Modern attacks don’t trip antivirus. Ransomware, phishing, and credential theft bypass signature-based tools constantly. Real protection requires endpoint detection and response (EDR), which monitors behavior — not just known threats. A firewall controls traffic at the perimeter. It doesn’t protect against attacks that come through email, stolen credentials, or an employee clicking a link.

M365 includes basic spam filtering — and that’s about it by default. The advanced security features exist, but most aren’t turned on out of the box. More importantly: if one of your user accounts was compromised right now, you probably wouldn’t know.

Remote access without proper controls is one of the most common entry points for attackers. VPN alone isn’t enough. Every remote connection should require MFA, use a managed device, and be monitored. Unmanaged personal devices accessing firm systems — even through a secure connection — introduce risk that’s invisible to most IT setups.

Password policies don’t work without enforcement. Credential reuse is the norm, not the exception. Most firms have no visibility into whether staff are following policy. A single reused password from a data breach elsewhere is enough to compromise your entire environment.

A one-time training or annual video doesn’t change behavior. Phishing simulations, short recurring training, and a clear process for reporting suspicious emails are what actually reduce risk. Most law firm staff have no idea what to do when they receive a suspicious email.

Cloud storage isn’t the same as cloud security. Files in SharePoint, Google Drive, or a DMS are only as secure as the permissions and access controls around them. Overly broad sharing and no audit trail mean you may not know who accessed what — or when. For law firms, that’s a confidentiality and ethics exposure, not just an IT problem.

Having backups and having tested, reliable backups are different things. Most firms discover their backup gaps during an incident — not before. A backup stored in the same environment as your primary data won’t protect you from ransomware. Recovery time matters too — knowing you can restore is different from knowing how long it will take.

Most law firms can’t answer basic questions about their own security posture because they’ve fully delegated it without verification. “Our IT handles it” is not a security strategy. If your provider can’t produce documentation of what’s covered and what’s not, you don’t actually know what you have. Many firms have no provider at all — which means nobody is handling it.