Ask a solo practitioner or a partner at a ten-lawyer firm whether they worry about cyberattacks and you often hear a version of the same answer: "We are too small to be interesting." It is an understandable assumption, and a risky one. Attackers rarely pick targets by admiring them. They use automation to find weak spots and then look at what they have found.
Here are six common myths and what is closer to reality. These are general observations, not statistics.
Myth 1: "We are too small to be a target."
Reality: Many attacks are opportunistic. Automated tools scan the internet for exposed systems, reused passwords and unpatched software, and phishing campaigns go out in bulk. A small firm with weak defenses can be as easy to compromise as a large one, and perhaps easier, since it has fewer layers in place. Firms of every size are also targeted deliberately because of what they hold.
Myth 2: "Hackers want money from banks, not law firms."
Reality: Law firms hold a combination attackers value: confidential client information, settlement and closing funds, trust account access, and sometimes sensitive corporate or personal data. Funds in motion make business email compromise attractive, and confidential material creates leverage for extortion. The FBI's IC3 has repeatedly highlighted business email compromise as a costly category of crime.
Myth 3: "Our antivirus protects us."
Reality: Traditional antivirus catches known threats. Modern attacks often use stolen credentials, legitimate administrative tools or fresh malware designed to evade detection. Protection now typically includes endpoint detection and response with human monitoring, MFA, patching, email security and good backups. No single product does everything.
Myth 4: "Our data is in the cloud, so it is the vendor's problem."
Reality: Cloud providers secure their infrastructure, but customers configure access. Weak passwords, missing MFA, over-broad sharing and compromised accounts are customer-side issues. And ethics rules, including Rule 1.6(c) on reasonable efforts to protect client information, remain the lawyer's responsibility even when a vendor is involved. Confirm specifics with your state bar.
Myth 5: "Cyber insurance will cover whatever happens."
Reality: Policies have sub-limits, exclusions, retentions and conditions. Funds-transfer fraud is often limited, and coverage can depend on controls you attested to when applying. Insurance helps with costs but does not repair client trust or remove your duty to prevent harm.
Myth 6: "Security is IT's job, not the lawyers'."
Reality: IT builds the guardrails, but attorneys and staff make daily decisions: clicking a link, replying to an urgent request, sharing a document, using a new app. Rule 5.1 addresses supervisory responsibilities of partners and managers, and Rule 5.3 covers nonlawyer assistants. Security is a firm-wide responsibility with leadership accountability.
What to do instead
You do not need an enterprise security program. A prioritized baseline is within reach for most small firms:
- MFA everywhere, starting with email and remote access
- Managed endpoint protection that someone monitors
- Email security with impersonation protection
- Patching on a defined schedule
- Tested, immutable backups
- Security awareness training with short, regular sessions
- Payment verification procedures for any wire or change in instructions
- A written incident response plan with names and phone numbers
- Vendor oversight, including a contract review for confidentiality terms
A reality check on cost
Prevention costs money, but so do incidents, including downtime, forensic work, client notification, lost billable time and reputational damage. For many firms, a managed service that bundles these controls is more affordable than building them separately.
Start with an honest assessment
Rather than guessing, ask someone to look. A quick review of your MFA coverage, backup status, email configuration and administrator accounts often reveals the most urgent gaps in a day.
Where Counsel Cyber fits
We work with firms across Texas, Arkansas, Louisiana, Oklahoma and Kansas, and we are happy to run that first review and explain the results in plain English.