For US mid-firm managing partners, COOs, and firm administrators. After Silent Ransom Group extorted the BigLaw class for $46M+ in 2026, the question a client’s general counsel or a cyber-insurance underwriter will ask is the same one bar counsel would ask after an incident: what did your firm have in place.
New field note · BigLaw’s $46M year, in detail →
§ I. The Docket
Law-firm cyber moved from an IT problem into a client-facing procurement question. The FBI issued its second Private Industry Notification on the Silent Ransom Group tactic in May 2026, and every bar counsel and cyber-insurance underwriter now uses it as the yardstick: what did the firm have in place after the profession was warned.
In 2026 the group extorted WilmerHale for roughly $18M, Goodwin Procter for $10M, and Weil Gotshal for up to $20M. Some victims never saw a network attack — the operators walked into offices in person, posing as IT contractors. This is the actual, current tactic your peers are answering for.
Bar counsel and cyber-insurance underwriters use the FBI’s second Private Industry Notification as the reference standard. After a warning-of-record from federal law enforcement, “we didn’t see it coming” is not the same defense it was a year ago.
Law.com’s May 2026 mid-market coverage explicitly names mid-firms as the growth segment for these incidents. BigLaw is spending its way into stronger controls, so the pressure is migrating downward. Carriers are already asking mid-firm renewals for the physical-security-at-reception controls the SRG campaign made table-stakes.
The 2026 outside-counsel-guidelines addenda from F500 clients already include the SRG-specific controls. Every quarter that passes without a documented answer is a quarter a client’s procurement team can point to. The next SIG on your desk is measured against every row of the timeline.
Known ransoms paid by BigLaw victims of Silent Ransom Group in 2026.
The Insurer · Aardwolf Security · Aug 2026
Ransomware incidents against US law firms tracked between 2025 and early 2026.
Halcyon ransomware tracking, 2026
Average cost of a 2026 law-firm breach, up 10% year over year.
Halcyon · IBM Cost of a Data Breach 2026
FBI Private Industry Notifications on Silent Ransom Group tactics: vishing (May 2025) and physical intrusion (May 2026).
FBI IC3 · 2025, 2026
§ II. The Complete Response Packet
When bar counsel opens an inquiry, when a cyber-insurance underwriter requests a retrospective at renewal, when an F500 client’s outside-counsel oversight team asks for the security posture, the firm has one packet to hand over.
This is what running the program lets a firm produce, in hours instead of weeks.
§ III. What the firm keeps. What it gets back.
A policy set and a live vendor register sound tactical. What they actually buy the firm is strategic — every one of these shows up in a client SIG response, a carrier renewal, a bar-counsel inquiry, or a monthly partner meeting that used to run twenty-five minutes and now runs fifteen.
Outside-counsel-guidelines cyber addenda are increasingly retainer-conditional. If the firm can't answer the 30-question SIG in ten business days with sourced, dated evidence, the retainer moves to a firm that can. Every SIG the platform answers is a retainer defended.
After Silent Ransom Group paid $46M+ across BigLaw in 2026, cyber-insurance carriers (CNA, Brit, Beazley, Chubb) are repricing mid-firm renewals against the same controls set. Firms that walk in with a FAIR-quantified posture packet and a tabletop artifact don't get quoted at 2x. Flat premium is the outcome you're paying to preserve.
Every hour the platform pulls evidence, drafts SIG responses, and keeps the vendor register current is an hour a partner isn't. Fifteen hours a week returned to matter work, client meetings, and the judgment calls that only a partner can make.
If an inquiry lands, the Response Packet assembles from the live program in under four hours. Reconstruction from email threads under a 24-hour clock is not a defense a bar counsel accepts; a dated packet is.
Peer-firm incidents make the ABA Journal and Law360 the week they happen. The story a reporter can write about your firm is shaped by what your program can produce that afternoon. The difference between "documented same-day response" and "the firm is investigating" is the difference between a story that ends and one that runs for six months.
Halcyon and Law.com publish quarterly mid-firm posture benchmarks. The managing-partner dashboard surfaces the firm's position against peers of the same head count and practice mix, so partner-meeting decisions come with a reference point instead of a guess.
§ IV. Contents of the Program
Every deliverable is exportable in the format a client SIG asks for, a cyber-insurance underwriter scores, or a bar counsel would request in an inquiry.
§ V. The program’s cadence
The InfoSec program is a running operation, not a lawyer’s side project. Most of it happens without pulling anyone off matter work. The rest lands in the right role’s queue at the right frequency — MSP or IT support, firm administrator, managing partner. Nobody has to build anything from scratch on a Tuesday.
§ VI. Terms of Engagement
Pricing lives on the pricing page. What follows is the one-time stand-up sequence: five phases across eight weeks, then § VI’s cadence carries the program forward.
§ VII. Counsel of Record
Client outside-counsel-guidelines cyber-addendum negotiation. Malpractice-carrier questionnaire response prep. Bar-counsel inquiry response readiness with a dated artifact chain. Tabletop facilitation with your actual partners in the room. MSP oversight and outside-professional agreement redlines. Ultra tier includes 4 hours per month of vCISO consulting; the Fractional CISO SKU adds a dedicated 8-hour-per-week engagement.
§ VIII. How your firm’s data stays yours
A firm choosing an InfoSec platform is choosing a subprocessor for privileged material. The four things below are how we hold that responsibility.
Each firm is its own organization boundary. SIG responses, Formal Op 483 workflows, tabletop scenarios, and every matter reference the platform captures stay scoped to your firm. No cross-tenant access. Single-tenant isolation available on Enterprise.
Multi-factor authentication required. Role-based access within your firm. End-to-end encryption at rest and in transit. No vCISO Lite staff access to matter content without written authorization from the firm.
Every action your program takes — policy adopted, register updated, tabletop closed, SIG returned — lands on a hash-linked audit chain your own auditor can verify independently. Chain integrity holds without depending on any other vCISO Lite system.
When your firm signs up, vCISO Lite goes on your own vendor register with a written agreement, a disclosure clock, and a data-subject-request path. A governed row in your program, held to the same terms as any other subprocessor.
Full documentation, security questionnaire, and current attestations · Data Protection →
§ IX. Is this you?
Managing partners and firm administrators don’t three-way shop compliance vendors. Either the firm is carrying enough client-facing pressure that the compliance program is straining what can be run manually, or it’s about to be.
Bar counsel opened a compliance inquiry after a client complaint about handling of privileged material.
An F500 client just sent a security addendum to your outside-counsel guidelines with 30+ questions.
Your cyber-insurance renewal came back at 2x with a physical-security-at-reception ask.
Your MSP is requesting root access to workstations and no one is capturing what they will and won't touch.
A peer firm was named in the 2026 Silent Ransom Group extortion list published by The Insurer.
You share a co-counsel arrangement with a firm that just had a breach.
If the firm is BigLaw with an in-house InfoSec team, a dedicated CISO, and a live IR retainer already on file, an enterprise-GRC platform plus internal staffing is the right shape. If the firm is a solo carrying baseline coverage and no client-facing security asks, the standard requirements from insurance and bar-association guidance are usually enough. The 10-to-200-attorney mid-firm segment sitting between those two, with real client-matter exposure and no full-time CISO, is us.
§ X. Frequently-Raised Questions
The complaint arrives. Bar counsel requests the InfoSec policy in effect on the date of the incident, evidence that the policy was operating, the vendor register, the client-by-client notification actions taken, the tabletop drill records, and the technology-competence education documented for the workforce. Counsel does not want a marketing deck; counsel wants the artifacts, dated, findable. If the firm ran vCISO Lite the day of the incident, those artifacts are already in the platform. If not, the firm reconstructs from email threads and shared drives, under a clock, and hopes what is produced meets the reasonable-efforts bar.
The IT consultant or MSP runs the technology. vCISO Lite runs the compliance program on top of the technology, so a bar counsel or a cyber-insurance underwriter can look at what the firm had in place before an incident and see a written policy, control-by-control evidence, a vendor register (with the MSP itself as a governed row), and a tabletop artifact. The two roles are complements, not substitutes. Firms that skip the compliance-program layer keep paying for IT and still cannot answer the SIG a client sends them or the questionnaire the carrier sends them at renewal.
10 to 200 attorneys is the sweet spot. Mid-firms with real client-matter exposure and no full-time CISO. Solos and very small firms often get by on baseline requirements from their existing insurance and bar-association guidance. BigLaw has internal teams and specific tooling. The mid-firm segment is the one Law.com and Halcyon both name as the growth segment for cyber incidents in 2026, and the segment where the fractional-CISO plus platform structure most cleanly maps to what client SIGs are asking for.
Eight weeks to a fully populated program. Week one is intake with a real vCISO — not a chatbot, not a partner-referral network — walking through what the firm already has and what the platform will produce. Firms arriving mid-crisis (a client SIG in hand or a carrier renewal quoted at 2x) get the artifacts unblocking the immediate deadline first, then the rest on the timeline.
The next SIG on Tuesday. The next cyber-insurance renewal in Q4. The next tabletop before year-end. All from one program, all defensible on the day someone asks.