Most law firms are not caught out by the obvious stuff. They are caught out by the weaknesses no one noticed.
No law firm ever says, “You know what will take us down? One slightly over-permissioned account, a lazy offboarding process, and a backup nobody has tested.”
And yet, that is exactly how a lot of firms end up exposed.
- An account with too much access.
- A backup nobody has tested.
- A file shared too broadly.
- A former employee whose permissions never fully disappeared.
- A cloud platform everyone trusts and nobody has properly locked down.
That is how exposure builds in legal environments. In the background of busy teams, moving deadlines, client pressure, and the constant belief that somebody, somewhere, is probably handling it.
That is what makes these gaps dangerous. They look operational. They look routine. They look like the kind of thing a busy law firm can live with.
Until it cannot.
The most dangerous gaps are the ones that feel normal
When people think about cyber risk, they usually picture the big event. The breach. The ransomware note. The horrible client call. The week nobody forgets.
But law firms do not become vulnerable on the day the incident happens. They become vulnerable in the weeks and months before it, when small weaknesses are left to harden into normal practice. That is the real issue.
Risk settles in where no one is asking difficult questions anymore. In permissions that were never revisited. In systems that were set up once and quietly trusted ever since. In vendors doing “security stuff” without anyone being completely clear on what that actually means. In workarounds that save five minutes and create five points of exposure.
1. Access expands fast. It almost never contracts neatly.
This is one of the most common ways firms become more exposed than they realize. People are given access for good reasons, and then that access just keeps building.
They move between matters. They step in for colleagues. They get added to new folders, systems, and tools. Very little gets removed. Over time, people end up with far more access than they actually need. It happens gradually, which is exactly why it gets missed.
The problem is that when an account is compromised, every unnecessary permission becomes part of the blast radius. So the real question is not whether access was appropriate when it was granted. It is whether it still makes sense now.
2. Offboarding is where confidence and reality often part ways
Most firms will tell you they have an offboarding process.
That is not the same as having an offboarding process that stands up under pressure.
What actually happens when someone leaves? Not what the policy says. What really happens.
Who removes access to email, file-sharing tools, practice management platforms, finance systems, remote logins, mobile devices, and the half-forgotten apps nobody thinks about until there is a problem? Who checks it all? Who signs it off? How quickly does it happen?
If the answer is some version of “IT usually handles it,” that may not be enough.
Lingering access is one of the easiest ways for avoidable risk to remain inside the firm after the person who created it has already gone.
If your offboarding process still depends on memory, momentum, and whoever happened to be copied on the right email, that is not a secure process. That is wishful thinking with admin privileges.
3. Cloud tools make firms feel secure long before they make them secure
Cloud platforms are not the problem. False confidence is.
A lot of law firms have made smart moves into Microsoft 365, Google Workspace, Teams, SharePoint, cloud document systems, and legal SaaS platforms. That flexibility is valuable. It is also where firms can start mistaking convenience for control.
Because a reputable platform is not the same thing as a secure environment.
Security lives in the configuration. In the permissions. In the review process. In whether MFA is enforced properly. In whether links expire. In whether sensitive material can be downloaded to unmanaged devices. Whether anyone has checked the settings since the day the system went live.
A lot of firms are not exposed because they chose the wrong platform. They are exposed because nobody ever tightened the right one.
4. Backups are comforting right up until someone needs one
There are few phrases in legal IT more soothing than “we have backups.” And maybe you do. But the better question is whether you have backups that would actually save you.
- Could you restore quickly?
- Could you restore cleanly?
- Could you restore the right systems in the right order?
- Has anyone tested that recently?
- Or is the backup strategy essentially a matter of faith.
This is where firms often confuse possession with preparedness. A backup that exists but has never been tested is not resilient. Theories are not much use on a Monday morning when a matter-critical system is unavailable and everyone suddenly wants certainty.
5. Day-to-day behavior is where policy goes to get embarrassed
Security policy might say one thing. Day-to-day reality often says something else.
Files get shared quickly because someone needs them now. Work gets forwarded to personal email because it is easier. Passwords get reused because nobody has time for another reset. Paper files stay on desks because the day got away from everyone. Devices get left unlocked because someone was “just stepping out for a second.”
None of that sounds especially dramatic. That is exactly the point.
Law firms rarely get exposed by one grand act of recklessness. They get exposed by ordinary behavior happening inside systems that were never designed tightly enough to hold up under pressure.
The issue is that security expectations are often too vague, too idealistic, or too disconnected from how work actually gets done.
6. Vendors can create just as much ambiguity as reassurance
A lot of firms feel more secure because they have multiple vendors involved.
Managed IT. Security tools. Backup providers. Practice management platforms. Cloud consultants. Email filtering. Compliance support.
On paper, that can look like maturity. In practice, it can create a fog of half-owned responsibility where everyone is doing something, but no one has a full view of the whole picture.
- Who is monitoring what?
- Who is responsible for configuration?
- Who checks for drift?
- Who reviews alerts?
- Who owns the response when something looks wrong?
- Who is accountable when the answer turns out to be “we thought that was covered”?
This is where law firms get caught in one of the most expensive phrases in cybersecurity:
I assumed someone else was handling that.
7. The deepest problem is visibility, not intent
Most firms are not reckless. They are partially sighted.
They cannot say with confidence:
- which users still have elevated permissions
- which devices are fully protected
- whether backup restores have been tested recently
- where the most sensitive client data lives
- which alerts are reviewed and by whom
- where vendor responsibility starts and ends
- how quickly they would spot an issue already unfolding
That uncertainty is where risk hardens. You cannot reduce what you cannot clearly see. You cannot govern what you cannot fully map. And you cannot defend what you only understand in fragments. The gap is hiding inside “probably”. This is the thread running through all of it.
Most law firm security gaps do not live inside obvious failure. They live inside soft language.
- We think that is covered.
- That should be locked down.
- IT probably handles that.
- I assume access gets removed.
- We have never had an issue.
The firms in the strongest position are not always the ones with the flashiest stack or the longest list of tools. They are the ones willing to interrogate the boring parts. The hidden parts. The bits everyone assumes are fine because they have not yet caused pain.
Want a clear view of where your firm stands? Start with the law firm scorecard, or see how we support law firms.