Cybersecurity has become a business issue, not just an IT issue, especially for law firms and architecture and engineering (A/E) firms entrusted with sensitive client information.
During our recent webinar, The Reality of Cybersecurity in Law and A/E Firms: What Clients Expect, our cybersecurity professionals discussed the evolving threat landscape, the growing role of vendor risk and the steps firms can take to meet increasing client expectations around cybersecurity. The conversation highlighted a common theme: clients are no longer asking if cybersecurity matters. They're asking how your firm is managing it.
Here are some of the key takeaways from the discussion.
Prefer to watch instead of read? The full webinar recording is here. 👇
Why Law & A/E Firms Are Attractive Targets
Cybercriminals aren't casting wide nets the way they once did. Today's attackers often target specific industries that handle valuable information, operate under tight deadlines and rely heavily on trust.
For law firms, that may include:
-
Confidential client communications
-
Litigation and transaction documents
-
Financial information
-
Intellectual property
For A/E firms, it may include:
-
Proprietary designs
-
Project specifications
-
Client contracts
-
Critical infrastructure information
What makes these organizations particularly attractive is that the data doesn't just belong to the firm. It belongs to clients.
Add in project deadlines, regulatory requirements and reputational considerations, and threat actors know they have leverage.
The Biggest Cybersecurity Mistake We See
One of the most common issues we encounter is that firms wait until something happens before taking cybersecurity seriously.
Maybe a mailbox gets compromised. Maybe ransomware brings operations to a halt.
Maybe a client sends a security questionnaire that the organization struggles to answer.
The response is often immediate: new tools are deployed, settings get tightened and vulnerabilities are addressed.
But after that initial effort, progress stops.
Cybersecurity isn't a one-time project. Threats evolve constantly, which means your defenses must evolve as well.
Vendor Risk Has Become a Business Risk
Your cybersecurity posture is only as strong as the vendors, platforms and service providers that support your business.
Every application, cloud platform, technology vendor and third-party partner introduces some level of risk.
Consider a few examples:
-
A software vendor suffers a breach and pushes compromised code through a routine update
-
An AI platform stores sensitive information in ways that don't align with your firm's privacy requirements
-
A former vendor retains access to systems long after an engagement has ended
These scenarios aren't hypothetical. They're increasingly common.
That's why vendor risk management should be part of every firm's cybersecurity program. Reputable vendors should be able to clearly demonstrate the controls, certifications and security practices they have in place to protect client data.
MFA Is Essential, But It Isn't Enough
Multi-factor authentication (MFA) remains one of the most effective cybersecurity controls available today.
However, many organizations mistakenly view MFA as the finish line. It isn't.
Modern attackers have become skilled at finding ways around traditional authentication methods. In some cases, they don't need your password at all. Instead, they trick users into authorizing access through seemingly legitimate applications or services.
The lesson is simple: MFA is a critical layer of protection, but it should be part of a broader cybersecurity strategy, not the entire strategy.
You Can't Protect What You Don't Monitor
One of the biggest misconceptions about cyberattacks is that they're loud and obvious.
In reality, attackers often spend days, weeks or even months inside a network before taking any action that draws attention.
During this time, they may:
-
Study your environment
-
Identify critical systems
-
Gather sensitive information
-
Learn employee relationships
-
Establish ways to maintain access
By the time ransomware is deployed, or data is stolen, the real damage may have already occurred.
That's why visibility and monitoring matter.
Organizations need the ability to detect unusual activity early, investigate quickly and respond before a small issue becomes a major business disruption.
Incident Response Plans Matter More Than You Think
If a security incident happened tomorrow, would your firm know exactly what to do?
Many organizations have an incident response plan sitting on a shelf somewhere. Far fewer have actually tested it.
A strong incident response plan should answer questions such as:
-
Who makes key decisions during an incident?
-
Who communicates with clients and stakeholders?
-
How are compromised accounts contained?
-
What systems should be isolated?
-
Who needs to be contacted and when?
The best plans aren't just documented. They're practiced.
Running tabletop exercises can reveal gaps, clarify responsibilities and help organizations respond with confidence when real incidents occur.
What Clients Are Looking For
Clients don't necessarily expect perfection. What they do expect is evidence that cybersecurity is being taken seriously.
Increasingly, firms are being asked to provide security questionnaires, documentation and proof of cybersecurity controls before engagements begin.
A strong cybersecurity program should include:
-
Documented security policies
-
Multi-factor authentication
-
Security awareness training
-
Vendor risk management processes
-
Endpoint detection and response tools
-
Regular patching and updates
-
Data classification and encryption
-
Backup and disaster recovery planning
-
Ongoing risk assessments
Just as importantly, firms should be able to explain these controls in a way that clients can understand.
Many organizations benefit from creating a concise, client-facing security overview that outlines the steps being taken to protect sensitive information without revealing proprietary details.
From Reactive to Risk-Based Cybersecurity
The firms best positioned for long-term success are adopting a risk-based approach to cybersecurity.
Rather than constantly reacting to the latest threat, they focus on understanding risk, implementing appropriate controls and continuously improving their security program over time.
That means:
-
Reviewing risks regularly
-
Evaluating vendors and new technologies
-
Testing security controls
-
Updating policies and procedures
-
Training employees
-
Monitoring for emerging threats
Cybersecurity becomes part of normal business operations instead of a series of emergency responses.
The Big Idea
For law firms and A/E firms, cybersecurity is no longer just about protecting technology. It's about protecting client trust.
Clients, vendors, insurance carriers and business partners increasingly expect firms to demonstrate that they have a mature, documented and proactive approach to cybersecurity.
Organizations that treat cybersecurity as an ongoing business process, rather than an IT project, are better positioned to reduce risk, strengthen client confidence and respond effectively when threats arise.
Need Help?
Whether you're responding to client security questionnaires, evaluating cybersecurity risks or building a more mature security program, it can be difficult to know where to start.
Our Managed IT, Cybersecurity & Advisory Services Group helps law firms and A/E firms identify vulnerabilities, strengthen security controls and align cybersecurity efforts with business goals.
Contact us here or call 800.899.4623 to schedule a conversation or learn more about our cybersecurity assessments and managed security services.
