Starting niche
Client files, trust accounts, and a renewal form.
We are starting with law firms of about 5 to 250 people. The managing partner usually signs the cyber policy and owns the duty to protect client confidences. That is a clearer first buyer than a generic small business. Accounting firms and dental practices are real prospects too. The first five customers should teach us one practice, not three.
Why the work shows up
- Confidentiality is a professional duty, not a slogan. ABA Formal Opinion 477R discusses reasonable efforts to prevent unauthorized access when lawyers use technology. It does not name a product. Nothing on this site is ethics advice, and we are not your malpractice counsel.
- Cyber applications for professional firms commonly ask about multi-factor authentication, endpoint detection, and mail security. The exact question depends on the carrier and the year. A gap does not always mean a declined policy. It does change the renewal conversation.
- Trust accounts and wiring instructions are a practical target. A changed payment instruction on a closing or a settlement is a loss even when no ransomware note ever appears.
- Firms this size rarely employ a security analyst. They have a managing partner, an office manager, and sometimes an outside IT provider.
What we would actually do
- Put Managed EDR on workstations and on the file server, if there is one.
- Watch Microsoft 365 or Google Workspace for sign-ins, inbox rules, and admin changes when the bundle includes identity.
- Review the tenant against settings insurers ask about, and write the gaps in a letter a partner can read.
- Run awareness exercises built around fake invoices and fake login pages. Never a real client, a real opposing party, or a real matter name.
What we will not take on
- We will not tell you that a bar opinion has been satisfied.
- We will not contact your clients, the court, or the other side.
- We will not replace the person who runs the case-management system, unless a later scope says we took a named piece of that work.
- We will not answer an insurance application by claiming a 24/7 staffed SOC. If the application requires one, we say we do not meet that condition.
The bundles and the hours are the same ones on the pricing page. A profession does not get a secret package.