Cyber security for legal practices

A security operations centre that works through the night

Every managed device runs Microsoft Defender for Endpoint P2. Its alerts go to a human security operations centre (SOC) that works 24/7, weekends included.

• Endpoints. Suspicious activity on laptops and desktops is investigated by an analyst.
• Identity. Risky sign-ins and unusual account behaviour are checked as they happen.
• Phishing. Simulated phishing shows how your people respond before a real lure lands.

When an alert is genuine, the analyst triages it and our engineers act on it. You hear from a person who can tell you what happened and what has already been done.

The baseline on every tenant

• Multi-factor authentication enforced through Conditional Access, with legacy authentication blocked.
• Attack surface reduction rules that shut down common ransomware tricks, such as malicious Office macros.
• Managed, encrypted devices. Intune enrols, encrypts, patches and compliance-checks every laptop.
• Independent Microsoft 365 backup held outside your tenant and restore-tested on a schedule. See backup and incident recovery.

Mapped to the Essential Eight

The Australian Cyber Security Centre's Essential Eight covers eight mitigation strategies: application control, patching applications, restricting Office macros, user application hardening, restricting administrative privileges, patching operating systems, multi-factor authentication and regular backups.

Our baseline is mapped to it, so you can see what is in place against each strategy. We do not certify a maturity level for you. Where a client, panel or insurer asks for a particular level, we scope the remaining work in your quarterly roadmap and price it before anything starts.

Insurer cyber questionnaires

Professional indemnity and cyber insurers now ask detailed questions about MFA, backups, endpoint protection and patching. We answer from your documentation register, so the facts you give your insurer match what is actually configured.

Where most incidents start

Breaches in smaller practices rarely need a clever attacker. A mailbox without MFA, an unmanaged laptop or a forgotten admin account is usually enough. The baseline closes those gaps first. Email is the most common way in, so it has its own page.