2 Oct 2026 · SecurityWeek
US think tanks and universities
How they got in
Email made to look like it came from a trusted sender.
What we check
Whether anyone can send email that passes as your domain.
Law firms
An email in your firm's name can be forged. Clients wire money on it.
Retainer requests, trust-account transfers and closing-day wires all travel by email. We read what anyone can see about your law firm from outside, and tell you which opening to close first.
Attackers use AI to find openings. We use it to find yours first, and a person checks every finding before you see it.
Outside reads onlyReviewed by a person72 hours to your documents
Rules that apply to youCanada and the United States
State bar rules of professional conduct
Duty of confidentiality (ABA Model Rule 1.6(c) and state rules)
State breach notification laws
Notice to affected residents
FTC Act, Section 5
Unfair or deceptive security practices
Also in Canada
Law Society rules of professional conduct, PIPEDA
Your findings are mapped against these in the Rules and Insurance Briefing. A mapping, not a compliance certification.
Rules that apply to law firms
Three reporting deadlines law firms should know.
New York
30 days
NY SHIELD Act
Notify affected New York residents after discovering a breach of their private information.
US, lawyers
Promptly
ABA Formal Opinion 483
Tell current clients when a breach affects their information.
Canada, federal
As soon as feasible
PIPEDA
Report a breach that creates a real risk of significant harm to the Privacy Commissioner, and tell the people affected.
Your deadline
30 days
NY SHIELD Act
A summary of published rules, not legal advice. The Rules and Insurance Briefing names the rules that apply to your firm.
01 · This week in law firms · 3 Oct 2026
This week, in and around law firms: what attackers used, and what we check for it.
2 Oct 2026 · Global News
Kingston Police
How they got in
Stolen or reused passwords.
What we check
Staff addresses present in monitored breach databases.
2 Oct 2026 · BleepingComputer
Frontline Education
How they got in
A supplier or vendor that was compromised first.
What we check
The outside services your domain depends on.
02 · Featured research
Law firms · 4 min · Sep 2026
Seven in ten professional firms cannot stop an email sent in their name
What the public records of law and accounting firms say about forged email, read from outside.
03 · What you receive
The full outside watch on your firm, the proof for every finding, and the fix.
1
Owner Summary and Action Brief
Executive brief
2
Technical Evidence and Findings
For your IT provider
3
Rules and Insurance Briefing
Statutory mapping
4
Signed Assessment Record
Dated attestation
A 10-minute walkthroughWith the analyst who reviewed your assessment.
The first month of monitoringYour domain and staff addresses watched continuously (email settings, look-alikes and new host names hourly, the rest daily), with a same-day alert to a named contact if anything new appears.
We hand your IT provider the exact fix; for forged email we close it in one click. Your evidence pack: an owner summary, the technical evidence for your IT provider, a rules and insurance briefing, and a signed assessment record.
04 · Check my firm
See what is open before anyone else does.
We read your firm from outside and tell you first, with proof you can check. No access, nothing tested, no obligation.
What we readPublic sources only
Who sees itYou alone
Delivery72 hours from confirmation
Mutual NDAAvailable on request
Outside reading requestPrivate
Received
A person will read it and reply within one business day from [email protected].
What happens next
- We read your firm from outside.
- We tell you first, with proof you can check.
- If it is worth it, you order.
While you wait: the 72 hours · 40 seconds, no sound
What happens if you go ahead. More at getleaktrace.com/see-it-first/.
Read the transcript
- 72 hours. One domain. Nothing to install.
- What happens in the 72 hours of an External Cybersecurity Assessment.
- You confirm the scope: one domain, your firm's. Nothing to install, no access to give.
- We read what anyone can see from outside: mail records, look-alike domains, staff addresses in monitored breach databases, website software, sign-in pages. We log into nothing.
- A person checks every finding and approves the release. Each one comes with a check anyone can run.
- Three documents and a signed summary: the Owner Summary, the Technical Evidence for your IT provider, the Rules and Insurance Briefing, and the Signed Assessment Record.
- Your IT provider gets the exact fix for each finding; we re-check until it is closed. A 10-minute walkthrough, and the first month of monitoring, are included.
- Inside 72 hours of confirmation.