Law Firms
We find out whether your attorneys' laptops, phones, email, document systems and client data are safe from attackers, and we fix what we find. Law firms hold exactly what attackers want: privileged communications, deal information and client identities. We protect them and keep your attorneys productive.
A law firm's product is trust, and its most valuable assets are privileged communications, deal terms and client identities. Attackers know it. Firms of every size are targeted by email fraud, credential theft and ransomware, and clients increasingly ask for proof of protection before they send work.
We run IT and security for law firms with attention to the way attorneys actually work: fast email, mobile devices, remote access, large document sets and tight deadlines. Controls that slow attorneys down get bypassed, so we design ones they will use.
Our insight article "Deepfake-Proof Payments: Callback Verification That Holds Up" describes the callback approach we can help your firm adopt, so trust-account and wire instructions are confirmed through a separate, known channel.
Staff training matters as much as filters here. Our Security Awareness Training service teaches attorneys and finance staff to resist impersonation and closing-fraud requests, with phishing simulation and wire-fraud drills that fit a billing-hour schedule.
What we see in your industry
- Business email compromise and wire-fraud attempts target firms handling closings and settlements.
- Client outside-counsel guidelines increasingly include security questionnaires.
- Attorneys want the benefits of AI without exposing privileged material to public tools.
- ABA Formal Opinion 512 (2024) calls for a client's informed consent before client information is entered into a self-learning AI tool.
Ethics rules put security on the attorney, not only on IT. ABA Model Rule 1.6(c) requires a lawyer to make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client. Comment 8 to Rule 1.1 adds that keeping up with competence includes understanding the benefits and risks of relevant technology.
Generative AI raises the same duty in a sharper form. The Florida Bar addressed lawyers' use of generative AI in Ethics Opinion 24-1 (January 2024), and the ABA did so in Formal Opinion 512 (July 29, 2024). Opinion 512 says that because many self-learning AI tools are designed so that their output could lead to the disclosure of client information, a client's informed consent is required before such information is entered into one, and that boilerplate language in an engagement letter is not enough. Both opinions stress understanding a tool's data practices and verifying its output.
That is why private AI matters for law. Document review, summaries and drafting are where AI helps most, and also where sending text to a public tool is least acceptable. We deploy models that run in your environment, with access controls and logs, so attorneys gain the benefit without exposing privileged material. This is general information, not legal advice.
The strongest example of what a firm can do is our own track record. A 50‑person law firm paid about $100 per employee per month for an outdated practice-management product. Our team replaced it with a custom, self-hosted platform with a module for each department and AI in every layer, so client data stays on the firm's own infrastructure. A smaller firm does not need to build everything, but the same questions apply to every one: where privileged data lives, who can reach it, and what each vendor does with it.
Two articles go further. "ABA Formal Opinion 512 and AI for Law Firms" sets out the confidentiality, competence, fee and supervision duties alongside Florida Bar Opinion 24-1, and "Business Email Compromise and Wire Fraud" explains how closings and settlement payments are hit and how to stop it.
"Cyber Insurance Readiness" explains the MFA, EDR and backup controls underwriters ask about, which also matter to the clients who send you their security questionnaires.
Our Apocalypse IT Package keeps a law office working through a long internet outage with a local law library, scanning, OCR and a private AI correspondence desk. Related work on our track record: a 50‑person firm moved to a custom self-hosted practice platform, a 300‑attorney firm that now fails over to a second region in under two hours with immutable backups (illustrative), and the zero trust design for a Los Angeles real estate group whose closings face the same email fraud.
Many of these firms must be able to show what a message said and when it was sent. Our team builds immutable message archives with provable integrity: a copy of every inbound and outbound email is stored in write-once storage, such as Amazon S3 Object Lock in compliance mode on Amazon Web Services (AWS) with encryption keys in AWS Key Management Service (AWS KMS), or the equivalents on Google Cloud (Bucket Lock and Cloud KMS), Microsoft Azure (immutable storage for Blob Storage and Azure Key Vault) and Oracle Cloud Infrastructure (OCI) (Object Storage retention rules and OCI Vault). A SHA-256 fingerprint of each message, protected with a key in the cloud key service, lets a third party check later that it is unchanged. For a law firm, that proof can matter in a dispute over what was sent to a client or when a deadline notice went out. Counsel and the compliance officer decide what must be retained; this is technical evidence, not legal advice.
ABA Formal Opinion 512 and AI for Law Firms: Confidentiality, Competence, Fees and Supervision, With Florida Bar Opinion 24-1
Two ethics opinions now frame how lawyers may use generative AI: the ABA's Formal Opinion 512 (July 2024) and the Florida Bar's Opinion 24-1 (January 2024). Neither bans the tools. Both ask lawyers to verify output, protect client information, bill honestly and supervise. This article turns them into a firm policy and a tool-selection checklist.
Work like yours
A law firm replaced its legal software with its own and stopped paying licence fees per user
A 50‑person law firm, a leader in its segment, running an outdated, paid legal practice-management product.
50 employees, every department, no licence fees after the switchRead the case
A law firm that can be back in under two hours: immutable backups and a tested failover to a second region
A law firm of about 300 attorneys with offices in three U.S. cities, a leader in its segment.
~450 users, 3 offices, 2 regions 1,000+ miles apart, RPO 15 minutes, RTO 2 hours for Tier 1Read the case
A Texas title company stops a deepfake wire-change request with callback and second-approver controls
A title and escrow company in Texas with about 35 staff, a leader in its segment.
About 35 staff, 3 closers, 2 approvers per disbursement, 1 Microsoft 365 tenant, 4 mail domainsRead the case
Email a regulated firm can prove: delivered into an Amazon S3 bucket that cannot be deleted or overwritten, with AWS KMS protecting each message's fingerprint
A regulated firm that needed to prove what it sent and received, a leader in its segment.
Every inbound and outbound message, 1 Object Lock archive bucket, AWS KMS protecting each message fingerprintRead the case
An accounting firm's Active Directory, rebuilt and re-tiered after ransomware reached the domain admins
An accounting and advisory firm of about 400 people in four U.S. offices.
~400 users, 6 domain controllers, 4 sites, 1 forestRead the caseHow we help
Managed IT Services
We run your IT day to day so it stays secure: help desk, devices, Microsoft 365, Exchange, Active Directory, backups, networks and monitoring.
Learn moreCybersecurity
We find out whether everything you run is safe from attackers, then we fix it.
Learn moreSuper Intelligence
American‑made Super Intelligence: AI your team can learn, trust and deploy.
Learn moreTailored Software
Software built around your business in weeks, and you own the code.
Learn moreMicrosoft Exchange, Active Directory & SQL
Exchange, Active Directory and SQL Server built redundant, backed up and recoverable, and engineers on call when they fail.
Learn moreSecurity Awareness Training
Train your people to stop the phish, the fake voice and the wire request before money moves.
Learn moreFrequently asked questions
Direct answers to the questions we hear most. Something else on your mind?
Send us a messageHow do you protect a law firm from wire-fraud and email compromise?
We secure email with multi-factor authentication, SPF, DKIM and DMARC, and filtering. We also set payment-verification procedures and train staff to spot spoofed requests during closings and settlements.
Can our attorneys use AI without risking privilege?
Yes, with a policy and the right deployment. We set up private or local AI for privileged material and rules for which tools may be used for what.
Can you answer client security questionnaires?
We help you document your controls and fix gaps, so that outside-counsel guideline questionnaires can be answered accurately. Accuracy matters because an answer is a statement a client may rely on. We keep the evidence behind each answer, such as policies, test results and configuration records, so the next questionnaire is faster.
Do you support legal software and document management?
Yes. We support the systems firms run every day and help secure access, backups and remote work around them. That includes document management, billing and practice-management platforms, and email. If a platform is a poor fit, we can also discuss a custom, self-hosted alternative, as our team has built for a law firm before.
How do you keep client files confidential?
Through access control, encryption, tested backups and monitoring, under written confidentiality terms. We give each person only the access the matter requires, protect data in transit and at rest, and keep logs so access can be reviewed. We work under a confidentiality agreement before we see anything.
Do you work with small firms?
Yes. We support firms from about ten people, including solo practitioners' offices that share space.