ABA-aligned cybersecurity that respects the bar and the bottom line.

TL;DR

What law firms get, and what it costs

We operate managed detection and response, ITDR, and Security Awareness Training for your firm end-to-end. The 24/7 SOC watches every endpoint and your Microsoft 365 or Google Workspace tenant for the attack patterns documented across the legal vertical:

• Ransomware against the document management server
• Business email compromise targeting paralegals
• Closing-wire-fraud aimed at real-estate settlement funds

Obsidian Ridge adds the security-operations side: an ABA-aligned written information security plan, MR 5.3-aware vendor management, the FO 483-aligned incident response runbook, cyber-insurance readiness, and the quarterly managing-partner briefing.

Pricing, per month:

• Foundation, $15 per device: endpoint only.
• Protected, $32 per user: adds identity threat detection and the awareness program. This is the tier to look at: it covers the controls cyber insurance applications ask about, including business email compromise.
• Complete, from $55 per user: adds Managed SIEM and the full compliance evidence program.

Not ready for the full program yet? Ridge Watch ($15 per device per month, monitoring only) is an honest first step — real protection now, though a firm handling privileged files and trust funds will want the controls above before a renewal.

See full pricing and what each tier includes

How we work

Alongside your current IT company

Keep your IT company. They handle the help desk, the hardware and the everyday fixes. We run the security layer beside them: threat detection and response, and the evidence insurers and auditors ask for.

What we don't do

• Help desk and everyday IT support
• Printers and office hardware
• Practice-management software support: installs, upgrades, troubleshooting

The threat model

What actually goes wrong in law firms in 2026

Three attack patterns matter most.

1. Document management system ransomware

The attacker phishes a paralegal and lands a loader. Then:

• Moves laterally to the document management server, or to the SSO that fronts a cloud DMS
• Exfiltrates sensitive matter files
• Encrypts everything over a long weekend

Monday morning the firm cannot work open matters, meet deadlines, or service clients, and court deadlines don't move.

Full walkthrough of the attack chain. What would the downtime cost your firm? Run the 2-minute calculator.

2. Closing-wire-fraud via business email compromise

The attacker phishes the paralegal's Microsoft 365 credentials through an adversary-in-the-middle kit. Then:

• Captures the session token, so MFA is already satisfied
• Sets an inbox rule that hides wire and escrow emails
• Reroutes a closing payment to a foreign bank account

IOLTA trust account exposure compounds the bar disciplinary risk. The pattern in detail.

3. Confidentiality failure via unhardened defaults

• Shared paralegal accounts at reception
• No MFA on the DMS admin
• BYOD partner laptops with matter files in personal Gmail
• Vendor access never reviewed

The kind of pattern that breaks attorney-client privilege when a court looks at the firm's actual confidentiality practices. What MR 1.6 and FO 477R actually require.

For the wider set of regulated-industry writeups — ABA opinions, HIPAA, cyber-insurance controls, breach-notification law — browse the compliance blog.

Three ABA sources set the practical cybersecurity floor for law firms in 2026:

• Model Rule 1.6(c) requires reasonable efforts to prevent inadvertent or unauthorized disclosure of client information. Comment [18] sets a sliding scale based on data sensitivity, likelihood of disclosure, cost of safeguards, difficulty of implementation, and effect on representation — not a fixed checklist.
• Formal Opinion 477R applies MR 1.6 to electronic communication. Standard email is generally adequate for routine matters; particularly sensitive matters call for stronger protective measures on the communication channel and the accounts that hold the file.
• Formal Opinion 483 imposes an affirmative duty under MR 1.4 to notify current clients of a breach affecting their material confidential information, with enough detail for the client to make informed decisions about ongoing representation. State breach notification statutes apply in parallel and can run ahead of the FO 483 timeline.

This is a general summary for educational purposes, not legal advice. Application to a specific matter depends on jurisdiction and facts, and the rules and formal opinions change over time. Consult qualified bar counsel and the official ABA guidance. Source: ABA Model Rules of Professional Conduct (americanbar.org).

Lawyers Mutual says every policy it issues carries a Financial Fraud Exclusionary Endorsement, and that the endorsement contains a safe harbor for attorneys in real estate transactions, made of two procedures:

• Incoming wires. Every new client, for every new matter, gets an engagement letter carrying Lawyers Mutual's wire warning: call the office to verify before sending any wire, the firm will not change wiring instructions, and instructions for a different bank or account should be presumed fraudulent. The client signs it, and the signed copy stays in the file.
• Outgoing wires. Before any money leaves the trust account by wire, the firm obtains “a written, original, notarized disbursement instruction” and keeps the original in the file.

Those are the firm's procedures, in Lawyers Mutual's terms. We don't read your policy or say what it covers; your endorsement and Lawyers Mutual answer that.

The controls and staff habits that support it

• A callback to a number you already have. Lawyers Mutual advises calling a known number before wiring any funds. In one fraud it described, a forged notarized directive, apparently built from a real notary's recorded signature and seal, was stopped only because the closing attorney still called the seller's previously verified number.
• Notarized is not proof. Lawyers Mutual also advises verifying notary credentials with state notary offices, and treating a notary in a different state from the owner's confirmed residence as a sign of fraud.
• The mailbox the fraud starts in. Lawyers Mutual names business email compromise as one of the most common scenarios. On Protected and Complete, identity threat detection watches Microsoft 365 or Google Workspace for suspicious sign-ins and the inbox rules that hide wire emails.
• Multi-factor authentication on email. Lawyers Mutual lists it among the steps to protect the firm's data and systems. We report where it is missing.
• Staff who expect the trick. Security awareness training on Protected and Complete runs closing-wire-redirect simulations for paralegals and assistants.

Obsidian Ridge is not an insurance producer, broker, or agent. We do not sell, place, or advise on insurance products.

Sources, all from Lawyers Mutual and fetched September 25, 2026:

• Common Errors in Real Estate-Wire Fraud Claims (April 27, 2022)
• Lawyers Mutual Issues Risk Alert on Wire Fraud (March 9, 2022)
• New Developments in Fraud: Forged Directives, Fake Notaries and Payoff Fax Compromises (August 28, 2018)
• Seller Fraud Risks Are High Especially Before the Holidays (November 20, 2024), which still points lawyers to the endorsement's safe harbor guidelines

A general summary, not legal or insurance advice.