A law firm can invest heavily in firewalls, endpoint protection, and compliance programs, then have an attacker approach an employee as “IT” and ask for a quick favor.
That is the front door problem. The systems may be well defended, but the trusted human layer can still be persuaded to open access. For law firms, RIAs, family offices, medical groups, and other sensitive-data businesses, the challenge is not simply keeping intruders out. It is making sure trust is verified before it becomes access.
Attackers exploit trusted access alongside technical vulnerabilities
The outdated lens treats cybersecurity as a technical perimeter problem. Modern strategy recognizes that identities, daily processes, and human decisions are part of the perimeter too.
In a CrowdStrike report released October 28, 2026, financially motivated adversaries accounted for 82% of observed malicious activity against the legal sector. The report described CHATTY SPIDER activity targeting legal entities growing 129% in the first eight months of 2026 compared with all of 2024. In one reported scenario, the group recruited individuals to impersonate IT staff and physically enter law firms to establish remote access.
In another intrusion described in the report, an attempted data exfiltration began four minutes after initial access. The window between someone opening the door and information being targeted can be short.
CrowdStrike also reported that Big Game Hunting adversaries named 455 legal entities on data-leak sites from September 2025 through August 2026, up 39% from the prior reporting period. A listing on a criminal-operated leak site is a claim, not independent confirmation that a breach occurred. Even with that qualification, the figures show how attackers use the prospect of exposure to pressure high-value organizations.
Treat identity and trust as security controls. A remote support request, a caller claiming to be IT, and a visitor requesting access to a workstation should all follow a defined verification process. Familiarity is not proof of identity.
A trusted voice can turn ordinary work into an access path
Employees are trained to question suspicious email. They may be less prepared to question a calm caller who knows their name, understands the systems they use, and says a problem needs immediate attention.
Fraudulent IT support calls can exploit the instinct to be helpful. An employee may be directed to install or authorize a remote monitoring and management (RMM) tool, share a screen, approve a login, or follow troubleshooting instructions. A tool used legitimately for support can become a route to control when an unverified person persuades someone to grant access.
The human element is not a flaw in your people. It is an access layer that has not yet been governed like one.
Give employees a verification protocol they can follow without hesitation. For unexpected IT contact, require a callback to a known number or a new request through the established service channel. Never allow a caller to set the verification method or number. Do not approve unsolicited remote access, install a tool at a caller’s direction, or share a password or authentication code.
Give employees clear permission to stop and verify, including when the caller sounds senior or says the request is urgent. Verification should be recognized as good judgment, not treated as a failure to cooperate.
For in-person support, confirm the visit with your known IT provider, register and escort visitors, and restrict access to workstations and network connections. A badge or familiar company name is not sufficient verification.
Access must match the job, and change when the job changes
An identity-first approach begins by asking who is requesting access, how that identity is verified, and whether the access is appropriate for the person’s role. It does not assume that a successful login, a familiar device, or a recognizable voice is sufficient on its own.
Broad permissions increase the potential consequences of a compromised account. A single identity should not automatically reach every client file, financial record, medical dataset, or administrative tool.
Apply least privilege consistently. Review access by role and remove permissions that are no longer needed. Limit administrative privileges. Require stronger verification for sensitive actions. Make sure support staff use an approved process before resetting credentials or changing authentication settings.
Use phishing-resistant MFA, such as FIDO2 security keys or appropriately configured passkeys, wherever supported. Independently verify requests to reset passwords or replace MFA methods. Restrict remote support to approved tools, and monitor their installation and use. These safeguards align with the joint government advisory on Scattered Spider, which documents similar impersonation and remote-tool abuse techniques; it is separate from the CHATTY SPIDER reporting above.
Offboarding is part of the same control. When a person leaves, access should be removed promptly across accounts, devices, remote tools, and shared systems. A delayed handoff can leave a former employee’s identity active after their job has ended.
Disabling an account is only part of offboarding. Revoke active sessions and tokens, remove access through remote-support tools and connected applications, and rotate shared credentials where the departing person knew them. Confirm completion with an accountable owner.
The same access controls matter for RIAs, family offices, and medical groups. Apply them in ways that protect sensitive information and preserve essential business and clinical operations.
The cost of access failure can extend well beyond one organization
A Tarter Krinsky & Drogin data-breach report offers a cautionary example of what sensitive-data exposure can involve. HIPAA Journal reported on October 23, 2026 that the Manhattan law firm identified suspicious activity on September 10, 2025. An investigation found unauthorized access to certain servers intermittently from July 9 through September 9, 2025. The report said the incident involved confidential and attorney-client privileged information, along with protected health information of 196,645 patients of the firm’s healthcare clients. After the affected-file review was recently completed, notification letters were being mailed.
The public report does not establish how the initial access occurred. It does not justify speculation about the firm’s security practices or response. It does underline the scope of potential impact when access to sensitive legal and healthcare information fails.
A law firm may hold its own client files and, through its work, sensitive information belonging to other organizations and individuals. That makes access governance a matter of client trust, professional responsibility, and operational risk.
Security culture works when the safe choice is the easy choice
An annual training video cannot prepare employees for every credible caller, urgent request, or unfamiliar support workflow. Training matters, but security has to live in the daily process.
If the official verification process is slow or confusing, employees may take a shortcut. If the safe option requires navigating a maze while the caller waits, the process creates pressure to comply. A well-designed culture makes verification the expected, practical path.
Build the rules into everyday work. Give employees one simple reporting route. Make callback details easy to find. Document what IT will and will not ask users to do. Practice the response to a suspicious support call. Review near misses and update procedures without blaming the person who raised a concern.
Leadership has a role here. When executives follow the same verification steps as everyone else, they reinforce that process protects the organization. When they ask staff to bypass it for convenience, they weaken the control.
Oversight connects identity controls to business resilience
Access governance works best alongside endpoint protection, monitoring, tested recovery plans, and clear incident-response ownership. Managed IT and security teams can help leaders put these controls into practice and review whether they work.
Review access as a business risk. Leaders should know who has privileged access, how unexpected support requests are verified, how quickly access is removed after a role change, and who is accountable for investigating unusual activity. These are practical management questions. They protect revenue, client confidence, and business growth.
At Oram Cybersecurity Advisors, we help organizations connect security and managed IT services to their operational and regulatory priorities. The aim is not to make people distrust every interaction. It is to establish a dependable process that lets them work confidently without relying on guesswork.
People who know how to pause, verify, and report suspicious requests are a security asset. Support them with verification, least privilege, timely offboarding, and a process that makes the safe action routine.
If you are reviewing how trust and access are handled across your organization, we welcome a practical conversation. Connect with Oram Cybersecurity Advisors for clarity on the controls that support your people and your business.
