In short
Cyber security for law firms means protecting client money, confidential information and the email accounts that matters run on. The SRA requires firms to safeguard client money and assets but leaves the steps to them. Forever Systems supplies and manages 24/7 vendor MDR, email security and identity protection that help firms meet that duty.
Get a quote for cyber security for law firms
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
Why law firms are targeted
Law firms combine three things attackers look for. They move client money, often in large sums at predictable moments such as property completions. They hold confidential and commercially sensitive information that can be stolen, leaked or held to ransom. And much of their work runs over email, with clients, other firms, estate agents and lenders, which gives fraudsters plenty of opportunity to impersonate someone a client trusts.
The SRA's own cybercrime guidance notes that firms have been shut down after being tricked into paying money out to fraudsters. The NCSC published a dedicated cyber threat report for the UK legal sector in June 2023, setting out the threats facing the profession and practical guidance on resilience.
The main threats to plan for are:
- Payment diversion and business email compromise: a mailbox is taken over or spoofed and used to change bank details on a completion statement or invoice
- Microsoft 365 account takeover: a fee earner's password is phished, mailbox rules are set up quietly and correspondence is watched for the right moment
- Ransomware: files and case management systems are encrypted, often at a weekend, and data may be stolen first
- Data theft: confidential client information is copied out and used for extortion
What the SRA expects
The SRA treats cybercrime as a priority risk. Its Code of Conduct requires firms (rule 5.1 of the Code of Conduct for Firms) and individuals (rule 4.2 of the Code of Conduct for Solicitors, RELs and RFLs) to safeguard money and assets entrusted to them by clients and others.
Importantly, the SRA does not dictate what specific steps firms should take. It expects each firm to identify its own threats and respond in proportion, and it points firms to the National Cyber Security Centre, the Cyber Essentials scheme and the Law Society's cyber security guidance.
That leaves firms to decide what reasonable protection looks like. For most, that now means the basics certified through Cyber Essentials, staff who can recognise fraud attempts, and someone watching for attacks out of hours. Cyber Essentials for law firms covers the certification side, and UK GDPR adds a duty to report personal data breaches that pose a risk to the Information Commission (formerly the ICO) within 72 hours where feasible.
Email and identity: where most law firm attacks start
Because so much legal work runs through email, email and identity protection usually come first. A managed approach combines technology with process:
| Layer | What it does | Services we supply |
|---|---|---|
| Email security | Catches phishing, impersonation and lookalike domains that get past standard filtering, and removes malicious messages after delivery | Check Point Email Security (formerly Harmony Email & Collaboration), IRONSCALES Email Protect, Email Protect Pro and Complete Protect, Perception Point, now part of Fortinet (with a managed 24/7 incident response service included) |
| Identity threat detection | Watches Microsoft 365 and Entra ID for suspicious sign-ins, risky mailbox rules and account takeover, and can act on compromised accounts | Blackpoint ITDR (can suspend accounts, end sessions and force password resets), Sophos ITDR |
| Multi-factor authentication | Blocks many attacks that rely on a stolen password alone | Cisco Duo or Microsoft's own MFA |
| Staff awareness | Helps people spot a changed bank detail or an unusual request | Business email compromise training |
Technology works best alongside a clear process, such as confirming any change of bank details by a known telephone number taken from the file rather than from the email. We can help you put the technical controls in place and keep them tuned; see managed email security services and managed ITDR for detail.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
24/7 detection and response for law firms
Email protection reduces the number of attacks that get through; managed detection and response deals with the ones that do. A vendor SOC watches your laptops, servers and Microsoft 365 accounts around the clock, investigates suspicious activity and contains confirmed threats within limits you agree, for example by isolating a device that has started encrypting files.
Vendor services we supply that suit firms of different sizes include Sophos MDR, Check Point MDR, Blackpoint, ThreatDown MDR, WatchGuard MDR and CrowdStrike Falcon Complete Next-Gen MDR. Some work with the Microsoft Defender tools you may already license; see MDR for Microsoft Defender. Our vendors page compares tiers, coverage and licensing units.
The response authority you give the SOC deserves thought. Sophos MDR, for instance, offers Authorize, Collaborate and Notify Only modes, so a firm can decide whether the vendor acts straight away or works with its IT provider first. For larger firms, an incident response retainer adds specialist investigators and proactive work such as tabletop exercises.
How our model works. Forever Systems does not run its own security operations centre. The 24/7 monitoring, investigation and response come from the vendor service you choose, run by that vendor's security analysts. We recommend the service, set it up, manage it, act as your escalation point and review it with you. Who does what is written down and confirmed at quote.
When the SOC finds something
It helps to know in advance what an alert looks like from the firm's side, because the first hour of an incident is not the time to work out who decides what. With a managed service in place, a typical sequence is:
| Stage | Who acts | What it looks like for the firm |
|---|---|---|
| Detection | Vendor SOC | Suspicious activity on a device or Microsoft 365 account is picked up and investigated by the vendor's analysts |
| Containment | Vendor SOC, within the permissions you set | A device is isolated, a process stopped or, with identity services, an account suspended or its sessions ended |
| Escalation | Vendor SOC to Forever Systems and your named contacts | You are told what happened, what has been done and what needs a decision, through the contacts agreed during onboarding |
| Follow-up | Forever Systems with your IT provider | Clean-up, password resets, restoring affected devices and reviewing what let the attack in |
| Reporting | Your firm | Deciding whether clients, insurers, the SRA or the Information Commission need to be told, using the facts from the vendor's case report |
Writing this down with your COLP, practice manager and IT provider before anything happens is one of the most useful things a firm can do. We help you agree the escalation contacts, out-of-hours decision makers and response permissions during onboarding, and help you keep them current as people join and leave.
Is cyber security for law firms the right fit for you?
We will check it against your systems and requirements and recommend the right option.
A practical starting point
For a small or mid-sized firm, a sensible first phase usually looks like this:
- Certify to Cyber Essentials, or check that your current controls still meet it.
- Turn on MFA for every Microsoft 365 account and remote access route.
- Add email security that inspects mail inside Microsoft 365 and removes malicious messages after delivery.
- Add 24/7 vendor MDR on endpoints, with identity threat detection for Microsoft 365.
- Train staff on payment diversion and phishing, and agree a call-back process for bank detail changes.
- Make sure backups are separate from the systems they protect and that restores are tested.
Not every firm needs every layer at once, and we can help you decide what can wait. Our page on managed security services for small business covers right-sized options in more detail.
How we work with law firms
We can review your current email, identity, endpoint and backup set-up, recommend vendor services that fit your firm's size and the tools you already use, set them up and manage them, and act as the escalation point between the vendor SOC and your firm. We do not give legal or regulatory advice; your COLP and advisers decide how the SRA's requirements apply. Security awareness training for law firms covers the people side.
Responsibilities are confirmed at quote, and pricing depends on users, devices and the services chosen, so ask us for a quote. Contact us to talk through protecting your firm and your clients' money.
How Forever Systems helps with managed security
We do not run our own security operations centre. The round-the-clock monitoring, investigation and response come from managed detection and response services that established security vendors already run at scale. Our part is choosing the right one for you, setting it up properly and staying involved.
- Independent recommendation: we supply several vendor MDR, XDR and SIEM services, including Sophos MDR, Check Point MDR and Cisco XDR, so we can suggest the one that fits the tools you already own
- Setup and onboarding: we can deploy agents, connect integrations such as Microsoft 365 and work with the vendor through tuning
- Clear responsibilities: escalation contacts, response permissions and who does what are agreed with you in writing and confirmed at quote
- Ongoing management: we help with policy changes, exclusions, renewals and regular service reviews
- Wider security too: security awareness training, Cyber Essentials and cloud security advice
We work with businesses, schools, charities and public sector organisations across the UK.
Frequently asked questions
What does the SRA require for cyber security?
The SRA requires firms and individuals to safeguard money and assets entrusted to them by clients and others (rule 5.1 of the Code of Conduct for Firms and rule 4.2 for individuals). It does not dictate specific steps, and points firms to the NCSC, Cyber Essentials and the Law Society's cyber security guidance.
Why are law firms targeted by cyber criminals?
Law firms handle client money, hold confidential information and run much of their work by email, which makes them attractive for payment diversion fraud, account takeover, ransomware and data theft.
How can law firms prevent payment diversion fraud?
Combine technical controls such as MFA, email security and identity threat detection with a process for verifying bank detail changes through a known contact number, and train staff to recognise the signs. No single control stops every attempt.
Do law firms need Cyber Essentials?
The SRA points firms to the Cyber Essentials scheme, and clients or insurers may ask for it. It is a sensible baseline, though it does not include monitoring or response.
Does Forever Systems run its own SOC for law firms?
No. The 24/7 monitoring and response come from the vendor service you choose, such as Sophos MDR or Check Point MDR. Forever Systems recommends the service, sets it up, manages it and handles escalation with you.
Still have a question about cyber security for law firms?
Ask us and a member of our team will reply by email.