Cybersecurity

Corporate clients who want to ensure their law firms are properly handling and securing their data aren't just having stern conversations with their attorneys—they're sending audits. Increasingly, firms are being asked to complete a variety of slightly different cybersecurity audits for clients in highly regulated industries, putting new and uncomfortable strains on routinely overstretched law firm IT staff.

In a bid to ease this burden, risk management technology company Privva launched AutoAssess, a new tool that uses machine learning to help law firm IT staff streamline and automate variations in client security assessment requests.

“Our clients were telling us these on average would take four to five hours to fill out,” explained Ishan Girdhar, CEO of Privva. “Most of the clients that are asking for security assessments of their law firms are asking specific themes or concepts, but just using different verbiage and terminology.”

Here's a look at the new tool:

Who it serves: At this point, most of these data security audits are coming to firms who work with corporate clients in highly regulated industries. Larger law firms, Girdhar said, are getting up to 50 to 100 different audits per year in this space, making compliance fairly tedious to do manually.

Because of the number of audits big law firms get, they are a prime market for AutoAssess, both as clients and as data sources that AutoAssess' AI can use to train its algorithms. Beyond big law, Girdhar said that the tool is also seeing some application for smaller and mid-sized firms, because of the expansion of data security audits across other types of industries.

How it works: AutoAssess essentially uses AI to highlight slight variations in data security audits. The tool uses previous client audit reports, most of which come through Excel, to get a sense of what information the audit is asking for and see if it can be drawn from work that law firm IT staff have already prepped. Privva then prepares the audit report from that work and returns it to firm staff to approve.

“Using a word similarity vector we can build a product that can read a question, map it back to historical questions, and relate it back to architecture,” Girdhar explained.

Looking, and thinking, ahead: If your firm is handling corporate cybersecurity audits fairly well thus far, Girdhar suggests you may want to look ahead to compliance needs you may have down the line.

“I see a lot of firms who say, 'I only have five of these [audits] from my clients today so I'm OK.' Next year when you have 15, call me, but I probably can't on-board you right away,” he said, adding that AutoAssess's AI can't exactly be trained overnight. “It's better to do it early. It's a time saver. We're preparing you for what you're about to embark on in 2018.”

Girdhar is not the only person to predict that these audits are likely to spike in coming years. “This is not going away,” John Sweeney, president of law firm technology services group LogicForce, previously told LTN. The group's recent “Law Firm Cybersecurity Scorecard” report found that 34 percent of firms had received at least one data security audit in 2016, and predicts that 65 percent of firms will receive similar scrutiny by 2018.