The biggest risks usually are not hidden in some dramatic cyber event. They show up in the everyday gaps firms have learned to live with.
There is a certain kind of sentence we hear all the time from law firms.
“We have IT handling that.”
“We’re on Microsoft 365.”
“We have cyber insurance.”
“We’ve never had an issue.”
None of those are crazy things to say. In fact, they are exactly what busy firms say when they are trying to keep work moving, protect client data, and trust that the basics are covered.
The problem is not that law firms are careless. The problem is that legal cybersecurity has become messy, layered, and easy to overestimate. Most firms are running on a mix of systems, vendors, cloud tools, email platforms, remote devices, and well-meaning assumptions. When something goes wrong, that is usually when the real gaps show up.
Right now, law firms are being asked harder questions by clients, insurers, and the wider reality of handling confidential information in a digital world. And if those questions are not being asked internally first, they tend to arrive at the worst possible moment.
Here are the security questions law firms should be asking right now
1. Do we actually know who is responsible for what?
This is the starting point, and it is amazing how often it is fuzzy.
Most firms rely on a mix of providers for IT support, cloud platforms, email security, backups, monitoring, remote access, and more. On paper, that can look reassuring. In practice, it often means responsibility is scattered across multiple vendors, internal staff, and nobody in particular. Our law firm scorecard calls this out directly: many firms discover during an incident that they do not actually know who owns which control.
A better question than “Do we have a vendor for that?” is:
Who owns this, how do we know it is being done, and where is that documented?
That question alone can save a firm from a lot of expensive confusion.
2. If someone left the firm today, how fast would their access actually disappear?
This is one of those questions that sounds basic until you sit with it for five seconds.
Would access to email, document systems, practice management tools, finance platforms, shared drives, remote desktops, and cloud apps be removed immediately? Or would it depend on who notices, who emails IT, and whether anyone remembers all the systems that person had access to?
Identity and access management is one of the clearest pressure points for firms. Shared logins, weak passwords, missing MFA, over-permissioned accounts, and slow offboarding remain some of the most common and most damaging weaknesses. They are also exactly the kind of things insurers and larger clients pay attention to.
If your offboarding process still relies on “Has anyone told IT?”, that is not a process. That is hope with a calendar invite.
3. Are we protecting client confidentiality consistently, or just in the obvious places?
Every law firm understands the duty to protect client confidentiality. The issue is that confidentiality does not only live in formal policy language. It lives in how files are shared, how laptops are secured, how email is used, how long data is kept, and what happens when somebody is working quickly under pressure.
This is where firms tend to get tripped up by the everyday stuff:
- Unencrypted devices
- No tested backup restores
- Consumer-grade file sharing
- Unclear rules around storing client data in cloud platforms
- Weak retention and destruction practices
A lot of malpractice-linked cyber issues have nothing to do with some movie-scene hacker in a dark room. They come from lost devices, mis-sent documents, and routine handling failures that were completely preventable.
So the real question is not “Do we care about confidentiality?”
Of course you do. The real question is:
Are our daily systems and habits protecting confidentiality in practice, or just in theory?
4. Are we secure by design, or just assuming our tools are secure by default?
This one matters more than most firms realize.
A lot of legal teams assume that if they are using Microsoft 365, Google Workspace, Teams, Zoom, or a major cloud platform, the security piece is basically built in. But that is not how this works. As our scorecard puts it, many firms assume cloud platforms are secure by default when in reality they only become secure when properly configured. Attackers often get in through permissions that were never tightened in the first place.
That is why the better question is:
What have we actively configured, hardened, reviewed, and restricted, and what are we simply trusting?
Those are very different things.
5. Do we know, today, that our devices and systems are actually protected?
Not “at some point.”
Not “I think so.”
Not “our IT company probably handles that.”
Today.
Law firms are working across offices, homes, airports, court buildings, client sites, and everywhere in between. That means your attack surface is constantly shifting. Endpoints, firewalls, Wi-Fi, servers, and cloud systems all need to be patched, monitored, and reviewed on an ongoing basis. Quiet gaps here are a common root cause of ransomware incidents.
If nobody in the firm can confidently answer whether every laptop, firewall, and cloud environment is patched and monitored right now, that is not a small issue. That is the issue.
6. If a breach happened tomorrow, could we show that we took reasonable steps?
Governance and compliance are not glamorous. Nobody gets excited about documented risk assessments, written policies, incident response plans, or naming a security owner. But when something goes wrong, those are exactly the things regulators, clients, and insurers look for first. Our scorecard is blunt about this: firms are often not criticized for lacking tools, but for lacking policies, accountability, and documentation.
A firm can spend money on technology and still be left exposed if it cannot show:
- Who is accountable
- What the policies are
- When risk was last assessed
- Whether incident response has been tested
- Whether vendor responsibilities were ever reviewed in writing
The question is not just whether you have tools in place. It is whether you can prove your firm is using them properly.
7. Are we testing what matters, or just assuming it will work?
This is one of the biggest traps in legal cybersecurity.
- A backup that has never been restored is not reassurance.
- An alert nobody reviews is not protection.
- A response plan nobody has practiced is not readiness.
Monitoring, testing, and maintenance are what turn security tools into real protection. Without them, firms are left with the appearance of control rather than the evidence of it. Our scorecard flags the same common failures repeatedly: no vulnerability scanning, no backup restore testing, ignored alerts, and no tabletop exercises. And one of the first questions after a breach is often when those controls were last tested.
That is why one of the most important questions a firm can ask is:
When was the last time we actually tested this? If the answer is silence, that tells you something.
8. Are our people part of the security strategy, or treated as the problem?
People are often described as the weakest link, which is lazy and not especially helpful.
Your team is not the problem. Unclear expectations are the problem. Inconsistent training is the problem. No phishing practice, weak remote-work guidance, unsecured paper files, unlocked screens, and undefined day-to-day habits are the problem. Our scorecard makes this point clearly: even the best tech fails when people are not prepared.
The better question is:
Have we made secure behavior easy, normal, and specific enough for people to follow?
Most preventable incidents are not caused by bad employees. They are caused by normal people working fast in unclear systems.
Underneath all of these questions is one bigger one:
Are we genuinely clear on where our risk lives, or are we relying on assumptions that feel good until they are tested?
Gaps have a habit of becoming problems at exactly the wrong time.
The firms in the strongest position are not necessarily the ones with the most tools. They are the ones with the most clarity. They know what they have, who owns it, what is documented, what is tested, and where the weak spots still are. That is what makes risk easier to reduce and much harder to ignore.
Want a clear view of where your firm stands? Start with the law firm scorecard, or see how we support law firms.