Stop failing the security questions your clients, lenders and insurer ask.
Law firms move client money, hold confidential case files and are a favourite target for fake bank-detail emails. Lenders, insurers and larger clients now want evidence the firm is protected. We find the gaps, fix them, and give you that evidence.
- Email protections that stop fraudsters sending as your firm
- A report you can attach to lender, client and insurer questionnaires
- Nothing tested without written authorisation
Three things that usually prompt the call.
A fake email to a client
A client in a conveyancing matter receives an email from what looks like the firm, saying the bank details have changed. The money moves within hours.
A questionnaire before a big instruction
A lender, panel or larger client sends a security questionnaire, and the question nobody can answer is "when was your last independent test?"
An insurance renewal asking for evidence
The cyber or professional indemnity renewal asks about scanning, patching and multi-factor sign-in, and "we think so" is no longer enough.
What we look at in a firm like yours.
Checked against how a law firm actually works: client money, confidential files, and email at the centre of everything.
Email that can't be faked
SPF, DKIM and DMARC set up and enforced, plus checks for hidden forwarding rules that quietly copy a mailbox to someone outside.
Accounts and sign-in
Multi-factor sign-in on every account, including shared and old admin accounts, and admin rights only where they're needed.
Case management access
Who can reach your case and practice management systems, from where, and whether leavers can still get in.
Laptops and patching
Every device on supported, updated software, including the old PC in the corner that still runs one programme.
What faces the internet
Remote access, document portals and anything else reachable from outside, mapped and locked down.
Backups that survive
A copy of case files and accounts that ransomware on your network couldn't also encrypt.
From first call to a closed report, with nothing technical asked of you.
Every stage is a fixed price, agreed before it starts. See what each stage costs.
Scoping call
Thirty minutes on your firm, your systems and what's driving the test. You get the fixed price for the test at the end of it.
Test, report, walkthrough
We run the assessment on agreed dates, then go through the ranked report with you: what's serious, what isn't, and what we'd fix first.
Fix, re-test, evidence
If you want the findings closed, we do the work with your IT provider, re-test every fix and hand over the evidence pack.
Two-office law firm, 65 staff, insurer asking for evidence
Testing showed multi-factor sign-in missing on a third of accounts and no email authentication in place. The evidence pack was accepted by the insurer, and the premium held at the previous year's rate.
Illustrative engagement showing the shape of the work, not a named client.
What firms like yours usually ask first.
Does testing put client confidentiality at risk?
No. We test how systems are configured and what is exposed, not the contents of client files. We work from named accounts you create and can switch off, findings are encrypted and shared only with people you name, and nothing is tested without written authorisation.
Can the report be used for lender and client questionnaires?
Yes. That's one of the main reasons firms ask for it. Most questions about testing, patching, access and multi-factor sign-in can be answered straight from the report, with the evidence attached.
Will you stop fake bank-detail emails completely?
We stop anyone sending email from your actual address, which is what makes these frauds convincing. Fraudsters can still try lookalike addresses, so we also help you tell clients clearly how you will and won't ask for money.
We already have an IT provider. Do we still need you?
Yes, for an independent view. We work alongside your IT provider, share the plan with them before we start, and fix the gaps together with them.