A solicitor receives an email from a client confirming their new bank details for a property purchase. The email looks perfect. The signature matches, the tone is right, and the chain of previous messages is all there. The firm sends the funds. Three days later, the real client calls to ask when the money will arrive. The firm has just become another victim of payment diversion fraud, and the money is gone. This is not a hypothetical scenario. It is the single most common way small UK law firms lose money and reputation today. Cyber security for a law firm is not about complex encryption or high-level espionage: it is about stopping someone from pretending to be you, or pretending to be your client.
What cyber security actually means for a law firm
In a legal context, cyber security is the set of technical and procedural barriers that protect your client data, your firm's money, and your professional reputation. For most small firms, this centres on email. Your email account is the keys to the castle. It contains sensitive case files, confidential client communications, and the ability to authorise financial transactions.
Security is often misunderstood as a product you buy, like an antivirus subscription. In reality, it is a configuration of your existing tools, primarily Microsoft 365, to ensure that only authorised people can access data. It involves verifying that an email actually came from who it says it did, ensuring that passwords alone are not enough to log in, and having a plan for when someone inevitably clicks a link they should have ignored. For a small firm, this means moving away from the idea of a perimeter (the office walls) and focusing on the identity of the person trying to access the files.
The financial reality of payment diversion fraud
Payment diversion fraud, often called Friday afternoon fraud, is a commercial disaster. If a firm is hit, the costs extend far beyond the stolen funds. Consider a hypothetical 10-person firm with a £250 hourly billable rate. If a ransomware attack or a major breach takes the firm offline for three working days, the lost revenue alone sits at £60,000. This does not include the cost of forensic IT investigators, the time spent notifying the Information Commissioner's Office (ICO) and the Solicitors Regulation Authority (SRA), or the inevitable hike in Professional Indemnity Insurance (PII) premiums.
Insurers are no longer treating cyber security as an optional extra. We are seeing PII renewal forms that now require specific technical proofs, such as the use of Multi-Factor Authentication (MFA) and evidence of regular staff training. A firm that cannot demonstrate basic security controls may find itself uninsurable or facing premiums that wipe out its profit margins. The SRA expectations are clear: you must take all reasonable steps to protect client money and assets. In the modern era, a weak password and a lack of email authentication are no longer considered reasonable.
Building a defensive perimeter with Microsoft 365
Most small law firms already have the tools they need within Microsoft 365 Business Premium. The issue is usually that these tools are not turned on or are configured incorrectly. To secure a firm, we follow a specific hierarchy of controls.
First, MFA must be enforced for every single account. This means a password is not enough; a secondary check on a mobile app is required. However, standard MFA can be bypassed by sophisticated phishing. This is why we implement Conditional Access policies. These policies check the context of a login. For example, if a solicitor usually logs in from London on a company laptop, but suddenly tries to log in from an unknown device in another country, the system blocks the attempt automatically.
Second, email authentication must be hardened using SPF, DKIM, and DMARC. These are DNS records that tell other mail servers that your emails are legitimate. Without them, a criminal can easily spoof your domain, sending emails that look like they come from your @firmname.co.uk address. We have a guide to SPF, DKIM, and DMARC that explains this in more detail.
Third, you must monitor for mailbox forwarding rules. A common tactic for attackers is to gain access to a mailbox and quietly set up a rule that forwards all incoming mail to an external address. They then sit and watch, waiting for a high-value transaction to intercept.
A pattern we see on most tenants we take on is that mailbox audit logging is not fully enabled, which complicates any post-breach investigation and prevents the firm from knowing exactly which documents were accessed.
Why professional indemnity insurers are asking harder questions
In the last few years, the insurance market has hardened. Insurers have paid out millions in claims related to phishing and invoice fraud, and they are pushing the risk back onto the firms. When you fill out your PII renewal, you are likely to see questions about your backup strategy and your use of MFA.
It is not enough to say you have backups. You must have immutable backups: copies of your data that cannot be deleted or encrypted, even if an attacker gains admin access to your main systems. We routinely see firms that think they are safe because they use OneDrive or SharePoint, but these are synchronisation tools, not backups. If a file is encrypted by ransomware on a laptop, that encrypted version is instantly synced to the cloud, destroying the good copy. A proper Microsoft 365 backup service is a requirement for any firm that wants to remain insurable.
Four security gaps we find in almost every initial audit
When we first look at a law firm's IT setup, we consistently find the same four vulnerabilities.
- Legacy Authentication: Many firms still allow older protocols like IMAP or POP3. These protocols do not support MFA, meaning an attacker can bypass your security by simply using an older mail client to log in.
- Local Admin Rights: Staff should not have administrative rights on their own laptops. If a solicitor can install software, so can a virus. By removing these rights, you stop the majority of malware from being able to execute.
- Shadow IT: This is the use of personal WhatsApp or Gmail accounts to send case details when the firm's system feels too slow. This data is outside your control, outside your backups, and is a major GDPR breach.
- Unmanaged Devices: If a staff member can access client files from a personal iPad or a home PC that is also used by their children for gaming, your data is at risk. We use Intune device management to ensure that only healthy, encrypted, and patched devices can touch firm data.
FAQ: Cyber security for law firms
Do we really need Cyber Essentials? Yes. Cyber Essentials certification is becoming a standard requirement for many panels and local government contracts. It proves you have the five basic technical controls in place. It also provides a clear framework for your IT provider to follow, ensuring nothing basic is missed.
Is Microsoft 365 secure enough for solicitors? Out of the box, no. It is designed to be accessible, not secure. However, when properly configured with Business Premium features like Defender for Office 365 and Conditional Access, it is a world-class security platform that exceeds the needs of most small firms.
How do we stop clients from being phished? Technical controls on your side help, but you must also change your procedures. Never accept bank details via email. Tell your clients at the start of the instruction that your bank details will never change, and if they receive an email saying otherwise, they must call you on a trusted number to verify.
What is the biggest threat to our firm right now? Business Email Compromise (BEC). This is where an attacker gets into a staff member's email and uses it to send fake invoices or redirect funds. It is more common than ransomware because it is quieter, easier to pull off, and often more lucrative.
How Black Sheep Support helps
We provide IT support for law firms that need to meet SRA standards without the complexity of an enterprise-sized IT department. We don't just fix printers; we build a secure environment where your staff can work from anywhere without risking a breach. We handle the migration to secure cloud systems, manage your Cyber Essentials certification, and monitor your mailboxes for signs of intrusion.
If you are concerned that your current IT setup would not pass an insurance audit
and we'll give you a clear picture of your current risks.
Not ready to talk yet? Run our free IT Health Check to assess your firm's security posture in minutes, no commitment. We also handle hardware, broadband, mobile and networking, ensuring your firm stays connected and protected.
Want this handled for you? See Cyber security services.
Based in Brighton or Hove? We are too: see IT support in Brighton.
