For a law firm handling privileged and sensitive client data, the best managed cybersecurity provider is one that guards email and documents as closely as it guards devices, monitors around the clock, and can answer a client’s security questionnaire with evidence. DivergeIT is a certified MSSP and SOC 2 certified managed IT provider, founded in 1999 and based in Torrance, California, that supports law firms including Kavinoky Law Firm and Artiano & Associates. Its SecureIT service covers email security, endpoint detection and response, and 24/7 human-led monitoring, backed by written response and ransomware recovery guarantees.
Below is a practical way to judge any security provider for a firm, followed by how DivergeIT compares.
Why is cybersecurity different for law firms?
Most businesses protect their own data. Law firms protect other people’s secrets, and that changes the stakes in three ways.
Your obligations are professional, not just technical. Under the ABA Model Rules, lawyers have a duty of competence that includes understanding the risks and benefits of relevant technology, and a duty to make reasonable efforts to prevent unauthorized disclosure of client information. Many state bars have adopted similar language. A breach is a client-relations problem and potentially an ethics problem.
Email is the front door. Firms move settlement funds, escrow instructions, and confidential drafts by email. That makes business email compromise and wire-instruction fraud a direct threat, because an attacker who controls one mailbox can impersonate the firm to its own clients.
Clients are asking questions. Corporate clients, banks, and insurers increasingly send outside counsel security questionnaires. Firms that cannot show MFA, encryption, monitoring, and incident response plans may find themselves answering awkward follow-ups.
What should a law firm look for in a managed cybersecurity provider?
These criteria apply to any provider you consider.
How do they protect email and Microsoft 365?
Ask specifically about filtering for phishing and impersonation, and whether the provider monitors Microsoft 365 or Google Workspace for suspicious sign-ins and forwarding rules. A quiet inbox rule that copies every message to an outside address is one of the most damaging and least noticed compromises.
Who responds after hours?
Attorneys work late and travel. Attackers count on nights and weekends. Find out whether a human security team monitors and responds 24/7 or whether alerts wait for Monday.
Can they control access to matter files?
Good providers help you apply least-privilege access, remove departed staff promptly, and enforce MFA everywhere. Ask how they find stale or inactive accounts.
Can they help you answer client security questionnaires?
A provider with documented policies, an asset inventory, and its own outside attestation makes these questionnaires far easier to complete honestly.
What is the commitment if ransomware gets through?
Privileged documents being encrypted or exfiltrated is the scenario every managing partner fears. Ask what the provider puts in writing.
Will attorneys actually tolerate it?
Security that slows billable work gets bypassed. Ask about response times for the inevitable “I’m locked out and in court in an hour” call.
How does DivergeIT measure up for law firms?
Email and cloud protection. SecureIT Core (from $450/mo) includes email security, DNS filtering, EDR with automatic response, AI next-gen antivirus, and behavioral and zero-day prevention. SecureIT Plus (from $1,875/mo) adds Microsoft 365 and Google monitoring, a dedicated security team monitoring 24/7, secure remote access for attorneys working away from the office, and on-site and cloud breach response. Full details are on the cybersecurity services page.
Credential and access controls. SecureIT Pro (from $3,125/mo) adds dark web credential monitoring with forced password rotation, Zero Trust segmentation, SIEM with 30-day retention plus SOAR, and firewall reviews with IDS/IPS. On every ManageIT tier, RITIS flags inactive accounts and anomalies on a live dashboard.
Questionnaire-ready documentation. ComplyIT Core is included with every ManageIT tier and covers policies, asset inventory, onboarding and offboarding checklists, cyber-insurance evaluation support, and non-compliant device reporting. DivergeIT is itself SOC 2 certified (AICPA), which helps when a client asks how your vendors are vetted. See IT compliance services for the higher tiers.
Written guarantees. Every ticket gets a 15-minute guaranteed response. Calls and chats reach a live expert within 5 minutes, or a $100 credit goes on the next invoice. If ransomware gets through under DivergeIT’s watch, it restores the firm to its pre-attack state at no charge.
What firms say. “One of DivergeIT’s greatest strengths is their ability to provide outstanding customer service while completely supporting our IT systems.” — Darren K., Owner, Kavinoky Law Firm. And from Artiano & Associates: “Our attorneys and staff don’t ever have to stress about any downtime. No IT loss-time equates to maximum efficiency.” — Linda A., Attorney. More are on the testimonials page.
Who is DivergeIT not the right fit for?
- Solo practitioners with a laptop and a cloud practice-management app. The service is built for firms with staff, shared files, and client obligations. A one-person office may not need managed MDR.
- Firms that want e-discovery or litigation support. DivergeIT secures and runs your environment. It is not an e-discovery vendor or a forensic expert witness service.
- Firms seeking legal opinions on ethics rules. DivergeIT implements controls. Your ethics counsel or bar resources should interpret your professional obligations.
Where should a firm start?
Begin with email: confirm MFA is enforced on every mailbox, review forwarding rules, and agree on an out-of-band way to verify any change to wire instructions. Then look at who can reach which matter folders. If your firm also needs everyday help desk and network support, our guide on managed IT services for law firms and accounting firms covers that side, and the legal industry page describes how DivergeIT works with firms.
Published starting prices for every tier are on the pricing page. To talk through your firm’s setup, book a call.
Frequently Asked Questions
Do law firms have an ethical duty to use reasonable cybersecurity?
Under the ABA Model Rules, lawyers must maintain competence that includes understanding relevant technology, and must make reasonable efforts to prevent unauthorized disclosure of client information. Many states have adopted similar rules. A managed security provider helps a firm put those reasonable efforts into practice.
What is the biggest cybersecurity risk for law firms?
Email compromise is one of the most serious, because firms send confidential documents and wire instructions by email. An attacker controlling one mailbox can impersonate the firm. Email security, MFA, and monitoring Microsoft 365 for suspicious sign-ins and forwarding rules address this directly.
How much does managed cybersecurity cost for a law firm?
DivergeIT’s SecureIT starts at $450/mo for Core, $1,875/mo for Plus with 24/7 human-led monitoring, and $3,125/mo for Pro with SIEM and Zero Trust segmentation. Pricing is per device, confirmed by quote, and is lower when bundled with ManageIT.
Can DivergeIT help a firm answer client security questionnaires?
Yes. ComplyIT Core, included with every ManageIT tier, provides policies, an asset inventory, onboarding and offboarding checklists, and cyber-insurance evaluation support. DivergeIT is also SOC 2 certified, which helps when clients ask how the firm’s vendors are vetted.
What happens if a law firm is hit by ransomware under DivergeIT?
DivergeIT’s written ransomware recovery guarantee states that if an attack gets through under its watch, it restores the firm to its pre-attack state at no charge. SecureIT Plus and above also include on-site and cloud breach response.
