That gap, between the people understanding a firm’s risk and the people controlling its resources, is where security failures begin. For firm administrators, chief operating officers and executive directors, closing it has become a core operational responsibility.
Why the Stakes Have Changed
Insurance underwriting has followed a similar trajectory. Carriers have moved away from box checking toward rigorous technical verification, and recent case law shows that shift in practice. In 2022, an insurer rescinded a cyber policy and denied a ransomware claim after a forensic investigation found that the multifactor authentication the policyholder had attested to across every system was in fact missing from the server where the attack originated. The City of Hamilton lost an $18.3 million claim on nearly identical grounds in 2024. The lesson is clear: When an IT director affirms MFA on an insurance application but has not actually deployed it across every legacy device, that gap does not remain theoretical. Once a breach occurs, the resulting loss goes straight to the firm’s bottom line rather than being absorbed by the policy the firm believed protected it.
The firms that close this gap most effectively rarely spend more on security than their peers.
Nor is the exposure limited to the firm. In 2016, a corporate client sued a law firm, alleging malpractice on the grounds that the firm had charged standard rates while failing to provide security consistent with the expertise it had marketed to clients. The first case of its kind, it opened a line of reasoning regulators and clients have continued to press: Firm leadership is now expected to demonstrate active, informed oversight of security decisions, not simply fund an IT budget and hope for the best. That is as much a governance standard as a technical one, and it falls on whoever is ultimately accountable for how the firm operates.
Why Both Sides Are Stuck
Security professionals think in terms of control frameworks, threat models and vulnerability ratings: a precision that serves IT well but tends to fall flat in a boardroom. Lawyers, by contrast, evaluate arguments for a living and are trained to look for a specific, actionable request. When an IT presentation concludes with an appeal to “improve our security posture,” it effectively asks partners to complete analytical work the presenter should have already finished. The predictable outcome is an expensive stalemate, and nothing gets funded.
Three Things Firm Managers Can Do Now
Anchor requests to business metrics. Consider the difference between two ways of making the same request. Framed technically, it might read: “We need $50,000 for an EDR solution because legacy antivirus is not catching zero-day exploits.” Partners understandably tune this out. Framed in business terms, the same request hits differently: “Our three largest corporate clients require endpoint detection and response under their outside counsel guidelines. This investment protects the $1.2 million in revenue those clients represent and keeps us compliant with our insurer.” The underlying need has not changed, but the second version gives a committee something to actually act on.
The Ideal Bridge
That process will not build itself, and the person best positioned to construct it is usually already in the room. The question worth asking is whether that responsibility remains informal or becomes a defined part of the job.
