Vulnerability scanning that protects attorney-client privilege

Law firms concentrate exactly what attackers want behind a thin perimeter: privileged client communications, merger and litigation strategy, sealed settlements, IP filings, and trust-account banking details. The public-facing footprint is usually small but high-value and chronically under-maintained — a marketing site on WordPress, a client portal or extranet for document exchange, secure file-transfer endpoints, a webmail or Exchange/OWA login, a VPN or remote-desktop gateway, and a long tail of practice-area microsites and event subdomains spun up by vendors and never decommissioned.

The recurring exposure patterns are mundane and that is the problem. Document portals and DMS integrations get stood up on subdomains that outlive the engagement, leaving dangling DNS records ripe for subdomain takeover. Self-hosted file-transfer appliances (the MOVEit and Accellion class of product the legal sector has repeatedly been breached through) sit on the open internet with management interfaces and known CVEs. Backups, case exports, and discovery material land in misconfigured S3/GCS/Azure buckets. And small firms running their own mail are prime business-email-compromise targets when SPF, DKIM, and DMARC are missing or set to monitor-only — wire-transfer fraud against real-estate and trust accounts is one of the sector's most common and costly incidents.

Brand and lookalike risk is acute here because so much firm business runs over email and wire instructions. Typosquatted and homoglyph domains are registered to impersonate a firm to its clients and opposing counsel, then used for invoice and closing-funds fraud. External scanning maps this surface — every live host, port, certificate, exposed file, takeover-able subdomain, public bucket, and registered lookalike — but it is honest about its limits: it sees what the internet can reach, not the contents of your DMS, internal network, or the human-targeted phishing that often delivers the final blow.