A law firm's email security and archiving rollout, and the outbound exfiltration attempt it caught
A law firm with about 80 lawyers and staff in several practice groups, a leader in its segment.
- Scale
- ~80 lawyers and staff, 1 mail gateway, 1 archive, 1 data loss prevention policy set
- Engagement
- Several weeks of design and rollout, then continuous operation
The challenge
The firm held privileged client files in mailboxes that nobody archived, and its mail filtering let through convincing phishing. Partners also worried about the most ordinary leak of all: an employee on the way out sending files to a personal account. There was no way to preserve mail for a dispute or to show what had left the firm.
A law firm with about 80 lawyers and staff had privileged client files in mailboxes that nobody archived. Its mail filter let convincing phishing through, and partners worried about a more ordinary risk: an employee on the way out sending files to a personal account. There was no way to preserve mail for a dispute or to show what had left the firm. The client is not named on this page, and this is an illustrative engagement that describes the kind of work our team does; details are composite.
The first layer was a mail security gateway placed in front of Microsoft 365. It inspects attachments and links, flags look-alike senders and enforces SPF, DKIM and DMARC, so the firm's own domain is harder to forge. Every inbound and outbound message passes through it, which also gave the firm a single place to apply policy.
The second layer was a tamper-resistant archive. Every message sent or received is captured outside the mailbox, so deleting an email no longer deletes the evidence. Retention rules were set by the firm's counsel, not by IT, and search was limited to authorized staff. A legal hold procedure lets counsel freeze a custodian's mail on request, with a record of who asked and when.
Data loss prevention rules watched outbound mail for bulk attachments, client matter numbers and files sent to personal addresses. They alert a small review group instead of blocking everyone, which keeps lawyers working and keeps false alarms from becoming noise. The firm also wrote down who acts on an alert: general counsel and HR own the decision, and IT supplies the facts and preserves the evidence.
Not long after launch, one rule flagged a departing employee sending a large set of client documents to a personal address. The message was held, counsel and HR were told, the mailbox was placed on legal hold and the firm dealt with the matter through its own process. The firm had preserved evidence instead of a guess. This engagement is illustrative, and nothing here is legal advice; the firm's counsel decides what the records mean.
What our team delivered
- A mail security gateway in front of Microsoft 365 with impersonation protection, attachment and link inspection, and SPF, DKIM and DMARC enforcement
- A tamper-resistant email archive that captures every message sent and received, with retention rules set by the firm's counsel and search for authorized staff
- Data loss prevention rules for outbound mail that flag bulk attachments, client matter numbers and files sent to personal addresses, with alerts to a small review group instead of blocks for everyone
- A legal hold procedure that freezes a custodian's mail in the archive on request from counsel, with a record of who asked and when
- A written process tying the alerts to HR and the firm's general counsel, so every review had an owner and nothing was handled by the IT team alone
- Staff briefings on what the new rules do and do not do, and a quarterly review of alerts and retention settings
Result
Shortly after launch, a rule flagged a departing employee sending a large set of client documents to a personal address. The message was held, counsel and HR were told, the archive was placed on legal hold and the firm handled it through its own process. The rollout gave the firm preserved evidence rather than a guess. This is illustrative and describes the kind of work our team does; details are composite, and nothing here is legal advice.
Get this for your company
Related services with fixed prices and a written scope.
Emergency package: security engineer in 1 hour
Is your company in a cybersecurity crisis? Purchase this package and a security engineer will call you within 1 hour.
Callback within 1 hour, 24 hours a day, 365 days a year
$1,950 per incident
Initial assessment of public endpoints
What an attacker can see and reach from the internet: your domains, mail, websites, remote access and cloud exposure.
Report within 5 business days of kickoff
$1,000 per assessment
Insurance-ready bundle
The three things cyber insurers and clients ask for most: an external assessment, a phishing simulation for 25 users and a disaster recovery plan.
Assessment report in 5 business days; plan draft in 15 business days
$5,400 per bundle, phishing simulation for 25 users
Show 3 more
Email security with AI detection and DLP
Inbound and outbound protection: phishing, malware and impersonation caught by AI detection, with data loss prevention for what leaves.
Live within 7 business days
$7 per mailbox, per month
Compromised-mailbox monitoring and alerts
We watch each mailbox for signs of takeover, such as odd logins, forwarding rules and mass sending, and alert you fast.
Live within 5 business days
$4 per mailbox, per month
Phishing simulation
A realistic, authorized phishing campaign with short training for anyone who clicks. Priced per person.
Campaign launches within 5 business days of approval
$12 per user, per campaign
After you purchase, we contact you within 1 hour, any time of day or night, to start onboarding.
No payment is taken online. When we call you within the hour we confirm the scope and send an invoice (ACH, card or crypto).
Mail checked going in, going out and kept
Inbound mail from the internet passes a filter with AI-assisted phishing detection before it reaches Microsoft 365 or Google Workspace. Outbound mail passes data-loss-prevention (DLP) rules first. A journal copy of every message goes to a write-once archive. If the mail platform has an outage, a continuity mailbox keeps receiving and replays the mail afterward.
How long a record is kept, and what a hold changes
A general illustration of broker-dealer record retention under SEC Rule 17a-4: some records are kept three years and others six, and in both cases the first two years must be easily accessible. A legal hold overrides the clock: nothing is deleted until the hold is released. General illustration, not legal advice; the period for a given record depends on its type and on the rule text.
Facing something similar?
Tell us about your environment. We will tell you plainly what we would do and what it would take.