This is the final article in our Cybersecurity Awareness Month series, and over the last few weeks we’ve covered several practical ways law firms can reduce cyber risk.

We’ve talked about phishing, AI impersonation, passwords, multi-factor authentication, and protecting sensitive information when using AI tools.

Every one of those protections matters.

Law firms should train employees. They should use MFA. They should establish strong policies, verification procedures, and clear rules around sensitive data.

But there is one important reality that every firm also needs to recognize:

You cannot completely train human error out of your organization.

Even with good cybersecurity practices in place, something can still go wrong.

Cybersecurity Reduces Risk, But It Does Not Eliminate It

Eventually, an employee may click something they should not.

Someone may respond to a very convincing phishing email.

A vendor your firm relies on could experience a security incident.

An employee could accidentally send sensitive information to the wrong person or approve a request that appears legitimate.

Cybersecurity controls are designed to make those events less likely and reduce the damage when they occur.

But they cannot guarantee that an incident will never happen.

That is why law firms need to think about cybersecurity in layers.

Your Firm’s Cybersecurity Layers May Include:

• Employee cybersecurity training
• Multi-factor authentication
• Strong password practices
• Email and network security tools
• Internal verification procedures
• AI and data-handling policies
• Incident response planning
• Cyber liability insurance

Each layer serves a different purpose.

Cyber liability insurance is there to help address the financial and operational risks that remain after preventive measures have been put in place.

A Cyber Incident Creates Immediate Questions

When something goes wrong, the situation can become complicated very quickly.

Firm leadership may suddenly need answers to questions such as:

Was client information accessed?

Do systems need to be shut down?

Can attorneys and employees continue working?

Do affected clients or other parties need to be notified?

Does the firm need forensic investigators, legal counsel, or other outside specialists?

Was money transferred fraudulently?

And perhaps most importantly from an insurance standpoint: What does the firm’s policy require it to do next?

That is not the ideal time to start reading your cyber policy for the first time.

Understand Your Cyber Coverage Before an Incident

Cyber insurance policies can differ significantly, so law firms should understand how their coverage is structured before they need to use it.

The goal is not simply to confirm that a policy exists.

The firm should understand what types of incidents may be covered, what limits apply, and what response resources are available.

Areas Law Firms Should Review

Depending on the policy, law firms may want to discuss coverage related to:

• Ransomware and cyber extortion
• Data breaches
• Business email compromise
• Social engineering
• Fraudulent wire transfers
• Business interruption
• Incident response and forensic expenses
• Legal and notification costs

Firms should also pay attention to policy limits and sublimits.

A policy may include a large overall limit while placing smaller sublimits on particular types of losses. Understanding those details before an event can help prevent surprises later.

Know What Response Resources Come With the Policy

Cyber insurance may also provide access to professionals who can help the firm respond to an incident.

Depending on the coverage, that could include forensic investigators, breach counsel, notification services, public relations resources, or other specialists.

Law firms should know who to contact and what steps are required under the policy before engaging outside vendors on their own.

A response plan is far more useful when the firm already understands how insurance fits into it.

Cyber Liability Insurance Is the Financial Backstop

The cybersecurity training we’ve discussed this month is one layer of protection.

Technology is another.

Policies and internal procedures are another.

Cyber liability insurance is the financial backstop for the risk that remains.

As Cybersecurity Awareness Month comes to an end, take one more practical step: pull out your cyber policy and review it with your insurance professional.

If you are not confident that your current coverage would protect your firm after a cyber incident, reach out to us. We can help you review what you have, identify potential gaps, and better understand how your coverage would respond.

Because the time to find a hole in your cyber insurance is before an incident — not after.

October is Cybersecurity Awareness Month, and this is part four of our five things every law firm should know to better protect its people, clients, systems, and data.

Law firms are using artificial intelligence more often, and that trend is not likely to slow down.

AI can help with writing, brainstorming, summarizing information, research, internal communications, and a growing list of everyday tasks. Used appropriately, it can save time and improve productivity.

But every law firm needs to answer one important question before AI use becomes routine:

What information are employees allowed to put into an AI system?

Without clear guidance, employees may make that decision on their own each time they use a tool. That creates unnecessary risk, especially when client information or confidential business data is involved.

Not Every AI Task Carries the Same Risk

There is a major difference between asking an AI tool to rewrite a generic email and pasting a confidential client document into that same system.

Imagine an employee thinks:

“I’ll just paste this document into AI and ask it to summarize it.”

Before doing that, the employee should stop and consider what the document actually contains.

Sensitive Information May Include:

• Client names or identifying details
• Financial information
• Medical information
• Confidential business information
• Settlement details
• Information from an active legal matter
• Personally identifiable information
• Internal firm information that is not intended for public disclosure

A document does not have to be marked “confidential” to contain information that deserves additional protection.

The problem is that employees should not have to analyze these risks from scratch every time they want to use AI.

Every Law Firm Should Have a Basic AI Policy

A clear AI policy can give employees practical rules they can follow before entering information into an AI platform.

The policy does not need to be complicated, but it should answer some basic questions.

Your AI Policy Should Address:

• Which AI tools are approved for firm use?
• Which employees are permitted to use them?
• What types of information may be entered?
• What types of information are prohibited?
• Can confidential client information ever be used?
• Should identifying details be removed before information is entered?
• Who should employees ask when they are unsure?

Giving employees specific guidance is much safer than relying on everyone to make an individual judgment call.

An Approved AI Tool Does Not Mean Everything Is Approved

One important distinction for law firms is the difference between approving an AI platform and approving every possible use of that platform.

Your firm may decide that a particular AI system is acceptable for certain business purposes. That does not necessarily mean employees should upload confidential documents, client records, medical information, financial data, or other sensitive material into it.

Approval of the tool should not automatically equal approval of the data.

Employees still need to understand what information may be used and under what circumstances.

Remove Sensitive Information Whenever Possible

One practical way to reduce risk is to remove unnecessary identifying information before using AI.

For example, an employee who wants help improving the wording of a generic client communication may not need to include the client’s name, case number, financial information, or specific facts about the matter.

Instead, the employee may be able to describe the situation in general terms and still receive a useful response.

Ask Whether the AI Really Needs That Detail

Before entering information into an AI system, employees can ask themselves a simple question:

Does the AI actually need this information to complete the task?

If the answer is no, leave it out.

The less sensitive information that is entered unnecessarily, the lower the potential exposure.

Productivity Should Not Come at the Expense of Confidentiality

AI can absolutely make law firms more efficient.

The goal should not be to prevent employees from using useful technology. It should be to establish boundaries so employees understand how to use it responsibly.

Clear expectations can also make employees more comfortable using approved tools because they do not have to guess where the line is.

Cybersecurity Awareness Month is a good opportunity to bring this topic into your next staff meeting and ask:

Does everyone in our firm know what they are — and are not — allowed to put into AI?

If the answer is unclear, now is a good time to establish the rules.

Next in Our Cybersecurity Awareness Month Series

Even strong policies and security practices cannot eliminate every possible risk.

In the final part of our series, we’ll look at the cybersecurity topic nobody likes to think about: what your law firm should do when something still goes wrong.

October is Cybersecurity Awareness Month, and this is part two of our five things every law firm should know to better protect its people, clients, finances, and data.

In our first article, we talked about phishing emails and why employees can no longer rely on obvious spelling mistakes or poor grammar to identify a suspicious message. But what happens when the request does not arrive by email at all?

What if it comes from a voice your employee recognizes?

Advances in artificial intelligence are making it increasingly possible to imitate voices and create convincing fake video. For law firms, that creates a new cybersecurity challenge: hearing or even seeing someone may no longer be absolute proof that the person is really who they claim to be.

Imagine This Happening at Your Law Firm

Your bookkeeper receives a phone call from one of the firm’s partners.

The voice sounds familiar. The partner seems rushed and says something like:

“I need you to send a wire right now. I’m walking into a meeting, so I can’t stay on the phone.”

The request sounds legitimate. The voice sounds right. There may not be anything obviously suspicious about the call.

Would your employee send the money?

The problem is that the person on the other end of the phone may not actually be the partner.

AI Is Changing How Firms Need to Think About Identity

AI technology can be used to create convincing imitations of a person’s voice. Similar technology can also generate or manipulate video.

That means one of the assumptions employees have traditionally relied on — “I know what this person sounds like” — may not provide enough protection for a high-risk transaction.

This is especially important for law firms because employees routinely work with sensitive information and high-value transactions.

High-Risk Requests May Include:

• Wire transfers or other financial transactions
• Passwords or account credentials
• Confidential client information
• Settlement funds
• Changes to payment instructions
• Requests to bypass established procedures
• Access to sensitive documents or systems

These requests deserve additional verification, regardless of how convincing the person making the request may sound.

Create One Simple Verification Rule

Law firms do not need complicated procedures for every phone call.

A good place to start is with one straightforward rule:

An unusual request gets verified — even when you recognize the person making it.

If an employee receives an unexpected request involving money, credentials, confidential information, or a change to normal procedures, they should verify it using a separate, trusted method.

For example, an employee could call the attorney or staff member back using a phone number already saved in the firm’s contacts rather than a number supplied during the questionable interaction.

They could also use a known internal communication channel to confirm the request.

For particularly sensitive transactions, some firms may consider establishing an agreed-upon verification word or another internal authentication procedure.

Verification Does Not Have to Slow Down Your Firm

The goal is not to make employees suspicious of every phone call or video conference.

Instead, teach them to recognize situations where an extra level of confirmation makes sense.

A routine conversation may not require additional verification. An unexpected request to immediately transfer thousands of dollars should.

Taking an extra thirty seconds to verify a high-risk request can be significantly easier than trying to recover money, investigate a security incident, notify affected parties, or determine what information was exposed after an employee acts on a fraudulent request.

Talk About Deepfakes Before Your Staff Encounters One

Cybersecurity procedures are most effective when employees already know what to do before something unusual happens.

During Cybersecurity Awareness Month, talk with your staff about how high-risk requests should be verified. Make sure employees understand that stopping to confirm a request is not an inconvenience — it is part of protecting the firm and its clients.

Employees should know exactly who to contact, which communication channels to use, and which types of requests require additional verification.

Because in the age of AI, “It sounded exactly like him” may no longer be enough.

A simple verification process gives your employees something much more reliable than instinct: a clear procedure they can follow when a request does not feel routine.

Next in Our Cybersecurity Awareness Month Series

Next, we’ll look at what happens when a criminal gets hold of something even more convincing: a real password.

October is Cybersecurity Awareness Month, making it a good time for law firms to revisit one of the most common cybersecurity threats their employees face: phishing.

For years, people were told to identify phishing emails by looking for obvious warning signs such as poor grammar, misspelled words, strange formatting, or awkward language. While those clues can still appear, relying on them alone is no longer enough.

Modern phishing messages can be polished, professional, and highly convincing. They may reference a real attorney, client, transaction, vendor, or internal business process. With AI making it easier to generate natural-sounding messages quickly, even a well-written email may deserve a second look.

The question employees should ask is no longer simply:

“Does this email look fake?”

A better question is:

“Is this person asking me to do something unusual?”

The Warning Signs Have Changed

Consider this scenario.

An employee receives an email that appears to come from a partner at the firm:

“I’m tied up. I need this wire sent immediately. Don’t call — I can’t answer.”

The email address may look right. The writing may sound professional. The request may even reference a legitimate matter.

The danger becomes clearer when you focus on the behavior of the request, rather than the appearance of the email.

Here are several elements law firm employees should learn to recognize.

1. Urgency

Phishing attempts often create pressure to act immediately.

A message may say a payment must be sent right away, a document needs to be opened before a deadline, or an account will be locked unless the recipient responds.

Urgency is effective because it reduces the amount of time people spend thinking about the request.

When a message pushes an employee to move unusually fast, that should be a signal to stop and verify.

2. Pressure to Bypass Normal Procedures

A particularly important warning sign is a request to ignore the firm’s established process.

Examples might include:

• Sending a wire without the usual approval.
• Changing banking information without confirming it.
• Providing confidential information through an unfamiliar method.
• Skipping a required phone verification.
• Being told not to contact the person making the request.

Legitimate requests should still be able to withstand normal verification procedures.

3. Unexpected Financial Changes

Law firms frequently handle money, settlement funds, invoices, retainers, and client transactions, which makes financial requests especially important to verify.

Employees should be cautious when a client suddenly provides new wire instructions, a vendor changes its banking information, or someone requests that money be sent to a different account than usual.

Even when the email looks legitimate, a financial change should be confirmed through a trusted channel.

4. Requests for Credentials or Confidential Information

Phishing is not limited to stealing money.

Attackers may also try to obtain usernames, passwords, documents, client information, access codes, or other sensitive data.

A request for credentials or confidential information that seems unusual—or that arrives through an unexpected channel—should trigger verification before anything is shared.

5. Instructions Not to Verify

One of the strongest warning signs may be an attempt to discourage verification.

Messages such as:

“Don’t call me.”

“I’m unavailable.”

“Just take care of this now.”

should receive additional scrutiny when paired with a sensitive or unusual request.

An attacker benefits when an employee feels that confirming the request would be inconvenient or inappropriate.

Create a Simple Verification Procedure

Law firms do not need an overly complicated policy to reduce this risk.

Start by defining which requests require additional verification. Financial transactions, changes to payment instructions, requests for credentials, and releases of confidential information are good places to begin.

Then determine how employees should verify those requests.

That could mean calling a phone number already stored in the firm’s records, contacting the person through a trusted internal channel, or following an established approval process.

Most importantly, employees should know that they have permission to stop before acting.

A simple statement can become an effective cybersecurity habit:

“Before I do this, I’m going to verify it.”

As phishing messages become more convincing, slowing down and verifying unusual behavior can be more valuable than trying to decide whether an email simply “looks fake.”

Cybersecurity Awareness Month is an excellent opportunity to make that expectation clear across your law firm.

I just got back from playing a round of golf, and while I had a great time thanks to my playing partner, my actual game was pretty lousy. Like most golfers, on the drive home I caught myself thinking: maybe it’s time for a new putter, a different set of clubs, or a new brand of golf balls.

But then it hit me — my clubs didn’t suddenly get worse in the past two weeks. My golf balls didn’t change. And my putter didn’t lose its magic. The truth was simple: it wasn’t the equipment, it was me.

My tempo was off. I was swinging too fast. I wasn’t focused. And that got me thinking: the same thing happens in business — especially in law firms.

The “Equipment” Problem in Law Firms

When something goes wrong in a firm — a missed statute of limitations, a conflict of interest issue, or a client complaint — our first instinct is often to blame the system.

• “The calendaring program let us down.”
  
• “The conflict checker didn’t catch it.”
  
• “We need a better case management tool.”
  

That knee-jerk reaction leads many attorneys to shop for the “latest and greatest” software. But just like with golf, buying new equipment doesn’t always solve the problem.

It’s Not the Tools, It’s the Process

Before rushing out to invest in new programs, it’s worth asking: Are we using the systems we already have, properly and consistently?

A few examples to consider:

• Calendaring systems: Are you and your staff updating them daily without fail?
  
• Conflict of interest checks: Are all clients, former clients, and ownership interests properly logged?
  
• Client documentation: Are you recording every conversation, every update, in the system right away — or are you telling yourself you’ll “do it later” and never getting back to it?
  

When these steps slip, it’s not the software that failed. It’s the process.

A Weekly (or Bi-Weekly) Check-In

The fix isn’t shiny new tools. It’s discipline. Take a few minutes each week — or at least every two weeks — to sit down with your team and review:

• Are we updating systems the way we should?
  
• Are we putting in accurate, complete information?
  
• Are we letting bad habits slide?
  

Your systems are only as good as the information you feed into them. If you don’t use them consistently, even the most expensive software won’t save you.

Back to the Golf Course

Golf taught me this: you don’t need a brand-new set of clubs every time you have a bad round. You need to slow down, adjust your swing, and focus on the fundamentals.

In the same way, law firms don’t always need new programs when mistakes happen. They need to look inward, review processes, and make sure the team is disciplined in using the systems already in place.

Remember: success isn’t about the latest equipment — it’s about how you use it.

I recently read something eye-opening in an insurance journal — a reminder that cybercrime isn’t just evolving, it’s organizing.

There are now cybercriminal groups that no longer just pick off random companies with weak cybersecurity. Instead, they target entire industries, strategically identifying and exploiting vulnerabilities across the sector. 

One such group is known as Scattered Spider, and their newest target? The insurance industry.

In recent months alone, major players like Philadelphia Insurance Company, Erie Insurance, and Aflac have been hit with significant cyberattacks. These breaches not only disrupted their operations, but in Erie’s case, have already led to multiple class action lawsuits.

Let’s think about that…

These are companies that:

• Handle sensitive data every day
• Have risk management baked into their company DNA
• Invest hundreds of thousands of dollars (if not millions) into cybersecurity infrastructure
  

… and they still got breached.

So here’s the question every law firm should be asking:

If these highly protected insurance companies aren’t safe, what makes you think your firm is?

The Ugly Truth – Law Firms Are Prime Targets

You might be thinking, “We’re a law firm — not an insurance company. Why would hackers bother with us?”

Here’s why:

• You store the same type of sensitive data: personal information, financial records, privileged communications.
• You likely don’t have the same kind of IT budget or internal safeguards that large insurers do.
• And from a hacker’s perspective, that makes you low-hanging fruit.
  

Whether you’re a solo practitioner in Pittsburgh or part of a mid-sized firm in Cleveland, you’re exposed — and attackers know it.

The Smart Next Step For Your Firm: Cyber Liability Insurance

Even if you have antivirus software, firewalls, and employee training in place (and you should), there’s another essential layer of protection… 

A tailored cyber liability insurance policy.

This isn’t just about protecting your firm — it’s about protecting your clients and your reputation. A single breach can take down your operations, cost tens of thousands in recovery, and damage your trust with clients.

Cyber policies are more affordable than most firms realize, especially compared to the cost of recovering from an attack.

Want to Learn More?

I go deeper into these risks and solutions in my book, Game Over? Not Today! 

It’s written specifically for professionals like you — attorneys, advisors, and business owners who want to understand the threat landscape and take action before it’s too late.

Pick up my free book today here -> https://bit.ly/INF-Game-Over-Not-Today 

Stop procrastinating. Protect your firm, your data, and your clients.

If you’re in Pennsylvania or Ohio and want to explore your cyber coverage options, I’d be happy to help.

I’m Don Ivol — your insurance guy.