Obsidian RidgeLaw firm cybersecurity
Managed cybersecurity for small and mid-size law firms running NetDocuments, iManage, Clio, MyCase, Microsoft 365, or Google Workspace. We operate MDR, ITDR, and Security Awareness Training, then package the written security evidence your bar, carrier, and ABA Formal Opinion 483 expect.
Obsidian Ridge is a CISSP-led managed security provider serving small and mid-size law firms in the Research Triangle and across the United States; managed detection and response starts at $25 per person per month on Ridge Core, month-to-month with no minimum and no contract, with 24/7 security team monitoring of every computer and email login and human-led containment, and it maps to ABA Model Rule 1.6 confidentiality duties and cyber-insurance controls.
TL;DR
We operate managed detection and response, ITDR, and Security Awareness Training for your firm end-to-end. The 24/7 security team watches every endpoint and your Microsoft 365 or Google Workspace tenant for the attack patterns documented across the legal vertical:
Obsidian Ridge adds the security-operations side: an ABA-aligned written information security plan, MR 5.3-aware vendor management, the FO 483-aligned incident response runbook, cyber-insurance readiness, and the quarterly managing-partner briefing.
Pricing, per month:
Log collection is Ridge Log, an add-on on any tier.
To see which AI apps and agents can reach client information, start with an AI security assessment and review the findings and fixes with a CISSP.
Before that, what each vendor publishes about its own tool: 35 AI tools, plan by plan, including Is ChatGPT safe for client data?
These arrive inside the software the practice already runs rather than being installed by anyone, and each page below quotes what the vendor publishes about client data, plan by plan.
For the ones staff signed up for themselves, the AI tool risk checker turns what you already know into a list of decisions, in your browser.
For a smaller team, compare MDR costs at 5, 10, 25 and 50 devices, including onboarding and the difference between device and person pricing.
Not ready for the full program yet? Ridge Watch ($15 per device per month, monitoring only) is an honest first step — real protection now, though a firm handling privileged files and trust funds will want the controls above before a renewal.
What the rules ask, and who does it
No vendor can make a firm ABA-compliant, and we don't claim to. These are the duties, the plan each one sits in, and the part that stays with the firm.
| What the rule asks for | What we do, and in which plan | What stays with you |
|---|---|---|
| Model Rule 1.6(c): reasonable efforts to prevent the inadvertent or unauthorised disclosure of client information. Comment [18] is a sliding scale, not a fixed checklist. | Ridge Core: every computer and every work-account login watched 24/7. A security team reviews every alert and acts on it — remediates it, notes it, or takes the computer off the network. Ridge Plus adds the awareness-training programme, email protection and the work browser. | Judging how sensitive each matter is, and approving the recovery steps. |
| Formal Opinion 477R: a particularly sensitive matter calls for stronger protection on the communication channel and on the accounts that hold the file. | Ridge Core: identity threat detection on the Microsoft 365 or Google Workspace accounts, which catches a stolen session token replayed from a computer nobody recognises, and the inbox rules used to hide a redirected closing wire. Ridge Plus adds email protection, configured and monitored, with SPF, DKIM and DMARC. | Deciding which matters need more than standard email, and agreeing the channel with the client. |
| Formal Opinion 483: notify current clients whose material confidential information was affected, in enough detail for them to make an informed decision about the representation. | Ridge Reserve: a written incident response plan, reviewed with you each year, plus the documented record of the response, so the managing partner can decide and send. | Deciding whether notice is required, drafting it and sending it. State breach-notification statutes run in parallel and can come first. |
| Model Rule 5.3: supervision of non-lawyer assistance, which includes an outside vendor. | Every plan: a written engagement agreement that addresses the MR 5.3 supervisory expectations, signed before any work begins, plus our security documentation for the firm's vendor file. | Keeping the vendor list current, and reviewing each provider. |
| Records that show the efforts were in fact reasonable. | Ridge Reserve: quarterly admin-access reviews and a monthly patch report, beside the written security plan, the MFA coverage report and the training records. | Retention, and deciding what goes to bar counsel or a carrier. |
Sources: ABA Model Rules of Professional Conduct, Formal Opinion 477R and Formal Opinion 483. A general summary, not legal advice — the plain-English section further down this page sets out what each one says.
Island Enterprise Browser
Keep control of work data, on company and personal computers.
Your practice software keeps running exactly as it does today. Island Enterprise Browser only changes the browser, so NetDocuments, iManage and an on-premises document management server are untouched, and the web apps your team already uses — the ones this adds policy to — open the way they always have.
Included in Ridge Plus. No separate price.
Also included in Ridge Reserve.
An everyday decision
A staff member downloads a confidential client file to a home laptop.
Set the rule for each app: allow, watermark or block the action.
Illustrative controls. Rules are configured for your work apps.
What's included
Attorney laptops, paralegal workstations, the document management server, the firm's M365 / Workspace box. The 24/7 security team watching for ransomware canaries, credential theft, and the lateral-movement patterns documented in legal-vertical attacks.
On either platform it catches stolen session tokens replayed from somewhere new and the inbox rules used to hide closing-wire-fraud activity. On Microsoft 365 it also catches the adversary-in-the-middle kits that bypass MFA (EvilProxy, Tycoon) and the OAuth-consent attacks against firm tenants.
Phishing simulations and 5-minute micro-lessons tuned for legal staff: closing-wire-redirect themes for paralegals, court-notice phishing for legal assistants, sealed-records hygiene for partners.
The written security plan that documents the firm's Model Rule 1.6(c) reasonableness analysis and answers the written-policy question on a cyber-insurance application, plus the audit-control logs, MFA coverage report, encryption attestation, training records, and the firm-tailored incident response plan.
We review MFA, admin separation, user access, former staff, external sharing and audit logging in the firm's practice-management and document-management systems (NetDocuments, iManage, Clio, MyCase, ProLaw, PracticePanther and the like), and deliver a list of fixes the firm or its IT vendor applies.
If something happens, you are not alone with a vendor portal. We coordinate forensics, walk through ABA Formal Opinion 483 notification obligations to current clients, file the cyber-insurance claim, and produce the documented response evidence the bar and the carrier expect.
How we work
Keep your IT company. They handle the help desk, the hardware and the everyday fixes. We run the security layer beside them: threat detection and response, and the evidence insurers and auditors ask for.
The threat model
Three attack patterns matter most.
The attacker phishes a paralegal and lands a loader. Then:
Monday morning the firm cannot work open matters, meet deadlines, or service clients, and court deadlines don't move.
Full walkthrough of the attack chain. What would the downtime cost your firm? Run the 2-minute calculator.
The attacker phishes the paralegal's Microsoft 365 credentials through an adversary-in-the-middle kit. Then:
IOLTA trust account exposure compounds the bar disciplinary risk. The pattern in detail.
The kind of pattern that breaks attorney-client privilege when a court looks at the firm's actual confidentiality practices. What MR 1.6 and FO 477R actually require.
For the wider set of regulated-industry writeups — ABA opinions, HIPAA, cyber-insurance controls, breach-notification law — browse the compliance blog.
The insurance wedge
Maybe a cyber-insurance renewal just arrived with a 2026 questionnaire asking for:
In 7 business days the Cyber Insurance Readiness Sprint maps every question on your carrier's questionnaire to the control that answers it, closes the gaps we can, and hands you a signed evidence pack.
Flat fee, $1,500–$3,500 depending on office count and scope. Delivered, or we keep working at no additional cost until it is. We don't control underwriter decisions. We control whether you walk in with the evidence they ask for.
Law firm field notes
Hands-on long reads. No marketing copy, no acronym soup. Each one written for a managing partner or firm administrator, not a CISO.
The pillar piece. MR 1.6's reasonable-efforts test, the 477R email guidance, the 483 breach-response duties, and where small firms get it wrong.
Read the articleThe attack chain that ends with an encrypted DMS over a long weekend, and the controls that break it.
Read the articleMFA on the DMS itself, audit-log review, integration-token inventory, BYOD App Protection, and the on-prem-DMS hardening checklist.
Read the articleThe 2026 underwriting questionnaire, the social-engineering rider that matters for closings, and the work needed to prepare accurate application answers.
Read the articleThe composite real-estate-closing incident, the AiTM session-token theft, and a callback-verification policy that helps check payment changes.
Read the articlePre-merger cyber diligence, the lateral-hire onboarding problem, the 4-quarter program, and the identity-consolidation question every growing firm hits.
Read the articleThe role-distinction reframe for law firms. What your IT provider owns, what a security operation owns, the specific questions to ask to tell whether the layer is covered, and why co-managed is the healthy model.
Read the articleHonest fit check
How we start
Tell us how the firm runs. Practice areas, DMS, office count, attorney + staff headcount, current IT firm, cyber-insurance renewal date, any recent incidents, and what is driving the conversation. We tell you which tier fits and where the real risks are.
Endpoint and user counts, tier recommendation, the implementation schedule, and the ABA-aligned deliverables (written security plan, IR plan, vendor management review). Fixed monthly pricing. Month-to-month or annual. No vendor markup games.
Managed detection and response agent on every endpoint and server. Managed ITDR connected to your Microsoft 365 or Google Workspace tenant. Awareness program launched with a phishing simulation calibrated to the firm's practice areas. Written engagement agreement covering MR 5.3 supervisory expectations signed before any access.
The 24/7 security team is watching from day one. Obsidian Ridge handles escalations, quarterly managing-partner briefings, the written security plan, the FO 483 incident response runbook, the cyber-insurance renewal support, and the tabletop exercise every firm should be running annually.
ABA duties in plain English
Three ABA sources set the practical cybersecurity floor for law firms in 2026:
This is a general summary for educational purposes, not legal advice. Application to a specific matter depends on jurisdiction and facts, and the rules and formal opinions change over time. Consult qualified bar counsel and the official ABA guidance. Source: ABA Model Rules of Professional Conduct (americanbar.org).
Wire fraud in North Carolina closings
Lawyers Mutual says every policy it issues carries a Financial Fraud Exclusionary Endorsement, and that the endorsement contains a safe harbor for attorneys in real estate transactions, made of two procedures:
Those are the firm's procedures, in Lawyers Mutual's terms. We don't read your policy or say what it covers; your endorsement and Lawyers Mutual answer that.
Obsidian Ridge is not an insurance producer, broker, or agent. We do not sell, place, or advise on insurance products.
Sources, all from Lawyers Mutual and fetched September 25, 2026:
A general summary, not legal or insurance advice.
Questions managing partners ask
At Obsidian Ridge, we help small law firms protect client records with managed endpoint and identity monitoring, staff training and security evidence under an agreed service scope.
These controls support the firm's ABA cybersecurity duties; the firm and its ethics counsel remain responsible for legal decisions, supervision and client communication.
ABA Model Rule 1.6(c) requires reasonable efforts to prevent unauthorized disclosure of or access to client information; it names no control, and whether a given set is reasonable is the firm's judgement.
We deliver the technical safeguards that analysis usually rests on — audit controls, encryption, identity threat detection, integrity monitoring — and we sign a written engagement agreement that addresses MR 5.3 supervisory expectations before any work begins.
Vendors are not 'ABA certified' in any formal sense; the meaningful question is whether they can produce the technical evidence and meet the firm's supervisory standards. We can do both.
We are not the firm's ethics counsel and we do not claim to be.
No, and we are explicit about that. We are a managed cybersecurity firm, not a legal-IT MSP. Your IT company continues to handle help-desk, Wi-Fi, hardware, e-filing system support, and DMS administration.
A security team provides 24/7 monitoring. We handle identity threat detection, security awareness training, incident response coordination, and the FO 483 breach response support.
The two functions belong with different specialists; most general legal-IT MSPs are not staffed or licensed to operate a 24/7 SOC.
Ridge Core starts at $25 per person per month, covering every workstation, every server and partner laptops with 24/7 monitoring by a security team plus identity monitoring on the Microsoft 365 or Google Workspace accounts.
Ridge Plus at $50 per person per month adds the awareness-training program, email protection and a secure browser for your work apps.
Ridge Reserve at $70 per person per month adds the incident response plan, quarterly admin-access reviews and monthly patch reporting for practices with an upcoming insurance renewal or audit.
Yes. Managed detection and response covers every endpoint and server, including on-prem DMS servers (iManage Work on-prem, ProLaw, older NetDocuments hybrid deployments).
Managed ITDR covers the identity-layer attacks that target the DMS through SSO compromise.
For the DMS itself, we run a security settings review — MFA, admin separation, user access, former staff, external sharing and audit logging — and deliver a list of fixes the firm or its IT vendor applies.
Yes, arguably more. Cloud DMS shifts the server burden to the vendor and the threat model toward account compromise.
That is exactly where Managed ITDR matters most: monitoring sign-in anomalies, mailbox rules, and token-replay attacks on your M365 or Workspace tenant, plus OAuth consent on Microsoft 365 — the front door to the cloud DMS.
The endpoint side is still important — laptops accessing the cloud DMS still get phished — and Ridge Core already covers both sides, so it is usually the right starting point for cloud-only firms.
We agree a deployment schedule after checking your devices, tenants, access permissions and existing IT arrangements. The proposal lists the work in scope and the evidence deliverables; timing depends on that scope and the access available.
Yes. Our Cyber Insurance Readiness sprint maps the carrier questionnaire to the actual controls you have or need, packages the evidence the underwriter wants to see, and tells you honestly which gaps are worth closing before renewal.
The goal is to turn a declined, surcharged, or uncertain application into a cleaner underwriting conversation backed by evidence. We are not an insurance broker — we don't sell the policy, we help you qualify for it.
A security team acts on the alert around the clock. For an active incident, call your cyber insurance carrier's breach hotline first; there is no emergency line here.
Within one business day, Obsidian Ridge takes over everything past containment.
We coordinate forensics, walk through ABA Formal Opinion 483 notification obligations to current clients whose material confidential information was affected, help file the cyber-insurance claim, and produce the documented response evidence.
The managing partner remains the decision-maker for client communication and ethical disclosures — we operate every technical and process step required by the breach response.
Two ways to start
The 10-minute assessment scores your firm against the controls the bar and your carrier ask about — no email required to see your result.
The 30-minute law-firm briefing goes deeper — DMS, office count, practice areas, insurance renewal, the threat model, and what your first 90 days would look like.
Both are free, both are no-obligation, and we tell you when you don't need us.
See how we serve law firms and other small businesses in Raleigh, Durham and the Research Triangle.
Read the industry guide, compare the service scope and start with your carrier's actual questions.