Posts by John Reeman

Most mid-sized law firms rely on their IT provider when something goes wrong. The managed services agreement covers restoring service. The cyber policy covers investigating. Neither covers the first two hours. Here is what to check in both documents, four questions for your provider, and a sensible split of responsibility.

An attacker sits in a mailbox, waits for the settlement invoice, then swaps the bank details. Here’s how payment redirection fraud hits law firms, and the callback rule that stops it.

Ask a partner how far back their firm could prove what an intruder accessed, and the room usually goes quiet. The answer was set years earlier by a licensing decision nobody treated as a legal one. Here is what a mid-size firm actually retains, what the Microsoft defaults really are, and the six numbers to ask your IT provider for this week.

For a decade, firms have been hardening the network. Firewalls, endpoint detection, email filtering, MFA everywhere. That investment worked and attackers responded the way attackers always respond. They stopped attacking the hardened thing and moved to the soft thing next to it.

The soft thing is the human process for getting back into an account when you’re locked out.

Your firm already has an AI policy. You just didn’t write it.

Right now, in the absence of anything official, every member of your staff is making their own individual decision about what to paste into ChatGPT. Some have decided client names are fine as long as they change them slightly. Some have decided a contract is fine as long as they delete the parties’ details. Some have decided nothing is fine and are quietly falling behind colleagues who’ve decided everything is.