Phishing and client-file lures
Practice spotting fake document shares, e-filing notices, sign-in prompts, and urgent messages that imitate trusted services.
Phishing awareness training for small law firms
Train your team to spot phishing before a real client, payment, or account is at risk.
Short, law-firm-specific scenarios help attorneys and staff recognize suspicious emails, business email compromise, MFA fatigue, wire fraud, and risky AI use.
No passwords. No client files. Built for small and midsize law firms.
Best for
Awareness training and everyday best practices
Employee effort
Short weekly scenarios, not a long annual seminar
Starting price
$99/month for up to 10 employees
Need simulated phishing emails?
This page is recurring decision training. For controlled email campaigns, click-rate reporting, and follow-up training, see our managed phishing testing service.
What phishing awareness training covers
Real decisions, not generic security trivia.
Each challenge puts a familiar-looking request in front of the employee and explains the safer next step.
Account and MFA attacks
Build the instinct to deny unexpected prompts, stop repeated push requests, and verify an urgent caller through a trusted channel.
Wire fraud and mailbox compromise
Reinforce safe handling of payment changes, suspicious mailbox rules, reply-to changes, and requests that bypass normal approval.
AI and privileged information
Give staff a clear framework for handling confidential drafts, client information, public AI tools, and risky sharing behavior.
Included in every plan
A program your office can actually run.
Give your team a recurring way to practice the decisions that protect client trust, firm funds, and account access.
- Weekly law-firm-specific scenarios assigned through your firm workspace
- Immediate explanation of the safer decision after each answer
- Coverage of phishing, BEC, MFA fatigue, mailbox compromise, wire fraud, and AI risk
- Employee completion records for the firm’s internal training log
- No passwords, client files, or simulated credential collection
Keep learning
Practical phishing guidance for law firm leaders.
Phishing Training for Law Firms: What to Test and Measure
How to practice staff decisions, document results, and distinguish awareness training from a managed phishing campaign.
Read the guideHow Law Firm Email Spoofing Puts Clients at Risk
Why attorney impersonation and fraudulent payment requests work, and where staff verification habits matter.
Read the guideCyber Insurance Requirements for Law Firms
What carriers may ask firms to prove, including training records and other documented safeguards.
Read the guideSimple firm pricing
Choose the seat band. Keep the training moving.
Every plan includes the same law-firm-specific training experience. Select monthly billing for flexibility or annual billing for a lower effective monthly cost.
1–10 employees
A practical starting point for solo practices and small teams.
Stripe securely handles checkout and recurring billing. Seat limits are applied when your firm account is provisioned.
Most popular
11–25 employees
For growing firms that need consistent training across offices or practice groups.
Stripe securely handles checkout and recurring billing. Seat limits are applied when your firm account is provisioned.
26–50 employees
For larger teams that want one shared security habit across the firm.
Stripe securely handles checkout and recurring billing. Seat limits are applied when your firm account is provisioned.
Need more than 50 employees or a tailored program? Contact us to discuss scope.
How it works
A small weekly commitment with a durable payoff.
01
Enroll your firm
Choose the seat band and monthly or annual billing option that fits your team.
02
Invite your people
Use the firm training workspace to invite employees and assign the current challenge.
03
Complete the scenario
Each short challenge asks people to make a realistic decision, not memorize a definition.
04
Review the result
Participants see why the decision mattered, while firm leaders get a durable training record.
Training questions
Answers for firm owners and office managers.
The program provides short, scenario-based weekly challenges built around threats that affect legal practices: phishing, fake e-filing notices, mailbox-rule compromise, MFA push fatigue, opposing-counsel impersonation, shadow AI, and wire-instruction fraud.
If your insurer asks for security awareness training, this program gives you a documented training program and employee completion records to review with your broker. Insurers set their own requirements, so confirm whether your policy specifically requires simulated phishing, a particular platform, or a stated training frequency. If you need a managed phishing campaign, see our separate Phishing Testing & Staff Training service.
This is recurring decision-based security awareness training. It teaches people why a request is suspicious and what to do next. It does not send simulated phishing emails or measure click rates. For a controlled phishing campaign with dated campaign reporting, use Managed Phishing Testing & Staff Training.
Each weekly challenge is designed to be short enough for a normal workday. The exact time varies by scenario, but employees make one decision, receive reinforcement, and continue through the firm’s assigned training flow rather than sitting through a long annual seminar.
The training workspace records assigned challenges and completion results for your firm. Those records help an office manager track participation and provide evidence of an ongoing awareness program. They are not a guarantee that a particular insurer or client will accept them.
The subscription is priced by the number of employees in the firm: up to 10, 11–25, or 26–50. The selected Stripe plan determines the firm seat limit when the account is provisioned.
Yes. Annual plans are available for every seat band: $990 for 1–10 employees, $2,490 for 11–25 employees, and $3,990 for 26–50 employees.
No. The training is designed to reinforce the technical controls and policies your existing provider manages. It gives your people a shared, law-firm-specific way to make safer decisions.
Employees receive the challenge material and the feedback they earn from their own answers. Answer keys and unearned feedback remain server-side so the completion record reflects the person’s actual decision.
Need simulated phishing rather than decision training? Review our managed phishing testing service.
Start with context
Know what attackers can see, then train the people who have to respond.
2 minutes. No internal access. No passwords.
The free Zero-Access Exposure Review shows what is publicly observable about your firm. Training helps your team act on the warning signs that appear in everyday legal work.