--- title: "Cybersecurity for Managing Partners — Not Am Law CIOs | EFROS" description: "ABA Op 512, privilege preservation, wire fraud, ransomware before depositions — handled. Cybersecurity for boutique and mid-size US law firms. No CISO required." canonical: https://efros.com/for-owners/law-firms/ --- - [Home](https://efros.com/) - /[For Owners](https://efros.com/for-owners/) - /Law Firms For owners of law firms # Cybersecurity for managing partners — not Am Law CIOs. Your firm is 8-75 attorneys. You bill matter time, not security policy. ABA Formal Opinion 512 (July 2024) says you have a duty to understand the AI you use and to supervise the firm's use of it. Most managing partners read that opinion and don't sleep well. This is the owner version: how boutique and mid-size firms in your band actually get hit, what wire fraud and ransomware cost when they land, the AI duties Op 512 created, and what an EFROS engagement looks like at your scale. [Run the Cost-of-Getting-Hit Calculator →](https://efros.com/tools/cost-of-getting-hit/?industry=legal) [Book 20 min](https://efros.com/book/?type=20min&source=for-owners-law-firms) By [Stefan Efros](https://www.linkedin.com/in/stefanefros-cyberdefense/), CEO & Founder, EFROS Updated · July 25, 2026 The shift ## Why owners of law firms are getting hit more, not less Law firms have been a top-five ransomware target since 2019. The reason hasn't changed: a firm's billings stop the day the case-management system stops. Attackers price the ransom against your weekly receipts, and they're usually within 30%. What changed in 2024-2025 is that AI gave them a second pressure point: every consumer ChatGPT prompt an associate sent with a client document is a potential privilege event, and ABA Op 512 made the duty explicit. The other pressure is wire fraud. Real estate, trust and estates, and corporate practices all move money through email-confirmed wire instructions, and BEC operators have industrialized the attack. The FBI IC3 2024 report tracked $2.9B in BEC losses, with law firms in the top-three professional-services targets. **Industry stat:** Law firms have been a top-5 ransomware target since 2019. The average ransom demanded from US law firms in 2024 was $850k, per the Coveware Q4 2024 ransomware report. Boutique and mid-size firms account for the majority of negotiated payouts. Attack surface ## The 5 ways law firms get attacked Drawn from the incident pattern across boutique and mid-size firms we've worked with and the public state bar disciplinary opinions from 2022-2025. ### Phishing of paralegals and legal assistants A fake e-filing notice or court-deadline alert lands at a paralegal's inbox. One click and an attacker has session tokens to your matter-management platform and email. Most law firm breaches start here. ### Wire fraud on real estate and trust closings Days before closing, 'the title company' emails the buyer updated wire instructions. The wire goes to the attacker. $400k gone before lunch. Your firm gets sued by a client who relied on your email channel. ### AI hallucination in court filings (Mata v. Avianca progeny) An associate uses ChatGPT to draft a brief. Six cited cases don't exist. The judge issues an order to show cause for sanctions. The bar gets a referral. Your malpractice carrier asks pointed questions at renewal. ### Ransomware timed to a deposition or trial deadline Attackers target law firms because downtime costs billable hours and risks missed deadlines. The ransom demand arrives the morning of a Rule 30(b)(6) deposition. The pressure is the point. ### Privilege exposure via consumer AI tools A partner pastes a client's contract into ChatGPT to summarize it. That single prompt arguably waives privilege because it was disclosed to a third-party processor that retains and trains on it. ABA Op 512 (July 2024) says you should have known. What it costs when it happens ## Best, average, worst — the dollar reality Modeled on public reports, NetDiligence Cyber Claims studies, and the work we've done for firms in the 8-75 attorney range. Your number depends on your size, your insurance, and your preparation. Best case ### Insured + prepared $45k – $180k Current cyber policy with no AI exclusion. Incident detected within hours. ABA Op 512 AI policy is documented. Wire fraud reversed via FinCEN Kill Chain. Deductible + forensics + minor downtime. Average case ### Partial preparation $320k – $1.1M Ransomware shuts the firm 1-2 weeks. Some matters miss deadlines. Bar inquiry on whether you preserved client confidentiality. Notification to clients. 8-12% of clients move firms within 12 months. Worst case ### Unprepared $1.4M – $4.8M Wire fraud unrecovered. Ransom paid or 3+ weeks of downtime. Sanctions on the AI-hallucination filing. Bar complaint progresses to formal discipline against named partner. Malpractice premium triples. Ranges are illustrative. For a personalized estimate calibrated to your size and current controls, [run the Cost-of-Getting-Hit calculator](https://efros.com/tools/cost-of-getting-hit/?industry=legal). The duties Op 512 made explicit ## Law-firm-specific risk highlights - 1ABA Formal Opinion 512 (July 2024) — competence, confidentiality, supervision, candor duties when using generative AI in client work - 2ABA Model Rule 1.6(c) — competent safeguards on client confidentiality; technology and vendor selection is your duty, not your IT person's - 3Mata v. Avianca and progeny — every court that has handled an AI-hallucination filing has sanctioned the lawyer, not the AI - 4State bar AI opinions — CA, NY, FL, TX, IL, PA have published opinions in 2024-2025; most align with ABA 512 but add local nuances - 5State breach laws stack — every US state has one; some require AG notification within 30 days regardless of harm threshold What we actually do ## What an EFROS engagement looks like for a law firm We start with a 10-day fixed-fee scoping engagement. We inventory every AI tool the attorneys, paralegals, and staff are using — Harvey, CoCounsel, Lexis+AI, M365 Copilot, ChatGPT, Claude, Perplexity, Notion AI, and whatever else turns up. We tell you which ones align with ABA Op 512 and which ones don't. We pull your wire-instruction-change protocol and stress-test it against the BEC playbook. We audit your DMARC, MTA-STS, and anti-impersonation controls. We review your matter-management platform — iManage, NetDocuments, Clio, MyCase, PracticePanther, Smokeball — for per-matter access boundaries and audit logging that would survive a bar inquiry. On retainer we run the operating model: AI governance policy with named partner signoff, quarterly tabletop scenarios on wire fraud and ransomware, an incident response runbook your malpractice carrier will accept, MDM for attorney devices, and a 1-page quarterly board-grade summary your management committee actually reads. Flat-fee retainer — typically $5,500-12,000 per month for boutique and mid-size firms depending on attorney count, AI surface, and case-management platform. No per-ticket charges. No tool upsells. We run the program. What these incidents actually look like ## Related incident stories Read how these played out at firms and adjacent professional services — the timeline, the bar inquiry, what would have changed the outcome. [Incident story ### Ransomware at a regional law firm 35-attorney firm hit five days before a major deposition. The ransom decision, the client notification, the bar inquiry that followed, and what changed for them.Read the story →](https://efros.com/incident-stories/ransomware-at-regional-law-firm/) [Incident story · cross-discipline ### AI data exposure at a CPA firm Same failure mode as an associate pasting a client contract into consumer ChatGPT. Worth reading for the regulator response and the recovery playbook.Read the story →](https://efros.com/incident-stories/ai-data-exposure-at-cpa-firm/) For law firms ## Built for partners running matter-scoped operations [### Legal services program Matter-scoped IT, client confidentiality, wire-fraud defense, and IRS Pub 4557 controls under one accountable program.Open→](https://efros.com/industries/legal/) [### AI Governance for Law Firms Privilege-preserving AI adoption: ABA Op 512, opposing-counsel disclosure norms, partner accountability under model rules.Open→](https://efros.com/resources/ai-governance-for-law-firms/) [### AI Governance program NIST AI RMF + Colorado SB 26-189 + ABA opinions mapped to firm-scale operations. Engaged when AI risk is on the table.Open→](https://efros.com/services/ai-governance/) [### Privileged IR Retainer Pre-engaged commander when a breach exposes privileged work product. Counsel-coordinated containment.Open→](https://efros.com/security/incident-response/) [### Virtual CISO for firms Board-grade security oversight without the full-time CISO hire. Firm-leadership reporting, exam-prep, compliance.Open→](https://efros.com/security/vciso/) [### Free Security Scan 60-second external audit of firm domain — DNS, email auth, TLS, headers. Branded PDF for management committee review.Open→](https://efros.com/tools/security-scan/) ## Three ways to start The calculator and quiz are anonymous and take under 5 minutes. The 20-minute call is a scoping conversation, not a sales pitch. Pick the one that fits your hour. [Run Cost-of-Getting-Hit](https://efros.com/tools/cost-of-getting-hit/?industry=legal) [Run Are-You-Ready Quiz](https://efros.com/tools/are-you-ready/) [Book 20 min](https://efros.com/book/?type=20min&source=for-owners-law-firms) Related EFROS resources ## Law firm program stack [### EFROS for law firms Full law-firm cybersecurity stack.Open→](https://efros.com/industries/legal/) [### AI Governance for law firms ABA Formal Opinion 512 operationalized.Open→](https://efros.com/resources/ai-governance-for-law-firms/) [### vCISO for law firms OCG response + client questionnaire workload.Open→](https://efros.com/security/vciso/) [### MDR for law firms DMS-export anomaly + OAuth-grant abuse detection.Open→](https://efros.com/security/mdr/) [### Law firm ransomware case Real incident pattern.Open→](https://efros.com/incident-stories/ransomware-at-regional-law-firm/) [### AI Governance service Legal AI vendor diligence.Open→](https://efros.com/services/ai-governance/)