Industries

Cyber security for solicitors

Managed cyber security for law firms. Stop conveyancing payment fraud, keep confidential client files out of criminals' hands, and show the SRA, your insurer and your clients that you take it seriously.

Why solicitors are targeted

Law firms hold two things criminals want: client money passing through on its way to somewhere else, and confidential information that clients trust you to keep private.

Conveyancing makes the money especially attractive. Large sums move on a known day, between people who mostly communicate by email. An attacker who gets into a mailbox, at your firm or your client's, can watch a transaction for weeks and step in at exactly the right moment with "updated" bank details.

What we see

Conveyancing payment fraud

A criminal intercepts the emails around a purchase and sends new bank details, apparently from your firm or the client, just before completion. Often called Friday afternoon fraud, it can take a client's entire deposit.

Your firm being impersonated

Fake emails, look-alike domains and cloned websites using your firm's name to trick clients and other firms into paying the wrong account.

Confidential files

Case files, wills, family and employment matters hold some of the most sensitive information there is. A breach damages clients and your reputation, and may need reporting to the ICO and the SRA.

Ransomware before a deadline

Losing access to case files and the case management system stops work, and attacks are usually launched outside business hours, when nobody is watching.

What clients, insurers and regulators expect

  • The SRA. Firms must protect client money and keep clients' affairs confidential, and are expected to report serious problems to the SRA promptly. A cyber attack that leads to lost client money or exposed client information can fall into that.
  • UK GDPR. Your firm is responsible for the personal data it holds. A breach that puts people at risk must be reported to the ICO within 72 hours of you becoming aware of it.
  • Insurers. Professional indemnity and cyber insurers ask about multi-factor authentication, email security, device protection and monitoring, and payment fraud claims are a major concern for them.
  • Clients and lenders. Corporate clients and lender panels increasingly send security questionnaires before they work with a firm.
What we recommend

Protection for solicitors

From£4

Email security

Filters impersonation, look-alike domains and malicious attachments out of your mailboxes, and can encrypt sensitive emails automatically.

Per user, per month, excluding VAT.

More details
From£8

Identity threat detection (ITDR)

Spots stolen passwords and suspicious Microsoft 365 sign-ins, the usual first step before an attacker starts watching a transaction.

Per user, per month, excluding VAT.

More details
From£13

24/7 managed detection & response (MDR)

A 24/7 team watching your devices and systems, including evenings and weekends, and stepping in to contain an attack.

Per user, per month, excluding VAT.

More details
From£4

Phishing simulation & training

Practice phishing emails and short training, so fee earners and support staff spot the real thing under deadline pressure.

Per user, per month, excluding VAT.

More details
From£2

Disk encryption

Encrypts laptops so one left at court or on a train is an inconvenience, not a reportable breach.

Per user, per month, excluding VAT.

More details

Business email compromise

If a mailbox is compromised, we lock the attacker out, find out what they saw and help you contact the right people quickly.

More details

How we work with law firms

A typical small firm has between 10 and 50 people, an IT provider for day-to-day support, a case management system, and nobody whose job is security. That's the gap we fill.

We start with a conversation about how your firm works: where client files live, how money moves, how your team works remotely, and what your insurer asks for. Then we recommend the protection that fits, with prices up front. Everything runs from one platform with one monthly invoice, and you can add to it as you grow.

Questions
Tell clients at the start, in writing and in person, that your bank details will never change by email. Confirm any change of details by phone using a number you already hold, and protect every mailbox with multi-factor authentication. Our guide to invoice fraud explains how these attacks work.
Usually yes, and the two work well together. Your IT provider looks after users, software and hardware. We supply and manage the security: the protection itself and the 24/7 monitoring behind it.
Our 24/7 MDR starts at £13 per user per month, so from £260 a month for 20 people, excluding VAT. Email security and the other controls are priced per user too. Use the price calculator for your own numbers.

Not sure what you need?

Tell us a little about your business and we'll recommend the controls that will work best for you, with no obligation and no jargon.

Our experts spent 20 years at Sophos and include a certified ethical hacker.
More about us

Get Protected Ask a question