Law firms are high-value targets because they concentrate highly confidential data - client secrets, deal/litigation material, IP, personal & financial data - and move large client-money transfers. Two risks dominate: a confidentiality breach (unauthorised access to document management, email or case systems exposing privileged, sometimes market-moving info) and payment-diversion fraud (intercepting a client-money transfer). Test the document management system, email, client/matter portals, practice/case management, and client apps - with heavy focus on the access controls separating one client's matter from another's and the money-transfer workflows. Drivers: confidentiality duty, the PDPLs, reputational stakes, and - increasingly - clients demanding a recent test before sharing sensitive matters. Details below; the fraud angle mirrors real estate.
// 01 Why legal is a high-stakes target
A law firm's business is confidentiality, and its systems hold an unusually rich concentration of exactly what attackers want: client secrets, deal and litigation material, intellectual property, and personal and financial data. That makes firms a prime target for data theft, extortion and - around major transactions - insider-trading-motivated attacks after market-sensitive information. They also handle large client-money transfers, drawing payment-diversion and business-email-compromise fraud. The stakes compound: a breach can expose privileged and market-sensitive information, constitute a professional-duty failure, and cause severe reputational damage. And clients increasingly demand evidence of strong security before sharing sensitive matters. The result is a sector that is both a favoured, high-consequence target and under growing pressure to demonstrate its defences - which is why real testing has become a business need, not a formality.
// 02 The two risks that dominate
Confidentiality breach. Unauthorised access to the firm's document management, email or case systems exposes privileged client information - both a professional-duty failure and, for deal or litigation work, potentially market-moving. Confidentiality is the firm's core promise, so any path that lets an attacker (or the wrong internal user) reach a matter they shouldn't is the gravest finding. Payment-diversion fraud. An attacker who has compromised or is spoofing email intercepts a client-money transfer and redirects funds, exploiting the large sums that flow through legal transactions - the same scheme that plagues real estate. Both risks are amplified by the fact that legal work runs heavily on email and document sharing, so testing concentrates on the systems where confidential data lives and where money moves - and on hardening the technical rails (email, portals, authentication) that fraud runs on.
// 03 What to test
Document management
Where confidential client files live - the crown-jewel data store, and its access controls.
Central to legal work and the usual fraud entry point - security, spoofing resistance, and account protection.
Client & matter portals
Client-facing portals and the authorisation separating one client's matter from another's.
Practice & case systems
Practice and case management platforms, and the money-transfer workflows.
Underneath sit the web, API and network layers. Because confidentiality is paramount, access-control testing - ensuring no user or attacker reaches information they shouldn't - is the centre of gravity, exactly the object-level authorisation discipline.
// 04 The client-demand driver & how it runs
Legal's testing driver is increasingly commercial. Corporate and institutional clients entrusting a firm with sensitive matters - especially in finance, M&A and regulated industries - now routinely assess their law firm's security and often require a recent penetration test or attestation before engaging or as part of ongoing due diligence, via a security questionnaire. Alongside this sit data-protection obligations (the PDPLs for personal data) and the sheer reputational stakes of a breach. So many firms now treat regular testing as a business necessity for winning and retaining significant clients, not just compliance. An engagement weights confidentiality and the money-transfer workflows, delivers a report clients accept, and follows our methodology with findings retested to closure.
// 05 Frequently asked questions
Why are law firms a target?
They hold a rich concentration of highly confidential information - client secrets, deal and litigation material, IP, personal and financial data - a prime target for data theft, extortion and insider-trading-motivated attacks. They also handle large client-money transfers, drawing payment-diversion and BEC fraud. A breach exposes privileged, sometimes market-sensitive information and causes severe reputational and professional damage, and clients increasingly demand evidence of security - making legal a favoured, high-stakes target.
What's the biggest risk for a law firm?
Two: a confidentiality breach (unauthorised access to document management, email or case systems exposing privileged, sometimes market-moving client information) and payment-diversion fraud (intercepting a client-money transfer by compromising or spoofing email). Both are amplified because legal work runs heavily on email and document sharing, so testing focuses on where confidential data lives and where money moves.
What should a law-firm pentest cover?
The document management system storing confidential files, email and its security, client and matter portals, practice/case management systems, and client-facing apps - across web, API and network layers. Testing covers the authentication and authorisation separating one client's matter from another's and the client-money-transfer workflows. Because confidentiality is paramount, access-control testing is central.
Do clients require law firms to have testing?
Increasingly, yes. Corporate and institutional clients entrusting sensitive matters, especially in finance, M&A and regulated industries, routinely assess a firm's security and often require a recent test or attestation before engaging or in ongoing due diligence. Alongside data-protection obligations and reputational stakes, many firms now treat regular testing as a business necessity for winning and retaining significant clients.
// 06 Related reading
- Real estate & proptech — the shared payment-diversion fraud risk.
- Vendor security questionnaires and the attestation letter — what clients ask for.
- PDPL requirements and access-control flaws.