Phishing Training for Law Firms: What to Test and Measure

Get your free Zero-Access Exposure Review™ | See Cybersecurity Awareness Training

An email says a document is ready for review. A caller says they need to fix an account. A vendor asks someone to resolve a charge.

Before anyone sees a ransom demand, someone may face a simpler decision: Should I trust this request?

For a small law firm, that decision may fall to a busy attorney, legal assistant, receptionist, or office manager. Preparing those people deserves a place alongside technical controls.

Recent law firm breaches make the issue timely. They also show why ransomware readiness must account for stolen documents and compromised accounts, even when computers remain operational.

Why phishing readiness matters for law firms

The first sign of a ransomware incident is rarely a lock screen. More often, it starts with a request that looks routine: a shared document, an account notice, a payment change, or a phone call from someone claiming to be IT.

A law firm can do everything right on paper and still be exposed if a staff member makes a rushed decision under pressure. That is why phishing readiness belongs in the same conversation as backups, MFA, and incident response.

What recent law firm breaches tell us

On September 3, 2026, Reuters reported breaches at Quinn Emanuel and McDermott involving social engineering. Quinn described access through one temporarily compromised account, and McDermott said its incident affected a single user. Those examples show how a narrow compromise can still expose sensitive files. Reuters reporting.

On September 10, Reuters reported that Greenberg Traurig said an unauthorized actor obtained a limited number of documents and posted them on the dark web. The firm said its systems were not compromised. The public account did not establish phishing as the entry point. Reuters reporting.

These reports do not show that every incident involved ransomware, the same attacker, or the same technique. The practical lesson is consistent: protecting client information requires attention to the people and accounts that can access it, as well as the systems storing it.

Ransomware, data extortion, and phishing are related, but not the same

Ransomware commonly encrypts files and demands payment. Data extortion can involve stealing information and threatening to disclose it without encrypting anything. An attack can involve both. Phishing is one route into an organization, not a synonym for either outcome.

The FBI's advisory on Silent Ransom Group, also known as Luna Moth, describes targeting of U.S. law firms, including callback phishing. A fake subscription notice prompts a call; the subsequent interaction can lead to remote access, data theft, and an extortion demand. The advisory also addresses impersonation of IT support. FBI advisory.

For partners, the distinction matters. Restoring your own files does not recover copies already stolen by an attacker.

That is why staff preparation should cover more than spotting typos. It should include requests to sign in, disclose information, approve access, install software, and move a conversation to a phone call.

Three fictional legal-workflow examples

These short examples are fictional teaching scenarios. They show recognition and verification, not how any named firm was attacked.

Shared client document: A message says a client shared a settlement folder and asks the recipient to sign in again. The cue is an unexpected sign-in page and pressure to act. The response is to open the known client portal or confirm with the client through a trusted channel, then report the message.

Apparent payment change: A familiar vendor asks the firm to use new wire details before a closing. The cue is a payment change delivered through one channel. The response is to pause and use the firm’s independent, second-channel payment verification process.

Impersonated IT request: A message or call claims that IT needs an approval or remote-access step immediately. The cues are urgency and an unverified contact path. The response is to contact the known IT provider or internal administrator using a saved number and report the request.

These are fictional discussion examples, not customer results or proof of how a named firm was attacked. They teach decisions; they are not all included product modules. A phone call from fake IT is a discussion scenario, not a live phone test. Neither service collects real passwords.

What should law firm staff practice recognizing?

Start with the decisions people actually make during the workday. These examples are illustrative, not claims about how the firms named above were breached.

• A shared document requires a fresh sign-in: confirm the request through a known channel before entering credentials into an unexpected page.
• An urgent account notice asks for approval: verify through the firm's established support process before approving an unexpected authentication prompt.
• A subscription notice provides a cancellation number: check the supposed charge independently rather than relying on contact details supplied in the message.
• A caller claiming to be IT requests remote access: contact the known IT provider or internal administrator through a verified number before granting access.
• An apparent partner or vendor changes payment instructions: follow the firm's independent payment-verification process, even when the message sounds familiar.

A useful exercise asks whether people know how to verify and report a request. Recognizing poor spelling is not enough when the request fits the recipient's work.

For weekly decision practice, see online cybersecurity training for law firms. Staff receive weekly challenge emails, complete scenarios online, and receive feedback; administrators can review completion and average scores. The service includes fake e-filing notices and sign-in, document-sharing, payment, and other legal-work scenarios. It does not send simulated phishing emails or measure campaign click rates.

Choosing online cybersecurity training for lawyers and staff

Start with everyday legal work, not technical qualifications. Useful awareness training helps people verify document shares, account prompts, and payment changes before acting.

Check how employees receive assignments, what feedback they get, and which participation records managers can review. Short recurring scenarios can fit between client work without relying on one annual session.

Weekly decision training and managed email campaigns are different

The managed service's standard scenarios include document-sharing notices, account or sign-in alerts, invoice or payment requests, and routine administrative messages. Do not assume a particular court-notice or fake-IT scenario is included in a campaign; confirm the agreed scenario and written scope. For an exact example, see the court filing email verification checklist and IT support callback checklist.

Keep training completion separate from evidence of real-world readiness. Completion and scores support follow-up, but they do not prove someone will recognize every attack. If you need CLE credit, verify approval separately; do not assume an awareness subscription provides it.

What a useful phishing test should measure

Connect reporting practice with your written escalation process. Our law firm incident response plan template includes a 15-minute tabletop exercise; the page shows whether email delivery is open.

A phishing simulation sends controlled test messages to authorized participants. Awareness training explains how to respond. A managed program handles the administration and connects the exercise to follow-up learning.

A good report should help the owner answer a few practical questions:

• Did the intended staff receive the exercise?
• What interactions were observed?
• Did anyone report the message, and through which channel?
• Was assigned training completed?
• What should the firm change or practice next?

Avoid treating the click rate as a security grade. NIST's Phish Scale helps interpret simulation results by accounting for how difficult a message is for a person to recognize. An easy test and a convincing work-related message are not interchangeable measures. NIST Phish Scale guidance.

In a ten-person firm, one person represents ten percentage points. Reports should show counts as well as percentages, explain scenario difficulty, and account for automated email-security activity where possible.

Use those findings to coach staff and improve process. Staff should feel able to report a mistake promptly, without fear that a bad outcome will become a negative performance record.

Want staff to practice recognizing suspicious requests? Explore Cybersecurity Awareness Training for Law Firms, with weekly, law-firm-specific scenarios and practical decision feedback.

Can phishing training prevent law firm ransomware?

It can provide practice and reveal gaps, but it cannot guarantee prevention. Evidence about training effectiveness is mixed: a 2025 study involving more than 12,000 employees at one financial technology firm found no significant overall improvement in click or reporting rates from the training interventions it studied. That is a reason to measure outcomes and avoid sweeping claims, not a finding about every possible training program or law firm. Research paper.

Our recommendation is to use simulations as one part of a broader readiness program. Maintain strong account protection, current software, appropriate access restrictions, controlled remote-support tools, tested backups, and a clear incident-response process.

An email exercise also does not establish how staff will respond to a live caller or unexpected visitor. If those scenarios matter to the firm, scope them separately and verify the underlying procedures.

A first-day and first-month security onboarding checklist

Give each new employee the approved access and procedures before they handle matter data or payments. The office manager coordinates; each system owner confirms completion.

First day

• Name the manager and system owners who approve access; grant only approved accounts, roles, and matter permissions.
• Enroll the employee in required MFA and confirm the recovery process through the administrator.
• Provide the known IT support and security-reporting contacts, including how to report a mistake or suspicious request.
• Explain the firm's client-file sharing, court-notice, payment-change, and document-handling procedures.
• Assign the initial security training and show how to complete the weekly decision challenge.

By the end of the first month

• Confirm required training completion and discuss any questions or missed assignments.
• Have the employee demonstrate where to report a suspicious message and how to verify an unexpected IT or payment request.
• Review access against the employee's actual role and remove any temporary access no longer needed.
• Record the owner's sign-off, completion date, and open items in the firm's approved system.

Onboarding sets appropriate access and habits at the start. The separate offboarding checklist covers access removal and records when someone leaves.

For help examining the controls around staff decisions, consider the Law Firm Security Baseline. It is a separate service, not a prerequisite for phishing testing.

What if your cyber insurer asks for phishing testing?

Begin with the exact question or requirement. Do not assume that watching a training video, completing one simulation, and running quarterly campaigns are equivalent.

Before commissioning work, establish the basics:

1. Activity: Is the request for awareness training, simulated phishing, or both?
2. Frequency: Is testing needed once, quarterly, or on another schedule?
3. Coverage: Which employees, partners, and contractors must participate?
4. Evidence: What dates, completion records, results, and follow-up documentation are needed?

A useful evidence package records what actually happened, including incomplete participation and limitations. Your broker or insurer should confirm whether it meets the stated requirement. A completed simulation does not guarantee coverage, renewal, or a premium reduction.

A practical model for small law firms

Securing Your Law Firm can handle campaign setup, scheduling, administration, short follow-up training, and reporting. We coordinate with the person administering your email environment when setup requires their assistance.

For a small firm, a sensible starting point is often a one-time campaign, followed by a repeat cycle if the firm has ongoing risk or insurance requirements. Pricing is typically structured as follows:

• 1 to 10 staff: $395 one-time or $995 per year
• 11 to 25 staff: $595 one-time or $1,495 per year
• 26 to 50 staff: $895 one-time or $2,495 per year

The one-time engagement includes one selected scenario, standard setup and delivery testing, short follow-up training with completion tracking, a dated report, and a 20-minute readout.

The annual program includes four campaigns over 12 months, four short training assignments, completion reminders, campaign reports, and an annual summary and readout.

Prices include standard setup and platform costs for one domain and one email environment. Additional environments, unusual delivery requirements, and bespoke exercises are scoped separately. The standard program does not include live telephone or in-person impersonation exercises. Prices are current as of September 13, 2026; see the service page for current scope and pricing.

You can purchase a campaign directly. No Security Baseline or free exposure review is required.

What to ask before buying

Ask what scenarios and channels are included, how staff will be supported after an interaction, what the report contains, how automated security-tool activity is separated from human behavior, and how results will inform the next exercise. A completion record shows participation; it does not prove that staff can recognize every real request.

Questions law firm owners ask

We already have an MSP. Who runs the campaign?

Securing Your Law Firm manages the agreed campaign and documentation, coordinating necessary configuration with your existing provider. First check whether your current contract already includes an equivalent service.

How often should we test staff?

Match the schedule to your firm's needs and any documented requirements. Quarterly testing is our standard annual offering, not a universal insurance rule. Revisit the scope when staffing, threats, or requirements change.

What should we do if someone responds to a real suspicious request?

Have a known reporting contact and escalation procedure ready before an incident. Encourage immediate reporting, including when someone has already clicked or granted access. A scheduled simulation is not an incident-response service.

Give your staff a process they can use under pressure

The next suspicious request may arrive while someone is preparing a filing, answering a client, or processing an invoice. They need a workable way to pause, verify, and report, and the firm needs to know whether that process works in practice.

For a controlled simulated-email campaign with follow-up training and dated reporting, explore Managed Phishing Testing & Staff Training. For weekly practice between campaigns, see Cybersecurity Awareness Training for your law firm. These are separate services, so choose the one that matches what your firm needs to test or practice.