Most IT Providers Measure Uptime. I Measure What a Bad Day Would Cost You.
By Jorge Crastz,
After twenty years in IT and security, I've noticed something about how most providers report to their clients. Monthly summaries of tickets closed, patches deployed, systems online. It is all true, and almost none of it answers the question a managing partner actually has, which is whether the firm could survive a bad week.
So I start somewhere else.
Step one: put a number on it
Before I look at a single firewall setting, I work out with the firm's leadership what one day without their critical systems would cost.
Take a firm collecting $12 million a year across roughly 250 working days. That is about $48,000 of normal activity per day. If 70% of the work stops, such as matter files, calendars, document management, billing, roughly $33,600 of revenue is disrupted.
Payroll keeps running regardless. At $7.5 million fully loaded, that is about $30,000 a day, and at 60% lost productivity, around $18,000.
Together: about $51,600 per day before forensics, breach counsel, notification costs, or the insurance deductible. Five days is $258,000.
I do this first because it changes every conversation that follows. Once leadership has seen that number, security stops being an IT budget line and becomes a business decision with a known downside.
Step two: find where law firms are different
This is where generic downtime models break, and where working with law firms specifically matters.
In most businesses the cost of a day offline is roughly flat. In a law firm it spikes. A day of downtime in a quiet week is expensive. A day of downtime the week of a filing deadline, a closing, or a trust account disbursement is a different kind of problem, because none of those dates move for you.
So I map the firm's calendar against its systems. Which practice groups have deadlines in the next ninety days, and what do they depend on to meet them? That turns a single daily number into a risk profile with peaks, and the peaks are where protection matters most.
There's a second law-firm-specific factor: confidentiality. A retail business that loses a day loses revenue. A firm that loses control of privileged material loses something that can't be recovered by restoring from backup, and may carry obligations to clients well beyond the outage itself.
The cost that doesn't fit in the calculation
Everything above measures the cost of being down. It doesn't measure the cost of what clients conclude about you afterwards, and for a law firm that can be the larger number.
A retail business that has an outage loses some sales. A law firm that loses control of client information loses something clients chose it for in the first place: the assurance that their matters are safe. Some clients will stay. Some will quietly move their next matter elsewhere. Referral sources get more cautious. And in a campaign like the one I wrote about earlier in this series, where attackers built public websites naming individual firms, the damage can reach clients before the firm has even established what happened.
You can't calculate reputation precisely, but you can measure how exposed you are to it. When I work with a firm, I ask what share of revenue comes from its ten largest clients, and what losing just one of them would mean. For many firms, a single departure costs more than a full week of downtime.
There's a newer version of this risk too. More corporate clients now send security questionnaires before engaging outside counsel, and firms that can't answer them confidently don't get the work. That loss never appears as an incident. It shows up as business that simply never arrives.
So I treat reputation as a multiplier on everything else. The downtime number tells a firm what an incident costs this week. Client concentration tells it what the incident could cost next year.
Step three: look at it the way an attacker would
This is the part I think sets how I work apart.
I'm a Certified Ethical Hacker, which means I've been trained to assess systems from the attacker's side. Once I know what downtime costs a firm and when it costs the most, I ask a different question than most providers: if I wanted to make that number as large as possible, where would I go?
For most firms the answer is not the server in the closet. It's identity. The accounts that unlock email, document management, and cloud storage all at once. It's the document management system, because that's where the matters live. And it's email, because that's where wire instructions and client communications travel.
That gives me an order of priority grounded in impact, rather than a checklist applied evenly to everything. Protection goes first to the systems whose failure would cost the most, at the times it would cost the most.
Step four: check it against the insurance policy
The last thing I look at is one most firms never connect to the rest: their cyber insurance application.
Carriers ask firms to attest to specific controls, like multi-factor authentication on remote access, tested backups, endpoint protection. Those forms are usually completed by someone who wants to answer yes, and who may not know what's actually configured.
If the firm has an incident and the controls it attested to aren't in place, the claim gets more complicated at exactly the moment the firm can least afford it. So I compare what the firm said on the application against what is actually running.
What this adds up to
Most firms are protected by providers who keep things running. That matters, and it isn't nothing. But keeping systems online is a different job from knowing what their failure would cost, when it would hurt most, how an attacker would go about causing it, and whether the firm's insurance will respond the way leadership assumes.
That second job is the one I think law firms actually need.
If your IT provider can't tell you what a day of downtime would cost your firm, what are they actually optimizing for?
Sources: SOCRadar: INC Ransom Targeted 24 Law Firms, but Only 10 are Listed; Halcyon: INC Ransom Group Mounts Rapid Campaign Against Law Firms