Still have questions?
Speak to our team
What the best-run law firms do differently with IT and cyber security
Author: Bruce Penson | Managing Director
“Are we doing this right?” It’s the question I hear most from partners and practice managers at law firms. Usually it comes after a near miss, a tricky insurance renewal, or a colleague asking whether they’re allowed to use ChatGPT on a client matter.
It’s a fair question, and a hard one to answer from the inside. In most firms of 10 to 100 people, there’s no IT director. IT sits with a partner or practice manager on top of the day job, and the firm relies on its provider to say whether it’s secure. But who checks the provider? And how do you know what “good” looks like for a firm your size?
That’s why we wrote IT, cyber security and AI in SME law firms 2026. It combines results from our IT Maturity Scorecard with what we heard in those conversations, and sets both against guidance from the NCSC, the SRA and the Law Society.
Why it matters now
Law firms have always been a target, because they hold client money and confidential data and work to tight deadlines. What’s changed is how much is expected of them. Insurers are asking harder questions at renewal. The SRA expects firms to report incidents promptly. And AI is arriving in inboxes and case management systems faster than most firms can write rules for it.
Through all of it, one thing stays the same: accountability sits with the partners, not the IT supplier.
What the report answers
We combined our IT Maturity Scorecard results with more than a thousand conversations with legal-sector leaders, and set what we found against guidance from the NCSC, the SRA and the Law Society. The report is built around the questions partners actually ask us:
- How does our firm compare with others our size?
- Where are firms like ours most exposed?
- What would happen in the first 72 hours of an attack, and who would make the calls?
- What should we be asking about AI before staff get ahead of us?
- What are the best-run firms doing that we aren’t?
That last one surprised even us. One habit separated the top-scoring firms from the rest, and it had nothing to do with spending more.
Who it’s for
The report is written for partners, practice managers and operations leads at law firms of 10 to 100 people. It’s practical rather than technical, covering how firms compare across seven areas of IT maturity, the attacks law firms face most and the first 72 hours of an incident. It ends with ten actions you can take straight to your next partners’ meeting.
Download the free report: IT, cyber security and AI in SME law firms 2026
Want to know how your own firm measures up?
Our free IT benchmarking assessment takes just five minutes, and you’ll get your personalised results instantly.