2027 law-firm IT budget planning · SERIES
Six core components of a strong cybersecurity posture: Who will own the work?
Law firms know the cybersecurity capabilities they need. The harder budget decision is who will scan, patch, manage security events, prepare for incidents, train users, and test defenses.
A strong cybersecurity posture depends on more than products and renewals.
Law firms need six continuing security functions: vulnerability scanning, security patching, Security Information and Event Management, incident-response preparation, security-awareness training, and penetration testing.
Most firms know these capabilities matter. The harder question is who will operate them.
A scanner needs review and follow-through. Patches need testing and controlled deployment. Security events need analysis and escalation. Incident-response plans need practice. Training needs continuing ownership. Penetration-test findings need remediation and retesting.
As law firms prepare their 2027 technology budgets, every function needs a named owner, process, and response path.
01
Vulnerability scanning
Find weaknesses, assign remediation, and confirm the fix.
02
Security patching
Test and deploy quickly without disrupting legal work.
03
Security Information and Event Management
Turn logs and alerts into investigation and action.
04
Incident-response preparation
Set roles and decision paths before a crisis.
05
Security-awareness training
Give lawyers and staff practical guidance throughout the year.
06
Penetration testing
Test exploitability, remediate findings, and retest.
The survey supports the ownership question. In the 2026 ILTA Technology Survey, 75% of respondents selected “specific security functions” among the IT functions they outsource to third parties. Respondents could select multiple answers, so this does not mean that 75% outsourced their entire security operation. The result shows that outsourcing at least some security functions is common among survey respondents.
Which security functions are firms outsourcing?
In a separate question about security functions outsourced to vendor partners, respondents selected SOC or MSSP functions at 70%, threat monitoring and analysis at 56%, incident response at 43%, security-awareness training at 36%, vulnerability management at 31%, and patching at 24%. Because respondents could select multiple answers, these percentages describe individual outsourced functions and should not be added together.
Source: 2026 ILTA Technology Survey, Q10.20.
01 · 2027 budget planning
1. Vulnerability scanning
Who identifies new weaknesses, determines their severity, and confirms remediation?
Vulnerability scanning can reveal exposed systems, outdated software, configuration problems, and other conditions that require attention across the firm’s internal and external environment. Finding a vulnerability is only the beginning.
Someone must review the results, determine which findings are credible, evaluate severity, assign remediation, and confirm that the weakness has been addressed. Scanning without follow-through can produce a growing list of findings without reducing exposure.
- What parts of the environment are scanned?
- Who reviews and prioritizes findings?
- Who owns remediation and retesting?
- How are accepted exceptions documented and reviewed?
Budget for
Scanning technology, review capacity, remediation ownership, and retesting.
02 · 2027 budget planning
2. Security patching
Can the firm test and deploy critical updates quickly without disrupting the systems attorneys rely on?
Security patching is an operating process. It requires prioritization, testing, controlled deployment, monitoring, and exception handling.
The difficult part is rarely finding the update. It is moving quickly while protecting application compatibility and the attorney experience.
September 2026 showed why patching capacity matters
Microsoft’s September 2026 Patch Tuesday included 966 to 974 reported vulnerabilities, depending on counting method, including two vulnerabilities already being exploited. Microsoft’s current guidance retains staged testing while compressing the complete deferral, deadline, and grace-period sequence to no more than seven days for normal quality updates.
Firms need a process that can prioritize urgent updates, test representative systems, deploy in controlled stages, monitor results, and manage exceptions without disrupting legal work.
- Which updates require immediate attention?
- How will testing and staged deployment work?
- Who approves broad deployment?
- What happens when a patch causes a performance problem?
Budget for
Testing capacity, deployment management, after-hours coverage, rollback, monitoring, and reporting.
03 · 2027 budget planning
3. Security Information and Event Management (SIEM)
Who reviews security activity continuously and decides what needs investigation?
Law firms generate large volumes of security activity across endpoints, identity systems, email, cloud services, firewalls, and applications. Collecting that information is not the same as managing it.
Alerts need review by people and systems capable of identifying suspicious behavior, investigating what happened, and escalating activity that may require containment. A firm can own a SIEM platform and still lack the capacity to operate an effective program.
- Which systems are sending information for review?
- Is coverage continuous or limited to business hours?
- Who can contain a compromised device or account?
- How does the monitoring team coordinate with the firm’s IT team?
Budget for
Coverage, analysis, escalation, and response ownership, not only log collection.
04 · 2027 budget planning
4. Incident-response preparation
If an incident begins tonight, who is authorized and prepared to respond?
A written incident-response plan matters, but it does not guarantee the firm can execute it. During a serious incident, leadership may need to make fast decisions about containment, communications, legal obligations, evidence, continuity, and recovery.
Those decisions become harder if roles and external response relationships are being established after the incident begins.
Tabletop exercises give the firm a controlled way to discuss scenarios, test responsibilities, and identify gaps in response and recovery processes. The ILTA survey reports that 54% of respondents selected tabletop exercises among implemented security technologies or controls. A separate incident-response question distinguishes internal IT-only exercises, management exercises, third-party exercises, and exercises involving critical vendors.
- Who leads the response and who can isolate systems?
- When are leadership and legal counsel notified?
- Who contacts outside response resources?
- Where are current procedures and contact lists stored?
Budget for
Preparation, exercises, retained expertise, and access to response support.
05 · 2027 budget planning
5. Security-awareness training
How will the firm reinforce secure behavior throughout the year?
Security awareness is sometimes reduced to an annual course. A stronger program treats it as continuing support for lawyers and staff who encounter phishing, suspicious links, credential requests, payment fraud, and unexpected file-sharing invitations.
Training should help people recognize these situations and know what to do next. People need clear expectations, usable reporting channels, and timely guidance.
- Who owns the awareness program?
- Does training address risks employees actually encounter?
- How can suspicious activity be reported quickly?
- What information does leadership review?
Budget for
The platform, program ownership, communications, testing, follow-up, and employee support.
06 · 2027 budget planning
6. Penetration testing
How will the firm test whether an attacker can exploit weaknesses that routine controls may miss?
Vulnerability scanning and penetration testing serve related but different purposes. A scan generally looks for known weaknesses. An authorized penetration test evaluates whether weaknesses can be exploited and what an attacker may be able to reach.
A firm can have regular scanning in place and still need periodic testing that evaluates how separate weaknesses, configurations, credentials, or access paths could be combined.
- What systems and locations are in scope?
- Who authorizes and coordinates the activity?
- Who owns remediation?
- Will important findings be retested?
Budget for
The assessment, remediation work, validation, and follow-up.
The operating-model decision
Decide what stays internal and what requires outside capacity
A law firm does not necessarily need to outsource all six security functions. It does need a named operating model for each one.
Outsourcing a function does not outsource the firm’s accountability. Leadership must understand what is covered, how an outside provider works with the internal team, and what happens when action is required.
- Who owns the work?
- What coverage is required?
- What happens after a finding?
- Who has authority to act?
- Where is specialist capacity needed?
- How is performance reviewed?
Build the budget around operations
Give every security function clear ownership
For many small and midsized law firms, maintaining every specialist capability internally is difficult. A legal-focused managed service provider can help define ownership, coordinate specialist resources, and connect security work to the firm’s wider IT operation.
Review who owns each function, where internal capacity is sufficient, and where outside coverage is required.
Next in the 2027 planning series
What must a law firm fund after buying the AI licenses?
Law firms are budgeting for AI licenses, governance, permissions, training, monitoring, and support. Next, we plan to examine what the 2027 budget must cover after the license is purchased.
Sources
- 2026 ILTA Technology Survey, Q2.14. Multiple responses permitted.
- 2026 ILTA Technology Survey, Q10.20, outsourced security functions. Multiple responses permitted.
- 2026 ILTA Technology Survey, Q10.21 and Q10.22, tabletop exercises and incident-response program elements.
- Cornerstone.IT: Microsoft Releases an Unprecedented Number of Patches.
- CISA Tabletop Exercise Packages.