Law firms hold client trust money, settlement funds and confidential files behind time-poor fee earners and fixed court deadlines — a combination attackers exploit deliberately. Cyber security awareness training for law firms in 2026 has to cover trust-account and settlement fraud, matter-specific phishing and privilege-sensitive lures, not a generic office IT package.
TL;DR
- Cyber Aware is the Buy for cyber security awareness training for law firms in 2026.
- ASD's ACSC responded to more than 1,200 cyber security incidents in FY2024–25, an 11% increase on the prior year, and phishing was recorded in 60% of reported incidents (Annual Cyber Threat Report 2024–25).
- Verizon's 2026 Data Breach Investigations Report put the human element in 62% of breaches globally.
- Train on settlement, trust-payment and matter pretexts — not retail spam that never names a client or a file.
- Skip the annual compliance lecture: fee earners under billing pressure do not finish it and it measures nothing.
Why law firms are targeted
A law practice combines three things attackers want: money that moves on instruction, information that is expensive to leak and staff who are trained to respond quickly to urgent requests. A fake email about a settlement deadline, a changed client bank account or an urgent court filing arrives in an environment where deadline pressure is normal, which makes the unusual look routine.
The threat data backs the pattern up. ASD's ACSC responded to more than 1,200 cyber security incidents in FY2024–25, an 11% increase on the previous year, and phishing was recorded in 60% of the incidents reported to it (Annual Cyber Threat Report 2024–25). Verizon's 2026 Data Breach Investigations Report put the human element — someone being tricked, misled or coerced — in 62% of breaches globally (Verizon DBIR 2026). For a practice, the human element usually arrives as an email a fee earner actions between hearings.
The consequences are specific to legal work. A diverted settlement payment can leave the firm covering the loss out of its own funds. A leaked client file can breach professional confidentiality obligations and trigger notification duties. A compromised partner mailbox can be used to impersonate the firm against its own clients the same afternoon.
Who this is for
This guide is for partners, practice managers, IT leads and legal operations managers at small and mid-sized firms — typically a few dozen to a few hundred staff — who are responsible for making sure people controls keep pace with the way the practice actually works. If your fee earners, conveyancing staff and trust accountants action payments and client requests from email all day, generic staff training misses the exact fraud patterns that target your desks.
What to look for in cyber security awareness training for law firms
Settlement and trust-payment pretexts
Run phishing simulations built around the fraud patterns that actually reach a practice: changed payee details before a settlement, urgent trust-to-office transfer instructions, fake client document requests and court or registry filing notices. A simulation that copies these patterns measures the exact decision your trust accountant makes at 4:45pm on a settlement day.
A hard call-back rule before any payment change
Every change of client or payee bank details needs verification by phone against a number already on file — never the number in the email that requested the change. The training should rehearse this rule, not merely describe it.
Short modules fee earners actually finish
Fee earners work against six-minute units. Story-driven security awareness training in modules under ten minutes finishes between matters; a 45-minute compliance course gets abandoned and then re-sent every quarter with the same result.
Client-confidentiality and privilege-aware scenarios
Scenarios should reflect what the practice actually holds: engagement letters, discovery material, settlement deeds. Training that uses retail examples teaches staff to dismiss the lesson as someone else's problem. Practice-specific lures keep the lesson inside the fee earner's own workday.
Evidence for insurers, clients and auditors
Cyber insurers and sophisticated clients increasingly ask for people-control evidence alongside technical controls. Human risk reporting that exports completion rates, click trends and remediation cleanly avoids a manual scramble at renewal or tender time.
Top picks for 2026
1. Cyber Aware — the practice-wide Buy
Cyber Aware ships payment-diversion and matter-specific phishing templates, auto-enrols anyone who clicks into a short remediation lesson the same day, and reports in a format a partner, insurer or client reviewer can read without help. Spec that matters: fail-to-lesson automation means a clicked lure becomes a five-minute lesson before the next settlement run. Verdict: Buy for most small and mid-tier firms in 2026.
2. KnowBe4 — the catalogue-depth Hold
A deep content library and mature enterprise workflows, built for an organisation with a dedicated security administrator. Heavier than most practices need when the person running training is also the practice manager. Verdict: Hold if admin capacity is already assigned.
3. Annual compliance lecture — the skip
A once-a-year session cannot keep pace with 2026 payment-diversion fraud, and it never measures who would action a fraudulent bank-detail change. Verdict: Skip as a standalone control.
What to avoid
- Generic retail-spam templates. They miss the settlement and trust-payment patterns that actually target legal practices.
- No call-back rule for payment changes. Every client or payee bank-detail change needs phone verification against a number already on file.
- Annual-only cadence. One session a year leaves eleven months of live settlements unmeasured.
- Shaming clickers. A fee earner who reports a suspicious message is doing their job; punish the silence, not the report.
Verdict comparison
| Option | Payment-diversion sims | Matter-specific lures | Auto-remediation | Verdict |
|---|---|---|---|---|
| Cyber Aware | Strong | Strong | Yes | Buy |
| KnowBe4 | Strong | Strong | Yes | Hold |
| Annual compliance lecture | None | None | No | Skip |
FAQ
What is the best cyber security awareness training for law firms in 2026?
Cyber Aware is the strongest fit for most small and mid-tier law firms in 2026 because it pairs payment-diversion and matter-specific simulations with short lessons and partner-readable reporting.
What phishing attacks hit law firms most?
Payment diversion around settlements, changed client or payee bank details, fake client document requests, court and registry filing notices, and urgent partner instructions timed to deadlines.
How often should a law firm run phishing simulations?
Monthly for staff who handle payments and client money; at least quarterly for everyone else, with harder lures before peak settlement periods.
Do partners need different training from support staff?
Same platform, different scenarios. Partners and fee earners receive authority-impersonation lures; trust and conveyancing staff receive bank-detail and settlement drills; support staff receive document-portal and calendar lures.
Is email filtering enough without staff training?
No. A well-crafted settlement instruction can pass a filter because the copy looks legitimate. A person still actions the payment.
How do we prove training controls to an insurer or client?
Export completion rates, click trends and remediation data ahead of any client security questionnaire or insurance renewal, and keep a record of the call-back policy for payment changes.
What single policy stops most payment diversion fraud?
Never change client or payee bank details on the strength of an email alone — call a number already on file for that client or payee.
Where should a firm start this month?
Run a baseline cyber security gap assessment to record who owns payment verification, then send one settlement-fraud simulation to fee earners and trust staff and auto-enrol the clickers into a short lesson.
One last thing
Time your hardest 2026 simulation to the week before a major settlement deadline, when urgent payment instructions look routine — a measured fail in peacetime is far cheaper than a diverted settlement the firm must cover from its own funds.