Why law firms must treat security as a core professional duty

Summary

• The combined expectation of regulation and ethical practice for law firms raises the bar for how seriously they must take cyber security
• The legal profession also plays an important role in shaping how other sectors deal with cyber and data security
• Cyber security always relies on good basics, but law firms should now focus on preparedness and response as well as prevention 
• Improperly deployed and managed AI tools can create security concerns, and AI is simultaneously increasing attack sophistication
• Cyber security is now a core part of operations that cannot be outsourced, and responsibility lies with each individual practice

The legal profession needs to be understood from two perspectives. Firstly, it is an industry in its own right, handling highly sensitive client information, financial data and confidential communications. Secondly, it is an adviser to organisations across the wider economy, supporting them with everything from compliance and contracting to incident response. Ian Jeffery, CEO of the Law Society of England and Wales, explains why cyber security preparedness has never been more critical for today’s law firms.

How is the legal profession positioned to reduce cybersecurity risks in an increasingly digital and cross-border economy?

In terms of its own operations, the profession is already subject to frameworks and legislation such as GDPR, but it also faces additional obligations. Solicitors are regulated by the Solicitors Regulation Authority (SRA), which imposes clear duties regarding the safeguarding of client money, confidential information, and other assets. Alongside those regulatory requirements, there is a longstanding professional ethical responsibility to act in clients' best interests.

That combination is important. It raises the bar for how seriously cyber risk must be treated and embeds security into the professional culture. But the profession’s role doesn’t stop there; legal practitioners also play a vital role in helping other sectors manage cyber risk — whether through advising on data protection, drafting commercial contracts, supporting IT procurement or responding to breaches and disputes.
So, while law firms are part of a wider ecosystem and face many of the same risks as others, they also have a broader influence through the advice they provide across the economy.

What are the most significant cyber threats currently facing law firms and their clients, and where should they focus first?

Many of the core threats will be familiar: phishing attacks, weak password practices and other forms of human error remain among the most common. These are not unique to the legal sector, but they affect it just as much as any other.

Where things become more distinctive is in how those threats play out. A good example is fraudulent fund redirection, particularly in areas like conveyancing. These transactions often involve significant sums of money and operate under time pressure. If an email account is compromised, attackers may send last-minute changes to bank details, redirecting funds to fraudulent accounts. It’s a very targeted use of otherwise familiar tactics.

There is also the nature of the information law firms hold. Legal data can be highly sensitive, commercially valuable or politically significant. That creates additional incentives for attackers and exposes firms to risks such as hacktivism, as malicious actors target them for the clients they represent or the cases they are involved in.

While the underlying threats are broadly consistent, their consequences in the legal context can be particularly serious. Firms need to be vigilant not only about the threats themselves, but also about how those threats intersect with their specific areas of practice.

As law firms adopt more advanced technologies, what does strong cyber resilience look like in practice?

At its core, cyber resilience is about getting the fundamentals right. This includes technical controls, strong password practices, system maintenance, supplier assurance and, critically, staff training.

But there has been a shift in mindset. Firms now need to assume that an attempted breach is a realistic scenario rather than a distant possibility. It’s vitally important that they focus not just on prevention, but also on preparedness and response, with the processes in place to detect, contain and recover from an incident.

What ‘good’ looks like will vary from firm to firm. A large commercial practice working with major financial institutions may face stringent client requirements around audits, contractual safeguards and supply chain security. Smaller firms will have different expectations, but the same principles apply.

At the Law Society, we provide guidance to help firms get started and point them towards expert providers where necessary. Ultimately, though, resilience is context-dependent. It depends on the nature of the work being done, the clients being served and the sensitivity of the data involved.

What common cybersecurity mistakes do law firms tend to make?

Many of the issues we see are predictable human mistakes, whether that’s falling victim to phishing attempts or failing to follow basic security practices. From a technical perspective, problems often arise when systems are not properly maintained. Failing to apply updates, leaving software unpatched or keeping redundant systems live can all create vulnerabilities. There have been cases where breaches occurred simply because an unnecessary legacy system was still active and accessible.

For you

Be part of something bigger, join BCS, The Chartered Institute for IT.

More recently, we’ve also seen new risks emerging around artificial intelligence. One issue is the use of public AI tools. If confidential information is entered into these platforms, it can potentially be exposed. There is also the risk of inaccurate or misleading outputs, which must be carefully managed through human oversight. While many firms are now implementing secure, internal versions of these tools, that doesn’t remove the need for caution.

At the same time, AI is increasing the sophistication of attacks. Deepfakes and advanced phishing techniques can make it much harder to distinguish legitimate communications from fraudulent ones. While the fundamentals remain critical, the landscape is evolving, and law firms need to adapt accordingly.

How important is collaboration with bodies like the National Cyber Security Centre in maintaining global trust in English law?

Collaboration is essential. A good example is the 2023 report produced in partnership with the National Cyber Security Centre (NCSC), which combined the Law Society’s understanding of legal practice with the NCSC’s expertise on the threat environment.

This kind of collaboration produces guidance that is both technically robust and highly relevant to the profession. It also helps ensure that intelligence about emerging threats is shared more quickly and widely. While the largest firms may have access to cutting-edge information, it can take time for that knowledge to reach the rest of the profession. Working with organisations like the NCSC helps bridge that gap.

We also work closely with bodies such as the Information Commissioner’s Office and the Solicitors Regulation Authority. Together, these relationships help maintain high standards and reinforce trust in the legal system, both in the UK and internationally.

How is the evolving regulatory landscape shaping law firms’ cybersecurity obligations, and what should firms be doing now to stay ahead of compliance requirements?

Law firms operate within a framework that includes GDPR, guidance from the Information Commissioner’s Office, and the Solicitors Regulation Authority's rules. The SRA takes a principles-based approach rather than prescribing detailed technical standards. The central obligation is clear: firms must protect client money, confidentiality and assets.

An important aspect of this is accountability. Firms are not judged solely on whether an incident occurs, because cyber threats are widespread and ongoing. Instead, the focus is on preparedness and response. Were appropriate measures in place? Was the incident handled properly?

To stay ahead, firms need to understand their obligations and embed them into day-to-day operations, ensuring that governance, systems, and training all align with those expectations.

For smaller firms with limited resources, what are the most impactful steps they can take to improve their cybersecurity today?

For smaller firms, the most practical approach is to start with established guidance. The Law Society provides resources that walk through the key steps, from staff training to leadership awareness and the use of external expertise. In addition, frameworks such as the NCSC’s Cyber Essentials offer a clear, structured pathway to establishing a solid baseline level of security.

By working through these materials, firms can build a strong foundation and identify any areas that require further attention based on their specific risks. It’s about prioritisation — focusing on the areas of most risk first, and then building from there.

Cybersecurity is now a core part of professional responsibility in law. It cannot simply be outsourced. The challenge is growing, and the responsibility for operating securely and taking ownership of risk mitigation must sit firmly within each practice.