
ResourcesLaw Firm AI Policy: What to Include + Sample Language
Build a practical law firm AI policy covering approved tools, information, human review, supervision, incident reporting, ownership, acknowledgment, and review triggers.
Read article2026-08-27
What Is External Attack Surface Management (EASM) for a Law Firm?
Learn how External Attack Surface Management helps law firms discover Internet-facing assets, identify exposures, and monitor newly relevant vulnerabilities.
Read article2026-08-26
ResourcesDMARC for Law Firms: Check Your Email Domain Protection
Learn how law firms should verify SPF, DKIM, and DMARC, stage enforcement safely, and request evidence about direct email spoofing risk.
Read article2026-08-25
Law Firm Ransomware and Business Email Compromise: The New Attack Pattern
Law firm ransomware and business email compromise are converging. Learn how attackers profile firms before using social engineering, impersonation, and extortion against law firms.
Read article2026-08-24
ResourcesAI Operations for Law Firms: A Practical Guide to Redesigning the Client Lifecycle
Learn how law firms can turn isolated AI use into controlled workflows for intake, client communication, matter work, operations, billing, and growth.
Read article2026-08-22
Attorney Incident Response: Your First 72-Hour Playbook
A 72-hour attorney incident response playbook for law firms. Contain the incident, preserve privilege, map notice deadlines, and document every step the right way.
Read article2026-08-22
ResourcesMicrosoft 365 Data Protection for Law Firms: DLP, Labels, and Sensitive Data
Set up Microsoft 365 DLP, Purview labels, and sensitive information types so client data is protected before it leaves your firm.
Read article2026-08-21
ResourcesCyber Insurance for Law Firms: How to Verify Application Answers
Use the insurer's exact wording to verify cyber insurance application answers, define scope, record dated evidence, and disclose exceptions.
Read article2026-08-21
What Is a Lookalike Domain? Why Your Law Firm Should Be Concerned
A lookalike domain can cost an attacker about $15 and ten minutes to register, but it can cost your firm a wire transfer. Learn how the scam works and what to check.
Read article2026-08-19
The Bots Scanning Your Law Firm's Website Aren't Just Bots Anymore
AI agents now scan law firm websites and DNS records for weaknesses at machine speed. See what's actually out there right now, and what to check first.
Read article2026-08-19
One Device, 57,000+ Records, and a Lawsuit That's Still Growing
Fox Rothschild's breach came from a single compromised device in May. The resulting class action is still expanding in August. Here's what that gap says about incident response planning.
Read article2026-08-19
A Law Firm Offered $520,000 to Stop the Leak. It Got Posted Anyway.
Luna Moth's law firm leak site now includes firms far smaller than WilmerHale and Goodwin Procter. Here's what that means if your firm isn't AmLaw 100.
Read article2026-08-18
Ransomware Protection for Law Firms: What Actually Works (and What Backups Can't Fix)
Learn how law firm ransomware attacks begin, why backups cannot undo stolen data, and which practical controls help firms reduce risk and prepare.
Read article2026-08-17
A Town Lost $545,000 Over One Swapped Letter in a Domain Name
A South Carolina town paid $545,598 to a scammer using a typosquatted domain and a hijacked email thread. Here's the exact playbook – and the controls that stop it.
Read article2026-08-16
WilmerHale Data Breach: What Law Firm Leaders Should Learn
What the WilmerHale data breach teaches law firms about impersonation, sensitive data requests, and independent verification.
Read article2026-08-14
When BigLaw Pays $46 Million, Your Five-Attorney Firm Is the Easier Target
A cyber-extortion group took $46 million from BigLaw firms without deploying ransomware. Here's how the attack works and what small firms can do about it.
Read article2026-08-12
ResourcesMigrating Your Law Firm to Microsoft 365: The Security Checklist Most Firms Skip
Migrating your law firm to Microsoft 365? Discover why default cloud settings leave client data exposed and how to harden your tenant for ethics and compliance.
Read article2026-08-08
ResourcesMicrosoft Copilot Risk for Law Firms: Permissions, Oversharing, and Ethical Walls
Before turning on Copilot, law firms should check SharePoint oversharing, broken inheritance, and ethical-wall gaps. This is how AI exposes permission problems that used to stay hidden.
Read article2026-08-03
What Law Firm Cybersecurity Rules Actually Require - and Where Most Firms Fall Short
Learn which cybersecurity rules and regulations actually apply to law firms, why generic checklists fall short, and what controls insurers and clients expect.
Read article2026-08-02
How Law Firms Get Hit by Wire Fraud – Even When No One Was Hacked
Learn how law firm wire fraud and business email compromise attacks happen, why email spoofing and public exposure matter, and what controls reduce risk for law firms.
Read articleWant something specific?
Request the review first, then we'll point you to the right next step
2 minutes. No internal access. No passwords.
The fastest way to make future resources useful is to understand your actual exposure first. Submit your domain and matching work email, then confirm the request from that inbox.