Humans are the weakest link - Cybersecurity training is one of your best defences

Research consistently shows that the overwhelming majority of successful data breaches involve a human element. This could be a mistaken click, a misplaced confidence, or a moment of distraction. Law firms are particularly attractive targets because they hold sensitive client data, manage significant financial transactions, and operate under time pressure that can cloud judgment. A busy conveyancing clerk who receives what appears to be an urgent settlement instruction from a familiar email address is exactly the kind of target a criminal exploits.

The element of trust is what cybercriminals look to exploit. To achieve this, at their core, cybercriminals social engineers. Social engineering is a broad, umbrella term for a wide range of psychological manipulation tactics used by cybercriminals to exploit natural human tendencies like trust, fear, and a desire to be helpful. The goal is to manufacture enough trust, urgency, or fear that the victim willingly takes an action against their own interests.

These psychological manipulation tactics are present in most of the attack types. Common examples include:

• Phishing: Broadly casting deceptive emails or messages to trick victims into revealing sensitive data. Victims trust the message and click on an embedded malicious link.

• Spear Phishing: Highly targeted phishing campaigns that leverage personal details to build trust. The message looks like it comes from a trusted source and in trusting that information (and not verifying it), the victim is tricked by the cyber-criminal.

• Vishing / Smishing: Social engineering attacks executed over the phone (voice) or via SMS (text messages). The aim is to get the victim to divulge sensitive information.

• Business Email Compromise (BEC): Impersonating a trusted authority figure (like a CEO or vendor) to manipulate an employee into authorising fraudulent fund transfers.

The Victorian Legal Services Board + Commissioner (VLSB+C) has published Minimum Cybersecurity Expectations for legal practices, and cybersecurity training sits squarely within its behavioural controls. The expectations are clear and worth unpacking in detail.

Comprehensive, role-relevant training for all staff

The VLSB+C expects practices to provide all staff with comprehensive cybersecurity training that is relevant to their specific roles and responsibilities. This is an important nuance in that a receptionist, a conveyancing paralegal, and a trust account manager each face different threats and need training tailored accordingly. Topics should include phishing emails, social engineering, password best practices, safe web browsing, and emerging risks. Critically, the expectations apply to principals and lawyers too. "Also complete this training yourself" is an explicit requirement. Seniority does not confer immunity from being deceived, and leadership sets the tone for how seriously the whole practice takes cybersecurity.

Induction training and annual refreshers

New staff must complete cybersecurity training as part of their induction and before they have access to sensitive systems, not weeks later when it is convenient. Existing staff must receive refresher training at least once a year. Cyber threats evolve constantly, and annual training ensures your team's awareness keeps pace.

Keeping training current

The cybersecurity landscape shifts quickly. A training module that was current two years ago may not address the risks your practice faces today. New risks arises regularly, for example: AI-generated phishing emails, deepfake voice calls, or new malware strains. The VLSB+C expects training to be updated at least yearly, and more frequently when new threats emerge that are relevant to your practice.

Ensuring staff understand their role and obligations

Cybersecurity training should incorporate both threat recognition and breach response. Every staff member should understand what to do if they suspect a cybersecurity incident: who to notify, what not to do (such as continuing to use a compromised device), and how the practice's incident response process works. A well-trained team that responds quickly and correctly can dramatically limit the damage of a breach.

Sharing cybersecurity updates

Cybersecurity alerts and warning are regularly published by organisations such as the VLSB+C, the Australian Cyber Security Centre (ACSC), the LPLC, and other sources. When you receive a cybersecurity alert or warning, share them with your staff promptly. A timely heads-up about a new phishing campaign targeting law firms could be the difference between a near-miss and a serious incident.

Compliance with the minimum expectations is a floor, not a ceiling. An effective training program should be:

• Regular and reinforced: annual training alone is not sufficient to change behaviour; supplement it with brief, topical reminders throughout the year (for example, sharing ACSC alerts when relevant)

• Practical and scenario-based: abstract advice is less effective than realistic scenarios drawn from actual attacks on law firms

• Tested: consider simulated phishing exercises to assess whether training is translating into changed behaviour, and to identify staff who need additional support

• Documented: keep records of who completed training and when, both for internal accountability and to demonstrate compliance if required

• Supported by leadership: when principals visibly participate in and champion training, it signals that cybersecurity is a genuine practice priority, not just a compliance exercise.

There is no technical control (no firewall, no antivirus software, no log-in system) that is fully effective. And technical controls are made weaker when your staff have not been trained to recognise and respond to threats. Cybersecurity training is not a tick-the-box obligation; it is a practical investment in protecting your clients, your practice, and your professional reputation.

The VLSB+C's minimum expectations on training provide a clear and sensible starting point. The LPLC provides regular cybersecurity workshops, as well as live and recorded webinars. Meeting your cybersecurity training requirements is achievable for practices of any size.