Why Buying More Security Tools May Not Make Your Law Firm Safer

There is a pattern in how law firms respond to cyber risk. A headline about a breach appears, a partner asks whether the firm is protected, and the answer arrives as a purchase. A new email filter. An additional monitoring service. Another license.

Each purchase is reasonable on its own. Together, they can leave a firm feeling more protected than it is.

What an attacker actually sees

I'm a Certified Ethical Hacker, which means I've been trained to assess systems from the attacker's side. From that side, the question is never "what did this firm buy?" It is "where does their protection stop?"

The answer is almost never a missing product. It is usually one of these:

A tool that was purchased but only partly deployed. Endpoint protection on most computers, but not the laptop a partner uses at home, or the machine running an old piece of legal software that the vendor said not to touch.

An exception that became permanent. Multifactor authentication switched on for everyone except a service account, a senior attorney who found it inconvenient, or a shared login for a case management system.

An alert that nobody reads. Security tools generate warnings constantly. When no one owns reviewing them, the important warning looks exactly like the hundred unimportant ones that came before it.

A gap between two tools. Each product covers its own area. The space where one stops and the next hasn't started is where an attacker goes.

None of those problems gets fixed by buying another product. Several of them get worse.

Why more can mean less

Every tool a firm adds creates work: configuration, updates, license management, alert review, and someone who understands how it interacts with everything else. Law firms rarely have dedicated security staff, so that work lands on an outside provider, an office manager, or nobody.

When nobody owns it, the tool keeps billing and gradually stops protecting. It still appears on the list, which is what makes it dangerous. The list is what leadership sees.

What I look at instead

When I start with a firm, I'm less interested in the inventory of products than in three questions about each one.

Is it deployed everywhere it should be, including remote devices and the systems nobody likes to touch?

Is anyone responsible for reviewing what it reports, and do they actually do it?

Does it protect the systems whose failure would cost the firm the most: email, identity, and the document management system where the matters live?

A smaller set of tools that are fully deployed, actively watched, and aimed at the right systems will almost always outperform a larger set that isn't.

The insurance angle

This matters beyond security. Cyber insurance applications ask firms to confirm specific controls, such as multifactor authentication on remote access and endpoint protection on all devices. Owning a product is not the same as meeting that requirement. If the firm attested to coverage it doesn't fully have, that gap tends to surface at the worst possible moment, during a claim.

The better starting point

Security spending should follow an understanding of what the firm cannot afford to lose, and where an attacker would go to take it. Products come after that, chosen to close specific gaps.

The next articles in this series cover what unmanaged tools actually cost, the questions to ask before buying anything new, and what a strategy-first approach looks like in practice.

If you listed every security product your firm pays for, could you say who is responsible for each one, and whether it's running everywhere it should?