An eight-attorney firm. A confidential merger matter. And a paralegal who did absolutely nothing wrong.
This walkthrough shows how a firm can be compromised without anyone clicking a bad link or opening a bad file — and why that possibility matters to the standard of care rather than only to the IT budget.
You will be asked to predict what happens at several points. The wrong answers are the ones most attorneys pick, which is what makes them worth working through.
No technical background needed. Any term appears like this — — and you can tap it for a plain-English definition at any time.
Scene 1 · Wednesday, 12:15 p.m.
An article over lunch
Priya is a paralegal at the firm. Over lunch she reads State Bar Weekly, a legal news site she has visited most weeks for four years.
Proposed amendments would reshape fee agreement disclosure
By the editorial staff · 6 min read
A working group has circulated draft amendments that would expand written disclosure requirements for contingency arrangements, drawing early comment from practitioners in several districts.
Valid certificate · the real site · the real article
She clicked no link in an email. She opened no attachment. She downloaded nothing. She read an article on a site she trusts, and closed the tab.
What she could not see is that attackers had quietly compromised State Bar Weekly some days earlier, and were serving malicious code to a fraction of its visitors.
What could Priya have done differently?
Consider it seriously before answering. Most people assume there was something.
This is a . Rather than approaching the target, the attacker compromises a site the target already trusts and waits for them to arrive.
Hold on to this. Everything that follows happens without a single careless act by anyone at the firm — which is precisely the point of the exercise.
Scene 2 · 12:15 p.m.
What loading the page did
The compromised site exploited a flaw in Priya's web browser — one the browser's maker does not know exists. Simply rendering the page was enough to install software on her laptop. No prompt appeared. Nothing was downloaded that she could see.
That is a . The vendor has had zero days to fix it. There is no update to install, because nobody has written one. And no antivirus has a description of it, because nobody has seen it before.
Does the firm's antivirus catch this?
The firm runs a reputable product, kept current.
Why it stays silent
Antivirus is a guard with a list of banned visitorsEveryone arriving is checked against the list. Someone who has never been banned anywhere walks straight past — not because they are harmless, but because the list is the only thing being consulted.
Antivirus works largely from : descriptions of malicious files already identified somewhere in the world. Something built to be new matches nothing on the list.
To be fair to antivirus: modern products also use heuristics and some behavioral rules, and they do sometimes catch novel code. But an attacker building something new tests it against common products until it passes. It cannot be relied on for this.
What would have helped here
Not a longer list. Something watching what the browser did — because a browser that silently starts another program is behaving abnormally whether or not anyone has named the code.
Scene 3 · 12:16 p.m.
The call home
A minute later the newly installed program opens a connection out to a server the attacker controls, and waits for instructions.
It uses on the standard web port — the same protocol as every site the firm visits all day.
Does the firm's firewall block that connection?
The firm has a business-grade firewall, properly installed.
What a firewall actually does
A firewall is the locked front doorIt is essential, and it decides who may enter. But it offers nothing once someone is already inside, and it cannot tell whether a person in the file room is pulling their own matter or somebody else's.
A firewall enforces rules about where traffic may travel — which addresses, which ports, which directions. It does not evaluate what a program on a computer inside the firm is trying to do.
Outbound web traffic has to be allowed, or nothing works: not research, not filing, not the document system. The attacker chose it for that reason.
Option C is nearly right, and worth being precise about: some firewalls do block connections to servers on known-malicious lists, which genuinely helps. But a server registered this week for this campaign is on no list yet.
What would have helped here
Noticing that this particular program — one that appeared on the laptop an hour ago and had never run before — was reaching the internet at all.
Scene 4 · That night
"But our documents are in the cloud"
Priya left at 5:30. Her LexVault session is still open in her browser, the way it is most evenings.
Late that night the malware uses that session to work through a confidential merger matter belonging to one of the firm's clients — and begins downloading every document in it.
Priya has never worked on that matter.
LexVault is a secure cloud platform with strong controls. Are the client's files safe?
This is the most common assumption among firms that have moved to the cloud.
Where the responsibility actually sits
LexVault secures its own servers and its own staff access. It does that well, and it was never attacked. Nothing here required breaking into the platform at all.
What the platform sees is a valid session belonging to Priya, from the firm's usual internet address, requesting documents her account is permitted to open. Every check passes, because every check legitimately should.
The platform's security ends where the laptop begins — and that side belongs to the firm. Moving documents to the cloud moved the servers. It did not move the laptop, and the laptop is where the attacker is.
Option C deserves a note, because the principle is sound. If matter access were limited to the people staffed on each matter, this attacker would have reached far less. Access scoping is real risk reduction and worth doing. In this firm, as in many, staff accounts could reach most matters — which is exactly what made the whole merger file available.
This is also where the enters. In general terms, attorneys are expected to make reasonable efforts to prevent unauthorized disclosure of or access to client information, and most states now recognize a related . How those apply to a given firm is a question for its own counsel.
What would have helped here
Noticing the pattern rather than the permissions. A paralegal opening documents is normal. A paralegal opening a matter she has never touched, at midnight, at two hundred files in four minutes, is not — and no permission check will ever ask that question.
Scene 5 · The same day, twice
What each setup sees
Identical attack. Identical firm. The only difference is whether anything is watching behavior.
Antivirus + firewall only
With behavior monitoring
Tap any alert on the right to see why that moment was abnormal.
What was doing the watching
EDR and UEBA are the observant office managerThe one who notices that someone with a perfectly valid badge is copying an entire merger file at midnight. The badge is real. The behavior is what does not fit.
watches what programs do on a computer: what launches what, what connects where. The first two alerts came from there.
learns each person's and each device's normal pattern — hours, matters, volume — and flags departures from it. The last three came from there.
No single alert here is proof of anything. An attorney will recognize the structure: it is the accumulation that carries weight. Odd hour, unfamiliar matter, and impossible volume together describe a pattern of conduct that no innocent explanation fits.
One honest caveat. Behavior monitoring is not perfect either. It can raise alerts that turn out to be benign, and it needs a baseline period before it is useful. The claim is not that it catches everything — it is that it can catch things with no signature, which signature-based tools structurally cannot.
Scene 6
Four things to take away
1
This attack needed no mistake by anyone.Nobody clicked a bad link or opened a bad file. The same zero-day could just as easily have arrived through an email, a routine software update, or a document from opposing counsel.
2
Zero-day attacks have no signature.Tools that work by recognizing known threats cannot see something never seen before. That is a structural limit, not a product defect.
3
Firewalls check where traffic goes, not what is happening on your computer.The malicious connection looked exactly like ordinary browsing, because the attacker made it look that way.
4
Your cloud platform's security ends where your laptop begins.LexVault was never breached. Everything happened on one laptop, through one real session.
Antivirus and firewalls are still necessary. They are just no longer sufficient. They stop a large volume of routine, known attacks every day, and removing them would be a serious mistake. The gap is specifically the attacks built to be new.
The first takeaway is the one worth sitting with. Training matters, and a firm should still run it. But a defense that depends on every person being alert every time is a defense that assumes away the case you just read.
If it is widely known that antivirus cannot detect zero-day attacks, is relying on it alone a reasonable effort?
That is a question about foreseeability, and it is one each firm has to answer for itself. Nothing on this page answers it for you.
Scene 7
Reasonable efforts checklist
Three quick questions, then a six-item review of your firm.
Question 1
What could Priya have done to prevent the infection?
Question 2
Why did the document platform allow the downloads?
Question 3
What made the attack detectable on the monitored side?
Six questions about your firm
Nothing is recorded or sent anywhere — this runs entirely in your browser.
Priya's Wednesday is an illustrative composite, not a report of a specific incident. LexVault, State Bar Weekly, and the firm are fictional. Document counts and times are used to show how an attack unfolds and are not statistics. References to professional responsibility are general and simplified; the Model Rules are not themselves binding and states adopt their own variations. Nothing here is legal or ethics advice — consult your own counsel or bar association about your obligations.