Law firms · Barristers · Legal practices
Cyber security for law firms
Law firms are targeted for client data and trust account funds. We secure the email, website and Microsoft 365 settings criminals go after first.
What are the biggest cyber risks for Australian law firms?
The biggest risks are business email compromise and payment redirection (especially around settlements), phishing that steals Microsoft 365 credentials, spoofed firm domains, and breaches of confidential client data. The core defences are multi-factor authentication, an enforced DMARC policy, hardened Microsoft 365, verified call-back procedures for bank detail changes, tested backups and a breach response plan.
// The risks
Why law firms are high-value targets
Payment redirection and email compromise
Compromised or spoofed mailboxes used to send fake bank details to clients, especially around property settlements.
Confidential client data
Matter files, identity documents and correspondence that would cause serious harm if exposed.
Credential phishing
Fake Microsoft 365 login pages that capture passwords and, without MFA, give attackers the whole mailbox.
Professional and reputational risk
A breach can raise questions from clients, insurers and the regulator long after systems are restored.
How we protect firms
- Enforced SPF, DKIM and DMARC so nobody can send as your firm
- Microsoft 365 hardening: MFA, admin roles, forwarding rules, legacy authentication off
- Secure, maintained firm website with no forgotten plugins or logins
- Payment verification procedure and staff training
- Essential Eight assessment and roadmap for client and panel questionnaires
- Incident response plan aligned to your professional obligations
Experience in legal
We have built, secured and supported websites and digital systems for Perth law firms for years, including Clifton Legal Group, MA Legal Group and Vogt Legal. We understand how firms work, and how careful you need to be with client information.
See legal case studies// FAQ
Common questions
Why are law firms targeted?
Law firms hold exactly what criminals want: confidential client information, settlement and trust account funds, and correspondence they can use to redirect payments. Conveyancing and settlement fraud through compromised email is a well-known pattern.
What security do clients and insurers expect from a law firm?
Increasingly, multi-factor authentication on email and practice management systems, enforced DMARC, encrypted devices, tested backups, staff training on payment verification and an incident response plan. Larger clients and government panels may ask about the Essential Eight.
Can you work with our practice management software provider?
Yes. We focus on the website, email domain, Microsoft 365 configuration and overall controls, and coordinate with your IT provider and software vendors on the rest.
Do we need to notify clients after a breach?
If client personal information is involved and serious harm is likely, notification obligations under the Notifiable Data Breaches scheme may apply, alongside your professional obligations. We help you establish the facts quickly so you and your insurer can decide.
// Keep going
Services for your sector
Email Security & DMARC
Stop email spoofing and invoice fraud. We set up SPF, DKIM and enforced DMARC, harden Microsoft 365 and fix email deliverability for Perth organisations.
Essential Eight Assessment
Essential Eight assessments for Perth and WA organisations: evidence-based maturity scores, a risk register and a practical roadmap to Level 2.
Cyber Incident Response
Cyber incident or data breach? We help Perth organisations contain, investigate, recover and meet OAIC and ASD reporting obligations. Call 1300 566 652.
// Next step
Talk to us about your organisation
A confidential, no-obligation conversation about what you hold, who asks about your security and where you think the gaps are.
- Happy to sign an NDA first
- Fixed scope and price before work starts
- Works alongside your IT provider
Written and reviewed by Noah Greenstone, Founder and Principal Consultant. Last reviewed 22 October 2026.
Tell us what is going on
We read every enquiry and reply within one business day. If it is urgent, call 1300 566 652.
Organisations Noah and the team have built, secured and supported
