The FBI put out a warning this spring that every managing partner should read: a crew is calling law firm staff, posing as IT support, talking their way onto a machine, and walking out with whatever files they can reach.
Whatever files they can reach. That's the part to sit with.
For most firms I talk to between Palm Beach and Port St. Lucie, that pile is bigger than anyone thinks. Client documents live in attorney mailboxes, on a laptop desktop, in a paralegal's personal file-sharing account, and in a shared folder nobody has opened since 2019. Every emailed attachment is one more copy you can never pull back.
A real client portal in SharePoint changes the math. The document stays in one place and you send a link instead of a copy. You can see who has access, you can cut it off in under a minute, and you can set the link to expire on its own.
Two things worth checking this week: external sharing is on by default in Microsoft 365, and "anyone with the link" sharing leaves you no record of who opened the file. Microsoft's own guidance: keep sensitive matters on a site with external sharing off, and use separate sites for work that needs outsiders.
The call you don't want to make is the one where a client asks which of their documents walked out, and you have no answer.
Worth a look before your next cyber renewal.
Want the next one in your inbox?
One practical Microsoft 365, Copilot, Azure, or security move per week — plain English, no pitch.
Subscribe via email