Law firms rely on strong cybersecurity technology, but many of the most persistent risks come from everyday operational practices.
These are the routine decisions, exceptions, and workarounds that shape how people actually use technology. They often remain invisible until a client audit, insurance renewal, or incident forces them into view.
Xantrion recently hosted the webinar “The Hidden Cyber Risks in Everyday Law Firm Operations.” Here are ten key takeaways law firms can use to improve cybersecurity.
1. Access That Follows People Through Their Careers
One of the most common issues occurs when employees change roles but retain access from previous positions. During the webinar, the discussion included a familiar scenario. An intern becomes an office assistant, then moves into finance, and eventually transitions into legal support. At each step, they accumulate new access to matter folders, shared mailboxes, and finance directories, but nothing from their past roles is ever removed. Years later, this person may still have access to salary information or confidential financial records simply because no one revisited their permissions.
To address this, firms should treat every role change as a trigger for a full access review. This means examining what the employee currently has, what they actually need, and what should be removed. It also means documenting who approved the changes and confirming that the adjustments were completed. None of it ever gets cleaned out on its own. The only way to prevent that accumulation is to make access review a standard part of onboarding, offboarding, and internal transitions.
2. Accounts That Remain After Departures
Even when firms disable accounts after someone leaves, the underlying permissions often remain intact. The webinar highlighted a situation where a new hire never showed up for their first day, yet their account, complete with initial password and access rights, remained active for months simply because no one closed it out. Disabled accounts can still be exploited if they retain access to shared resources or integrated systems.
A complete offboarding process should include removing permissions, revoking licenses, clearing shared mailbox access, and confirming the return of physical keys or access cards. A second reviewer or periodic audit can help ensure these steps were actually completed. Leaving a process unfinished can be as risky as never starting it.
3. Temporary Access That Never Gets Removed
Urgent deadlines often lead to quick access grants. Someone is out sick, a filing is due, and a colleague needs access “just for today.” The discussion included a common pattern. Sandra fills in for John, receives access to his matter so she can complete a filing, and successfully gets everything submitted on time. The crisis passes, but Sandra’s access remains indefinitely.
To prevent temporary access from becoming permanent, firms should record why the access was granted, who approved it, and when it should be removed. The conversation included a simple but effective practice. Immediately scheduling a calendar reminder to remove the access once the urgent work is complete ensures that exceptions do not quietly become long-term vulnerabilities.
4. Tools Adopted Before They’re Evaluated
Staff frequently discover new applications that help them work more efficiently, including AI-enabled tools that take notes, analyze documents, or track time. The challenge is that these tools often begin interacting with client data before the firm has reviewed them. Useful tools tend to arrive before the decision to use them does, which means employees may already be working in them before anyone has assessed their security.
Firms should establish a clear path for evaluating new tools. This includes reviewing how the tool handles data, whether it stores information externally, and whether it aligns with firm policies. Assigning an owner to manage the evaluation and deployment ensures the process moves forward instead of stalling. The goal is not to slow innovation but to ensure new tools are introduced safely and intentionally.
5. Tools That Are Purchased but Never Fully Implemented
Another hidden risk arises when firms approve and purchase software but never finish deploying it. Tools get bought with good intentions, partially configured, and then abandoned during busy periods like budgeting season. Even unused tools may retain access to sensitive systems or data.
To avoid this, firms should define what complete deployment means for each tool. Completion might include creating accounts, delivering training, configuring integrations, or formally deciding not to proceed. Without clear exit conditions, tools remain in limbo, creating both security and financial waste.
6. Security Forms That Become Commitments
Cyber insurance applications and client questionnaires often contain technical questions that require precise answers. Take a question like “Is multi-factor authentication required for all remote access?” Many administrators assume the answer is yes because they personally use MFA, but they may not be aware of exceptions or systems that behave differently.
These forms become commitments once submitted, so firms must route each question to the appropriate subject matter expert. Verification may require evidence such as screenshots, logs, or policy references. Keeping a record of submitted answers and supporting documentation helps during audits and renewals.
7. Patterns of Exceptions That Indicate Policy Gaps
Exceptions are sometimes necessary, but recurring exceptions often signal that a policy no longer reflects how the firm actually works. The examples discussed included situations where the same person repeatedly approves exceptions, not because they are careless, but because the policy is too rigid for real-world needs.
Reviewing exception patterns helps identify where policies need to be updated. This ensures that staff can work effectively without relying on workarounds and that security controls remain aligned with operational reality.
8. Increasing Client Scrutiny Around Technology and AI
Clients are asking more detailed questions about how firms use technology, including AI-enabled tools. The conversation noted that some clients even use ChatGPT to generate long lists of questions they do not fully understand. These questions often cover data processing, confidentiality, and tool usage.
Firms should maintain a list of approved tools, document how client data is handled, and prepare standard responses for diligence requests. An internal AI usage guideline helps staff understand what tools are allowed and how to use them safely.
9. Business Continuity Plans That Don’t Match Current Operations
When systems fail, whether email, document management, or cloud platforms, firms need a clear plan. Without one, downtime disrupts client work and internal coordination. The webinar emphasized the importance of knowing what gets restored first, who makes decisions, and how long the firm can tolerate downtime.
A strong continuity plan identifies critical systems, restoration priorities, communication methods, and decision makers. Review and update the plan regularly so it reflects current operations and technology.
10. Processes That Aren’t Verified
Many firms have documented procedures, but fewer apply them consistently, and even fewer verify completion. Verification is the step that most often gets skipped. How do we know that it happened? Without confirmation, processes remain vulnerable to human error and oversight.
Add verification steps to critical workflows, such as access changes, tool deployment, and offboarding, to ensure procedures are followed. Ticketing systems, checklists, and periodic audits provide the structure needed to confirm completion and maintain accountability.
Strengthening Operational Security
Cybersecurity is both a technical and operational discipline. By addressing these hidden risks, firms can reduce exposure, meet client expectations, and build a more resilient security posture. Each improvement begins with a clear understanding of what should happen, who is responsible, and how completion is verified.
The session page has the full recording, the slides, and a cybersecurity risk assessment you can run against your own firm.
