With fears spreading as each highly publicized corporate data breach commands more attention and woes in the executive suite, law firms have more opportunities these days to point corporate clients in the direction of particular cybersecurity vendors or even offer up their own skilled cybersecurity professionals.

Such cross-selling opportunities are not lost on cybersecurity vendors, at least a few of which have established programs to “partner” with law firms. Under those programs, law firms and vendors set up scenarios where they cross-sell to corporate clients in an effort to boost their respective revenues.

Milpitas, California-based FireEye Inc., along with its sister company Mandiant, which it acquired in 2014, offers cybersecurity operations and data-breach incident response services. In the past few years, FireEye has set up formal partnerships with more than five law firms, and informal partnerships with almost 20 firms, said Karen Kukoda, the company's senior director of strategic alliances. FireEye has since signed up five Am Law 100 partners: Baker & Hostetler; Holland & Knight; Pillsbury Winthrop Shaw Pittman; Ropes & Gray; and Weil, Gotshal & Manges.

No quid quo pro dictates permeate such partner relationships, Kukoda said. But FireEye, which went public in 2013, and its law firms often negotiate three-way master service agreements with clients. Since it started the partner program and as a direct result of it, FireEye has boosted its annual revenue by double-digit millions, Kukoda said. The company's revenue grew to $751.1 million in 2017, a 5 percent increase from the previous year.

FireEye and its partner firms offer clients and potential clients joint informational sessions and thought leadership events, Kukoda said. FireEye and firm partnerships allow each side to better understand the business of the other and thus more efficiently serve client needs, she said. After a breach, most clients first contact their insurance provider, who are ultimately expected to help pay for resolutions. So it helps that some of FireEye's partner firms serve on insurance cybersecurity advisory panels.

As a trio, the insurance provider, FireEye and its partner firms put a “holistic strategy in place to help a client with a data-breach incident,” Kukoda said.

But some lawyers, such as a Baker & Hostetler partner who participates in the firm's FireEye partnership, advise caution about any excess emphasis on cross-selling clients.

“There is a lot of potential for conflicts of interest,” said Baker & Hostetler partner Laura Jehl, co-leader of the firm's General Data Protection Regulation (GDPR), blockchain technologies and digital currencies initiatives.

Before joining the firm last summer, Jehl learned about cybersecurity from the in-house perspective when she served as general counsel and chief privacy and security officer at Resolution Health Inc., a subsidiary of health benefits giant Anthem Inc., which in 2015 acknowledged a massive cyberattack affecting 80 million customer records. (Anthem, advised by Hogan Lovells, agreed to a $115 million data breach settlement last year.)

Cross-selling has “potential pitfalls,” said Jehl, even though she recognizes that cybersecurity these days “is an area that has tremendous growth opportunity.” Bottom line, she warns: “Everyone has to be really careful.”

It's not that cybersecurity lawyers insist on distant ties to vendors. As a rule, most lawyers cannot deploy or even understand with any depth the forensic tools available and developed by such companies, many of whom make proprietary claims about those tools, Jehl said.

“You absolutely have to trust the vendors,” she added. “This is a necessarily close relationship.”

Jehl said that Baker & Hostetler remains a FireEye partner, but not an exclusive partner. She estimated that for about 50 percent of its recommendations, the firm sends clients to other cybersecurity vendors.

“We love FireEye, but we look at the size and scope of what the client needs,” Jehl said.

She knows of other law firms that have pursued exclusive relationships with cybersecurity vendors, or even hired their own professionals in-house, but she admits to being concerned about those trends.

“It's not the best idea,” said Jehl, noting that she instead prefers for clients to research and select their own cybersecurity firms if they have the resources.

Pillsbury partner Brian Finch, who joined the firm in 2014 and now serves as co-leader of its cybersecurity, data protection and privacy practice from Washington, D.C., said his firm both serves as counsel and partner to FireEye.

“We refer clients to FireEye and FireEye refers clients to us,” Finch said. “I'm not going to put words in FireEye's mouth, but they know this is a law firm that understands cybersecurity issues.”

David Lisi, a litigation partner at Pillsbury in Silicon Valley, who joined the conversation with Finch, noted that his firm is “not exclusively referring clients to FireEye.”

Finch agreed, noting that Pillsbury is “very careful” and strives “to act as honest brokers.” But Finch also said he was “comfortable as going on the record saying that FireEye is one of the best in the world.” Not every client, however, “can drive a Ferrari,” said Finch, noting that as a result, Pillsbury will send some cybersecurity matters to other vendors.

Will Pillsbury and FireEye's revenues continue to grow even if they each stop referring clients to one another? Finch is not worried about that at all.

“Anyone who is a legitimate authority on cybersecurity is seeing growth in their practice,” he said.