Walk into a 3D lesson.Watch a learner go through the bar scenario, step by step.- Industries
- Legal
Security awareness training for law firms, built around client confidentiality.
Law firms hold privileged documents, client money and deal timelines, and the FBI has warned that criminals reach them by phone. Cyberfrog trains partners, fee-earners and support staff with realistic simulations and short lessons, and keeps the records clients ask for in their security reviews.
- Callback and fake IT-support tests
- Deepfake partner and client calls
- Lessons between billable hours
- Records for client audits
A document has been served on your firm in the above matter. The response deadline is three working days from service. The document stays on the secure portal for 48 hours; sign in with your firm email account to view it.
View served document- A court portal on an unfamiliar .org domain, not the official court service
- A short deadline that pushes a fee-earner to act before checking the matter
- Asks for the firm email password to open a document
What attackers send to law firms.
A law firm knows its clients' secrets and moves their money. Attackers often do not need to break anything: they call, pretend to be IT or a client, and ask.
- The call from 'IT support'
Silent Ransom Group, also known as Luna Moth, poses as IT support by phone and email. If remote access fails, it sends a person to the office to plug in a storage device. It has targeted US law firms since spring 2023. FBI FLASH-20260526-01
- The most-reported ransomware target
Legal services were the most-reported industry, at 18%, among the more than 1,400 ransomware complaints from sectors outside critical infrastructure. FBI IC3 Report 2025
- Diverted client payments
Business email compromise losses reported to the FBI reached USD 3.05 billion in 2025. FBI IC3 Report 2025
- Social engineering in professional services
In professional services, system intrusion, social engineering and basic web application attacks make up 91% of breaches, and credentials are among the compromised data in 31%. Verizon DBIR 2026
- A breach in the justice system
The UK Legal Aid Agency suffered a cyber attack, discovered on 23 April 2025, that exposed data of legal aid applicants. GOV.UK, Legal Aid Agency cyber security incident
Every role in the firm, its own training path.
A partner approving a completion, a secretary taking a call from 'IT' and an accounts clerk releasing client money face different tricks. Cyberfrog trains each group on the ones aimed at them.
- Partners and fee-earners
Fake court and client messages, deepfake calls from a senior partner, and the technology competence that bar rules expect.
- Secretaries, PAs and paralegals
Callers from 'IT support' who ask for remote access, and visitors who arrive to 'fix' a laptop, covered in the physical-security 3D lesson.
- Accounts and client money
Changed bank details the day before completion, urgent transfers and invoices from look-alike client domains.
- IT, practice management and risk
Help-desk reset requests, evidence for client security reviews and outside counsel guidelines, and training for the management board.
The calls and emails your firm really gets.
Legal simulations copy the pressure of real matters: deadlines, privilege and client money. Every mistake leads to a short lesson on exactly that trick.
- Multi-stageCallback phishing
An email about a software renewal gives a phone number. The AI voice that answers asks the caller to start a remote-support session.
- EmailServed court document
A notice from a fake e-filing portal, with a cloned sign-in page and a three-day deadline.
- EmailNew bank details for completion
A 'client' writes from a look-alike domain the day before completion with changed account details.
- DeepfakeThe senior partner on video
A short video message asks a fee-earner to send a draft agreement to an outside address.
Find the lawyers attackers have already profiled.
Firm websites list partners with their email address, practice area and recent matters, which is most of what a convincing lure needs. Cyberfrog's OSINT campaigns map that public footprint and check your domain against Darknetsearch's breach and stealer-log data.
The result is a list of exposed people with drafted simulations, and nothing is sent until you launch it. Exposed staff get a personal notice and a lesson on how their data leaked. Passwords are shown only as much as your privacy settings allow.
What the rules ask of law firms.
Bar rules rarely say 'phishing training', but confidentiality and competence duties are hard to meet without it. Cyberfrog keeps per-person training records for regulators, insurers and client audits.
| Rule | What it asks for | How Cyberfrog helps |
|---|---|---|
| ABA Model Rules 1.1 (comment 8) and 1.6(c) | Keep up with the benefits and risks of relevant technology, and make reasonable efforts to prevent unauthorised disclosure of client information. | Role paths for lawyers and staff, with records that show the firm's efforts. |
| ABA Formal Opinions 483 and 512 | Duties after a data breach (483), and competence and confidentiality when lawyers use generative AI (512). | Lessons on reporting incidents and on using AI safely, both in the library. |
| New York CLE rule | Since 1 July 2023, New York attorneys need one CLE credit in Cybersecurity, Privacy and Data Protection in each biennial cycle. | Cyberfrog is not CLE-accredited; it adds practice on real lures all year, between those courses. |
| Swiss Criminal Code Art. 321 and Lawyers Act (BGFA) Art. 13 | Professional secrecy for lawyers and their auxiliaries. No training duty, but the core confidentiality duty that training protects. | Lessons on handling data and sharing files for lawyers and support staff alike. |
| ISO/IEC 27001:2022 and Outside Counsel GuidelinesMapped in Cyberfrog | Clients often ask firms for ISO 27001 or the security controls in their guidelines. Annex A 6.3 covers awareness, education and training. | Programme mapped to ISO 27001, with coverage and completion reports per person. |
Summaries for orientation, not legal advice. Cyberfrog provides training records and coverage reports; it does not certify compliance.
Questions from law firms.
Why are law firms targeted by cybercriminals?
They hold confidential client information and handle large payments, often under deadline pressure. The FBI reports that legal services were the most-reported industry among ransomware complaints from sectors outside critical infrastructure.
How do fake IT support scams against law firms work?
The FBI describes Silent Ransom Group calling or emailing staff as IT support and asking for remote access. If that fails, it may send someone to the office to plug in a storage device. Verifying every support request through a known internal number, and never letting an unannounced visitor touch a device, counters both steps.
Do lawyers need cybersecurity CLE credits?
In New York, yes: since 1 July 2023 attorneys need one credit in Cybersecurity, Privacy and Data Protection in each biennial cycle. Other jurisdictions differ. Cyberfrog training is not CLE-accredited, but it gives lawyers practice on real lures between those courses.
What cybersecurity compliance applies to law firms?
It depends on where you practise. In the US, ABA Model Rules 1.1 and 1.6(c) and Formal Opinions 483 and 512 shape what reasonable security means. In Europe, GDPR applies to client personal data, and in Switzerland professional secrecy under Art. 321 of the Criminal Code. Many clients add ISO 27001 or outside counsel guidelines on top.
Can we train partners who will not sit through a course?
Yes. Lessons take a few minutes, simulations reach partners in their normal inbox and on their phone, and a deepfake or voice scenario shows the risk more clearly than any slide.
Related industries.
- IndustryFinancial services
Payment-diversion emails, deepfake executives and phone calls that push staff to release a transfer or reset an account.
Read more - IndustrySaaS
Phone calls that get staff to approve a malicious connected app, stolen OAuth tokens and fake job applicants.
Read more - IndustryPublic sector
Calls posing as the authorities, AI voice messages from senior officials and ransomware that stops municipal services.
Read more
Protect privilege before the call comes.
In a 30-minute demo we show the callback, court-notice and deepfake simulations for your firm, on your own domain.