Security · IT Support

Your People: The Biggest Risk — And the Best Defence

26 June 2026

Most cyber attacks do not break through systems.

They go through people. A convincing email, a rushed decision or a moment of distraction can give an attacker access that no firewall could prevent. For SME law firms, this risk is particularly acute. As firms rely on platforms like Clio to manage matters, documents and client communication, the impact of a successful attack increases.

This article relates to the User Awareness & Culture domain of the Technology Resilience Score. It looks at whether your firm's people are equipped to recognise and respond to threats.

Why human risk is critical for law firms

Law firms operate under pressure — deadlines, transactions and client expectations all demand speed. Attackers exploit that pressure. Phishing emails are often timed to coincide with live matters and appear to come from clients, counterparties or financial institutions. If successful, they can lead to:

exposure of confidential client data
unauthorised access to systems
financial fraud
reputational damage

In many cases, the attack succeeds because the user was not prepared to recognise it.

Where Clio fits into awareness and culture

Platforms like Clio centralise how law firms operate. They hold matter data, documents, communication and billing information. This makes them valuable — but also increases risk if access is compromised. Modern platforms also introduce AI features, which require responsible use.

Staff need to understand:

how to recognise threats
how to handle client data
when and how to use AI features
what behaviour is acceptable

As a Clio partner, Little Big Tech helps firms ensure that technology adoption is supported by strong awareness and clear behavioural expectations. The key question becomes: "Do our people know how to act when it matters?"

Is your firm's technology environment resilient?

If your firm relies on platforms like Clio, the question is not just whether they are in place — it is whether the surrounding environment is resilient.

Get your Technology Resilience Score

The problem with weak awareness

Many firms assume staff will "use common sense." In practice:

training may be limited or outdated
staff may not recognise modern phishing techniques
incidents may go unreported
mistakes may be hidden rather than escalated

This delays detection and increases impact.

What weak looks like in a law firm

Weak awareness and culture often appear as:

inconsistent or incomplete training
lack of phishing simulation
limited reporting of incidents
hesitation to admit mistakes
unclear expectations around acceptable use
reliance on individuals rather than structured processes

These issues increase risk across the firm.

What strong looks like

A well-prepared firm invests in its people. Staff receive regular training and understand how to recognise threats. Phishing simulations reinforce awareness and identify gaps. A no-blame reporting culture encourages fast escalation of incidents. This turns the workforce into an active defence.

How this TRS domain helps law firms improve

The User Awareness & Culture domain of the Technology Resilience Score helps firms assess how prepared their people are. It looks at whether:

training is effective and consistent
staff recognise threats
incidents are reported quickly
behaviour aligns with expectations

The result is a score out of 5. That score provides a clear baseline and a structured improvement path.

Why this matters for AI and modern working

As firms adopt AI features and modern platforms like Clio, the role of staff becomes more important. Users interact directly with tools that process sensitive information. Without clear understanding and boundaries, risk increases. Strong awareness and culture ensure that technology is used safely and consistently.

The Technology Resilience Score gives SME law firms a benchmark across 10 domains, including User Awareness & Culture. As a Clio partner, Little Big Tech helps firms build a culture that supports resilience and growth. Find out more about our approach at LBT Resilience.