Over the years, midsize and large firms have invested in cybersecurity at the behest of their clients. But such demands aren't always being aimed at solo practitioners or small law firms due to their clients and cases typically not setting cybersecurity requirements. Still, even with scant cybersecurity awareness among their clientele, high-profile attacks and intensifying insurance audits could soon make cybersecurity a top priority for small firms.

To be sure, U.S. lawyers have an ethical duty to protect client data. But while that obligation is widespread, clients play a critical role in keeping pressure on lawyers to adopt and maintain cybersecurity measures, noted law firm marketing consultant and chairwoman of the Pennsylvania Bar Association's solo and small law firm section Jennifer Ellis.

"They take [cybersecurity] seriously and are properly protecting the data, but I think if you don't necessarily have people pushing you to protect data, you may not be as conscientious of it," she said.