Law firms hold exactly what criminals want: confidential client information and money moving through trust and operating accounts. NexGenGuard is a family-owned San Antonio IT company that already supports local law offices. We help small and mid-sized firms protect client confidences, stop wire fraud and keep the practice running.
Why attackers go after law firms
- Wire and payment fraud. A criminal gets into an email account, or fakes one, and sends "updated" payment instructions for a settlement, retainer or closing. The FBI's 2025 Internet Crime Report counted 24,768 business email compromise complaints with about $3 billion in reported losses.
- Confidential files. Client files, medical records in injury cases, financial records and Social Security numbers are valuable to thieves and painful to lose.
- Small teams, busy schedules. Most firms don't have IT staff watching the network. Attackers count on that.
- Your website. We recently found a local professional office whose website was quietly showing visitors a fake "Verify you are human" prompt that installs malware. Read what we found.
What Texas lawyers are expected to do
You don't need to be a technology expert, but the rules expect reasonable care. In plain English:
- Technology competence. In February 2019 the Supreme Court of Texas amended the comment to Rule 1.01 of the Texas Disciplinary Rules of Professional Conduct. Lawyers should stay competent in the practice of law, "including the benefits and risks associated with relevant technology."
- Email and encryption. Texas Ethics Opinion 648 (2015) says lawyers may generally use email, but should consider encryption or another method in some situations. Examples include highly sensitive information, a shared email account, someone else knowing the client's password, or email read on a public or unsecured computer or network.
- Before and after a breach. ABA Formal Opinion 483 (2018) says lawyers should make reasonable efforts to monitor their technology and vendors. If a breach happens, they should act promptly to stop it, investigate what was affected and tell current clients when material confidential information is involved. It recommends a written incident response plan.
- Texas breach notice. If sensitive personal information is exposed, Texas law requires notifying affected people within 60 days, and the Texas Attorney General within 30 days when 250 or more Texans are affected. See the details.
Sources: Supreme Court of Texas, Misc. Docket No. 19-9016 (Rule 1.01, comment 8) · Texas Professional Ethics Committee, Opinion 648 · ABA Formal Opinion 483 · Texas AG: Data Breach Reporting · FBI Internet Crime Complaint Center (IC3)
How we protect law firms
- Locked-down Microsoft 365. Multi-factor authentication on every account, mailbox auditing and alerts for suspicious sign-ins and mail forwarding rules, which are common signs of a takeover.
- Email protection and secure sending. Filtering for phishing and spoofed senders, plus encrypted email options for sensitive client communications.
- Wire fraud safeguards. Staff training to spot fake payment requests, and help setting a simple rule: always confirm payment changes by phone, using a number you already have.
- 24/7 threat detection. SentinelOne managed detection and response with a 24/7 security operations center to catch and contain attacks, even after hours.
- Backups you can restore. Backups of computers, servers and Microsoft 365, so a deleted folder or ransomware doesn't take down the practice.
- Laptops and phones. Encryption, updates and remote wipe for devices that leave the office, go to court or work from home.
- Training your team. Security awareness training and phishing tests for attorneys and staff.
- Plans and paperwork. Help writing an incident response plan and answering cyber insurance security questions.
- Vendor coordination. We work with your practice management, document management and phone vendors so you don't have to.
Local, and easy to reach
We're a family-owned team based in San Antonio, serving firms across the city and nearby communities. You talk to the people doing the work, not a call center. Most requests are handled remotely, Monday through Friday from 8 AM to 5 PM, with on-site visits when needed and 24/7 support for clients who opt in.
Common questions
Do you work with solo attorneys and small firms?
Yes. Most of the firms we help are small, owner-run practices. We size the service to your team and budget.
Can you help us avoid wire fraud on settlements and closings?
Yes. We secure your email accounts so they are harder to take over, add alerts for suspicious activity, and train your staff to confirm any change in payment instructions by phone using a number already on file.
Do we have to encrypt every email?
Not necessarily. Texas Ethics Opinion 648 says lawyers may generally use email but should consider encryption or another method for highly sensitive information and certain situations. We can set up an easy way to send encrypted email when you need it. This is not legal advice; confirm with your own ethics counsel.
Can you help with our cyber insurance application?
Yes. We help you understand the security questions, put the required controls in place, such as multi-factor authentication and backups, and document what you have.
Last reviewed: November 2026. Rules and guidance change; always confirm with the official source.
Important information. This page is general information, not legal advice. Which rules apply to your practice, and what they require, depends on your situation; confirm with your attorney or compliance advisor. No security service can guarantee a business will never experience a cyberattack or security incident.