This is the final article in our Cybersecurity Awareness Month series, and over the last few weeks we’ve covered several practical ways law firms can reduce cyber risk.

We’ve talked about phishing, AI impersonation, passwords, multi-factor authentication, and protecting sensitive information when using AI tools.

Every one of those protections matters.

Law firms should train employees. They should use MFA. They should establish strong policies, verification procedures, and clear rules around sensitive data.

But there is one important reality that every firm also needs to recognize:

You cannot completely train human error out of your organization.

Even with good cybersecurity practices in place, something can still go wrong.

Cybersecurity Reduces Risk, But It Does Not Eliminate It

Eventually, an employee may click something they should not.

Someone may respond to a very convincing phishing email.

A vendor your firm relies on could experience a security incident.

An employee could accidentally send sensitive information to the wrong person or approve a request that appears legitimate.

Cybersecurity controls are designed to make those events less likely and reduce the damage when they occur.

But they cannot guarantee that an incident will never happen.

That is why law firms need to think about cybersecurity in layers.

Your Firm’s Cybersecurity Layers May Include:

• Employee cybersecurity training
• Multi-factor authentication
• Strong password practices
• Email and network security tools
• Internal verification procedures
• AI and data-handling policies
• Incident response planning
• Cyber liability insurance

Each layer serves a different purpose.

Cyber liability insurance is there to help address the financial and operational risks that remain after preventive measures have been put in place.

A Cyber Incident Creates Immediate Questions

When something goes wrong, the situation can become complicated very quickly.

Firm leadership may suddenly need answers to questions such as:

Was client information accessed?

Do systems need to be shut down?

Can attorneys and employees continue working?

Do affected clients or other parties need to be notified?

Does the firm need forensic investigators, legal counsel, or other outside specialists?

Was money transferred fraudulently?

And perhaps most importantly from an insurance standpoint: What does the firm’s policy require it to do next?

That is not the ideal time to start reading your cyber policy for the first time.

Understand Your Cyber Coverage Before an Incident

Cyber insurance policies can differ significantly, so law firms should understand how their coverage is structured before they need to use it.

The goal is not simply to confirm that a policy exists.

The firm should understand what types of incidents may be covered, what limits apply, and what response resources are available.

Areas Law Firms Should Review

Depending on the policy, law firms may want to discuss coverage related to:

• Ransomware and cyber extortion
• Data breaches
• Business email compromise
• Social engineering
• Fraudulent wire transfers
• Business interruption
• Incident response and forensic expenses
• Legal and notification costs

Firms should also pay attention to policy limits and sublimits.

A policy may include a large overall limit while placing smaller sublimits on particular types of losses. Understanding those details before an event can help prevent surprises later.

Know What Response Resources Come With the Policy

Cyber insurance may also provide access to professionals who can help the firm respond to an incident.

Depending on the coverage, that could include forensic investigators, breach counsel, notification services, public relations resources, or other specialists.

Law firms should know who to contact and what steps are required under the policy before engaging outside vendors on their own.

A response plan is far more useful when the firm already understands how insurance fits into it.

Cyber Liability Insurance Is the Financial Backstop

The cybersecurity training we’ve discussed this month is one layer of protection.

Technology is another.

Policies and internal procedures are another.

Cyber liability insurance is the financial backstop for the risk that remains.

As Cybersecurity Awareness Month comes to an end, take one more practical step: pull out your cyber policy and review it with your insurance professional.

If you are not confident that your current coverage would protect your firm after a cyber incident, reach out to us. We can help you review what you have, identify potential gaps, and better understand how your coverage would respond.

Because the time to find a hole in your cyber insurance is before an incident — not after.

October is Cybersecurity Awareness Month, and this is part four of our five things every law firm should know to better protect its people, clients, systems, and data.

Law firms are using artificial intelligence more often, and that trend is not likely to slow down.

AI can help with writing, brainstorming, summarizing information, research, internal communications, and a growing list of everyday tasks. Used appropriately, it can save time and improve productivity.

But every law firm needs to answer one important question before AI use becomes routine:

What information are employees allowed to put into an AI system?

Without clear guidance, employees may make that decision on their own each time they use a tool. That creates unnecessary risk, especially when client information or confidential business data is involved.

Not Every AI Task Carries the Same Risk

There is a major difference between asking an AI tool to rewrite a generic email and pasting a confidential client document into that same system.

Imagine an employee thinks:

“I’ll just paste this document into AI and ask it to summarize it.”

Before doing that, the employee should stop and consider what the document actually contains.

Sensitive Information May Include:

• Client names or identifying details
• Financial information
• Medical information
• Confidential business information
• Settlement details
• Information from an active legal matter
• Personally identifiable information
• Internal firm information that is not intended for public disclosure

A document does not have to be marked “confidential” to contain information that deserves additional protection.

The problem is that employees should not have to analyze these risks from scratch every time they want to use AI.

Every Law Firm Should Have a Basic AI Policy

A clear AI policy can give employees practical rules they can follow before entering information into an AI platform.

The policy does not need to be complicated, but it should answer some basic questions.

Your AI Policy Should Address:

• Which AI tools are approved for firm use?
• Which employees are permitted to use them?
• What types of information may be entered?
• What types of information are prohibited?
• Can confidential client information ever be used?
• Should identifying details be removed before information is entered?
• Who should employees ask when they are unsure?

Giving employees specific guidance is much safer than relying on everyone to make an individual judgment call.

An Approved AI Tool Does Not Mean Everything Is Approved

One important distinction for law firms is the difference between approving an AI platform and approving every possible use of that platform.

Your firm may decide that a particular AI system is acceptable for certain business purposes. That does not necessarily mean employees should upload confidential documents, client records, medical information, financial data, or other sensitive material into it.

Approval of the tool should not automatically equal approval of the data.

Employees still need to understand what information may be used and under what circumstances.

Remove Sensitive Information Whenever Possible

One practical way to reduce risk is to remove unnecessary identifying information before using AI.

For example, an employee who wants help improving the wording of a generic client communication may not need to include the client’s name, case number, financial information, or specific facts about the matter.

Instead, the employee may be able to describe the situation in general terms and still receive a useful response.

Ask Whether the AI Really Needs That Detail

Before entering information into an AI system, employees can ask themselves a simple question:

Does the AI actually need this information to complete the task?

If the answer is no, leave it out.

The less sensitive information that is entered unnecessarily, the lower the potential exposure.

Productivity Should Not Come at the Expense of Confidentiality

AI can absolutely make law firms more efficient.

The goal should not be to prevent employees from using useful technology. It should be to establish boundaries so employees understand how to use it responsibly.

Clear expectations can also make employees more comfortable using approved tools because they do not have to guess where the line is.

Cybersecurity Awareness Month is a good opportunity to bring this topic into your next staff meeting and ask:

Does everyone in our firm know what they are — and are not — allowed to put into AI?

If the answer is unclear, now is a good time to establish the rules.

Next in Our Cybersecurity Awareness Month Series

Even strong policies and security practices cannot eliminate every possible risk.

In the final part of our series, we’ll look at the cybersecurity topic nobody likes to think about: what your law firm should do when something still goes wrong.

October is Cybersecurity Awareness Month, and this is part three of our five things every law firm should know to better protect its people, clients, systems, and data.

Cybersecurity can feel complicated, but some of the most effective protections are also some of the simplest.

One of the most important rules law firms can follow is this:

One stolen password should not be enough to get into your law firm.

Passwords are still a major part of how employees access email, cloud platforms, practice management systems, financial accounts, and other important tools. But a password alone may not provide enough protection if it is reused, guessed, exposed, or stolen.

That is where stronger password practices and multi-factor authentication can make a significant difference.

Why Password Reuse Creates Risk

People reuse passwords because it is convenient.

An employee may use the same password for multiple accounts or create small variations of a password they have relied on for years. Others may use information that is easy to remember, such as a pet name, birthday, family member’s name, or familiar phrase.

The problem is that criminals do not always need to directly “hack” a law firm to obtain a password.

Passwords can be exposed in a breach involving another website or service. They may be guessed, stolen through phishing, or voluntarily entered into a fake login page.

Once criminals obtain a username and password combination, they may try those credentials on other services to see where else they work.

If an employee has reused the same password, one compromised account could potentially create risk for several others.

Give Important Accounts Unique Passwords

A strong first step is to make sure important accounts have unique passwords.

That means the password used for an employee’s law firm email should not also be used for a personal shopping account, social media profile, or another business application.

The challenge, of course, is remembering all of those different passwords.

Consider Using a Password Manager

A reputable password manager can help employees generate and securely store unique passwords without requiring them to memorize every credential.

Instead of relying on predictable variations of the same password, employees can use longer, randomly generated passwords for individual accounts.

This reduces the risk that a password exposed somewhere else can simply be reused to access a law firm’s systems.

But unique passwords are only one layer of protection.

Add Multi-Factor Authentication

Multi-factor authentication, commonly called MFA, adds another verification step when someone signs into an account.

The basic idea is simple.

If a criminal steals an employee’s password, the password alone should not automatically give that person access.

The system requires an additional form of verification before completing the login.

MFA can significantly strengthen account security because an attacker who obtains a password still has another barrier to overcome.

Which Law Firm Accounts Should Get Priority?

Law firms should pay particular attention to systems that contain confidential information or provide access to important business functions, including:

• Email accounts
• Practice management software
• Cloud storage platforms
• Financial and banking systems
• Document management systems
• Accounts containing sensitive client information

Whenever MFA is available for these systems, firms should evaluate whether it is enabled and properly configured.

Why Email Deserves Special Attention

Email is especially important because it often acts as a gateway to other information.

A compromised attorney or staff email account may expose conversations about clients, invoices, payments, settlements, transactions, and internal procedures.

It can also give a criminal something extremely valuable: the ability to communicate while appearing to be someone inside the firm.

That can make fraudulent requests much more convincing.

For example, a criminal who gains access to an attorney’s email may be able to study existing conversations and then send a payment request that appears to fit naturally into an ongoing matter.

Protecting email accounts with unique passwords and MFA can help reduce that risk.

Keep the Cybersecurity Rule Simple

Employees do not need to become cybersecurity experts to improve account security.

Start with three straightforward practices:

Unique passwords. A password manager. MFA.

Review the systems your firm relies on most and determine where these protections are already in place and where improvements may be needed.

If you are not sure whether MFA is enabled on your firm’s most important accounts, Cybersecurity Awareness Month is a good time to ask your IT provider.

A few basic changes today can make it much harder for one stolen password to become a much larger security problem.

Next in Our Cybersecurity Awareness Month Series

Next, we’ll look at a different cybersecurity question many law firms are only beginning to address: what employees are putting into AI tools.

October is Cybersecurity Awareness Month, and this is part two of our five things every law firm should know to better protect its people, clients, finances, and data.

In our first article, we talked about phishing emails and why employees can no longer rely on obvious spelling mistakes or poor grammar to identify a suspicious message. But what happens when the request does not arrive by email at all?

What if it comes from a voice your employee recognizes?

Advances in artificial intelligence are making it increasingly possible to imitate voices and create convincing fake video. For law firms, that creates a new cybersecurity challenge: hearing or even seeing someone may no longer be absolute proof that the person is really who they claim to be.

Imagine This Happening at Your Law Firm

Your bookkeeper receives a phone call from one of the firm’s partners.

The voice sounds familiar. The partner seems rushed and says something like:

“I need you to send a wire right now. I’m walking into a meeting, so I can’t stay on the phone.”

The request sounds legitimate. The voice sounds right. There may not be anything obviously suspicious about the call.

Would your employee send the money?

The problem is that the person on the other end of the phone may not actually be the partner.

AI Is Changing How Firms Need to Think About Identity

AI technology can be used to create convincing imitations of a person’s voice. Similar technology can also generate or manipulate video.

That means one of the assumptions employees have traditionally relied on — “I know what this person sounds like” — may not provide enough protection for a high-risk transaction.

This is especially important for law firms because employees routinely work with sensitive information and high-value transactions.

High-Risk Requests May Include:

• Wire transfers or other financial transactions
• Passwords or account credentials
• Confidential client information
• Settlement funds
• Changes to payment instructions
• Requests to bypass established procedures
• Access to sensitive documents or systems

These requests deserve additional verification, regardless of how convincing the person making the request may sound.

Create One Simple Verification Rule

Law firms do not need complicated procedures for every phone call.

A good place to start is with one straightforward rule:

An unusual request gets verified — even when you recognize the person making it.

If an employee receives an unexpected request involving money, credentials, confidential information, or a change to normal procedures, they should verify it using a separate, trusted method.

For example, an employee could call the attorney or staff member back using a phone number already saved in the firm’s contacts rather than a number supplied during the questionable interaction.

They could also use a known internal communication channel to confirm the request.

For particularly sensitive transactions, some firms may consider establishing an agreed-upon verification word or another internal authentication procedure.

Verification Does Not Have to Slow Down Your Firm

The goal is not to make employees suspicious of every phone call or video conference.

Instead, teach them to recognize situations where an extra level of confirmation makes sense.

A routine conversation may not require additional verification. An unexpected request to immediately transfer thousands of dollars should.

Taking an extra thirty seconds to verify a high-risk request can be significantly easier than trying to recover money, investigate a security incident, notify affected parties, or determine what information was exposed after an employee acts on a fraudulent request.

Talk About Deepfakes Before Your Staff Encounters One

Cybersecurity procedures are most effective when employees already know what to do before something unusual happens.

During Cybersecurity Awareness Month, talk with your staff about how high-risk requests should be verified. Make sure employees understand that stopping to confirm a request is not an inconvenience — it is part of protecting the firm and its clients.

Employees should know exactly who to contact, which communication channels to use, and which types of requests require additional verification.

Because in the age of AI, “It sounded exactly like him” may no longer be enough.

A simple verification process gives your employees something much more reliable than instinct: a clear procedure they can follow when a request does not feel routine.

Next in Our Cybersecurity Awareness Month Series

Next, we’ll look at what happens when a criminal gets hold of something even more convincing: a real password.

October is Cybersecurity Awareness Month, making it a good time for law firms to revisit one of the most common cybersecurity threats their employees face: phishing.

For years, people were told to identify phishing emails by looking for obvious warning signs such as poor grammar, misspelled words, strange formatting, or awkward language. While those clues can still appear, relying on them alone is no longer enough.

Modern phishing messages can be polished, professional, and highly convincing. They may reference a real attorney, client, transaction, vendor, or internal business process. With AI making it easier to generate natural-sounding messages quickly, even a well-written email may deserve a second look.

The question employees should ask is no longer simply:

“Does this email look fake?”

A better question is:

“Is this person asking me to do something unusual?”

The Warning Signs Have Changed

Consider this scenario.

An employee receives an email that appears to come from a partner at the firm:

“I’m tied up. I need this wire sent immediately. Don’t call — I can’t answer.”

The email address may look right. The writing may sound professional. The request may even reference a legitimate matter.

The danger becomes clearer when you focus on the behavior of the request, rather than the appearance of the email.

Here are several elements law firm employees should learn to recognize.

1. Urgency

Phishing attempts often create pressure to act immediately.

A message may say a payment must be sent right away, a document needs to be opened before a deadline, or an account will be locked unless the recipient responds.

Urgency is effective because it reduces the amount of time people spend thinking about the request.

When a message pushes an employee to move unusually fast, that should be a signal to stop and verify.

2. Pressure to Bypass Normal Procedures

A particularly important warning sign is a request to ignore the firm’s established process.

Examples might include:

• Sending a wire without the usual approval.
• Changing banking information without confirming it.
• Providing confidential information through an unfamiliar method.
• Skipping a required phone verification.
• Being told not to contact the person making the request.

Legitimate requests should still be able to withstand normal verification procedures.

3. Unexpected Financial Changes

Law firms frequently handle money, settlement funds, invoices, retainers, and client transactions, which makes financial requests especially important to verify.

Employees should be cautious when a client suddenly provides new wire instructions, a vendor changes its banking information, or someone requests that money be sent to a different account than usual.

Even when the email looks legitimate, a financial change should be confirmed through a trusted channel.

4. Requests for Credentials or Confidential Information

Phishing is not limited to stealing money.

Attackers may also try to obtain usernames, passwords, documents, client information, access codes, or other sensitive data.

A request for credentials or confidential information that seems unusual—or that arrives through an unexpected channel—should trigger verification before anything is shared.

5. Instructions Not to Verify

One of the strongest warning signs may be an attempt to discourage verification.

Messages such as:

“Don’t call me.”

“I’m unavailable.”

“Just take care of this now.”

should receive additional scrutiny when paired with a sensitive or unusual request.

An attacker benefits when an employee feels that confirming the request would be inconvenient or inappropriate.

Create a Simple Verification Procedure

Law firms do not need an overly complicated policy to reduce this risk.

Start by defining which requests require additional verification. Financial transactions, changes to payment instructions, requests for credentials, and releases of confidential information are good places to begin.

Then determine how employees should verify those requests.

That could mean calling a phone number already stored in the firm’s records, contacting the person through a trusted internal channel, or following an established approval process.

Most importantly, employees should know that they have permission to stop before acting.

A simple statement can become an effective cybersecurity habit:

“Before I do this, I’m going to verify it.”

As phishing messages become more convincing, slowing down and verifying unusual behavior can be more valuable than trying to decide whether an email simply “looks fake.”

Cybersecurity Awareness Month is an excellent opportunity to make that expectation clear across your law firm.