For law firms, accountancy and audit firms, consultancies, conveyancers and other firms that hold client files
Professional firms hold deal documents, litigation files and tax records, and client money passes through their accounts. We test the document systems, cloud tenants and payment processes that attackers use to steal files, read privileged email and redirect funds, and we write the result for partners as well as IT.
A firm's exposure is counted in clients rather than records. Stolen deal documents can move markets, leaked litigation files can damage a case, and the confidentiality a firm promises is written into its engagement letters and its professional rules. Extortion groups know this and threaten to publish client files rather than only encrypting them. The most direct loss is still the oldest: a convincing email at the moment a completion or settlement payment is due, and client money sent to the wrong account.
Attackers watch a compromised mailbox, or register a lookalike domain, and send new bank details just before a property completion, a settlement or a client account transfer.
Ransomware groups now commonly steal files before encrypting them and threaten to publish client documents. Firms with few servers and many cloud services are reached through stolen credentials and the file-sharing tools they use with clients.
A partner's or an assistant's mailbox gives an attacker the client list, the open matters, the calendar and the tone to impersonate anyone. Inbox rules that hide replies and forward copies keep the access alive after a password change.
Document management systems, data rooms and client portals with loose permissions, shared links that never expire, or external users who keep access after a matter closes.
E-discovery vendors, practice management platforms, outsourced IT and transcription services all hold copies of client data, and in each client's eyes their security is yours.
Client files are personal data under GDPR, with breach notification to the supervisory authority within 72 hours and an Article 32 obligation to have a process for regularly testing, assessing and evaluating the effectiveness of security measures. Israeli firms keep client databases under the Data Security Regulations, where the high security level requires penetration tests at least every 18 months; since Amendment 13 took effect on 14 August 2025, a missed test or a severe incident reported late can draw a sanction of NIS 327,560 at 2026 rates for such a database. Corporate clients often ask their advisers for ISO/IEC 27001:2022 certification or a SOC 2 report, and a recent penetration test answers the testing questions in their supplier reviews.
The scoping call settles which of these apply to your systems.
Phishing, vishing and physical pretexting run against your staff, help desk and finance team, only under written authorisation that names the targets, pretexts and limits. Results are reported by channel and pretext, never by name: how far a convincing approach got, how many people reported it and how long the first report took to reach someone who acted.
Duration: 2 to 4 weeks including campaign preparation
Authenticated, role-aware testing of your application and its API surface, with an account for every role. We chain small findings into the access they lead to, such as a sequential invoice ID and a missing tenant check that together let one customer read another's invoices.
Duration: 5 to 10 working days
Internal and external network testing, including Active Directory. Where scope allows we go from an unauthenticated foothold to domain-wide impact and document the whole chain: the exposed service or sprayed credential that got us in, each privilege escalation on the way, and the accounts and hosts it reached.
Duration: 5 to 12 working days
An IAM-first review of AWS, Azure or GCP. We map what an attacker reaches after compromising one workload or one developer laptop, then rank those paths by the data at the end of each and write the Terraform or policy change that cuts it.
Duration: 4 to 8 working days
Hands-on help when an attacker is already inside: triage on the first call, containment that does not destroy evidence, forensic scoping of what was touched, and recovery that we verify before calling it complete. Outside a crisis we run retainers, tabletop exercises and compromise assessments, so your team has practised the first hour before it happens.
Duration: Live incidents until recovery is verified; readiness work in days
Yes. Where a finding gives access to client documents or email, we prove it with a document or mailbox you nominate, record the evidence and stop. The rules of engagement name what may be opened, and engagement data is encrypted at rest and destroyed on a schedule you set.
It answers the testing questions directly and gives you an attestation letter to attach. The findings also show which of your other answers need work before the next questionnaire arrives, and gaps such as missing multi-factor authentication, weak email authentication or overdue access reviews are usually quick to close once someone has listed them.
If payment diversion is the worry, test the process first: who can change bank details and what checks apply. A phishing or vishing exercise under written authorisation then shows how staff respond to a convincing request, reported in aggregate so it improves the process instead of blaming individuals.
We pick the checks that apply to your systems and the frameworks you answer to. A 45-minute scoping call ends with a fixed quote and a proposed start date; the written scope follows by email.