A law firm is one mailbox away from exposing litigation strategy, M&A data rooms and client funds. Darkmoon tests your Microsoft 365 identity, client portals, case-management stack and remote access the way an attacker would, then proves which paths actually work. The managed engagement is run end to end by ASC-IT's security experts, legal framework included.
A firm concentrates what adversaries want: privileged correspondence, deal timelines, identity documents and the bank details of settlement payments, all behind an email tenant shared by every partner, associate and paralegal.
Litigation strategy, pre-announcement M&A files and criminal-matter records are worth more to an extortionist than card numbers: the threat of publication pressures the firm and its client at the same time. ANSSI was informed of 196 data-exfiltration incidents in 2025 against 130 the year before, across all sectors.
An attacker who reads a partner's mailbox learns when a completion payment is due, then sends corrected bank details from the right thread. The CNB's cyber guide singles out identity usurpation and falsified bank details as a key scenario for law firms.
Microsoft 365 with legacy authentication still enabled, MFA fatigue prompts accepted on a Friday evening, a shared mailbox nobody owns: one identity gives the attacker SharePoint, Teams and the document-management system at once.
Professional secrecy (art. 66-5 of the French 1971 Act, ABA Model Rule 1.6(c) in the US) and GDPR Article 33 run alongside the crisis: 72 hours to notify a breach while the firm is still working out which matters the attacker read.
Most firms run on the same stack. Darkmoon maps it as an attacker sees it: identity first, then every application that trusts that identity.
Legacy authentication protocols, MFA fatigue, consent-phishing applications, forwarding rules planted in a partner's mailbox, Entra ID roles nobody has reviewed since the last lateral hires.
The place where clients, experts and opposing counsel upload exhibits: authorization flaws between matters, guessable share links, guest accounts that expired on paper and still log in.
Case-management and DMS families index every matter in one place. We test their web front ends, APIs, Outlook integrations and the permissions that leak across practice groups.
Edge devices are the asset a firm patches last. We check exposed VPN portals, remote-desktop gateways and the single-factor logins that survive on them.
Marketing site, intranet, time-recording and e-billing portals: footholds that often share credentials or hosting with the production estate.
SharePoint and OneDrive libraries, legal-research and e-discovery SaaS, e-signature services: tokens, over-shared folders and OAuth grants that outlive the matter they were created for.
These are the chains we walk during an engagement, with the evidence of each step kept for the report. Hostnames, emails and credentials are tokenized before they reach the model.
A phished password, a burst of push notifications accepted at 7 pm, a session token replayed from the attacker's machine. From there: the partner's mailbox, the SharePoint data room of a live transaction and the e-signature account that approves it.
How the engine worksFifty specialist agents and 142 tools behind a build-enforced allow-list, orchestrated against the scope you authorize. Every finding is qualified EXPLOITED, CONFIRMED or UNCONFIRMED with the request, payload or screenshot that proves it.
Legacy authentication exposure, MFA coverage and bypass paths, conditional-access gaps, consent-phishing exposure, mailbox rules and privileged roles across the tenant.
Authorization between matters and clients, file-upload handling, session management, API endpoints of the case-management and document-exchange stack, e-billing and intranet applications.
Exposed VPN and remote-desktop services, Active Directory and Entra ID attack paths to the DMS and backup servers, cloud storage permissions and third-party SaaS integrations.
A process designed to be simple for the client and rigorous on the security side.
Not just an automated scan: a structured, validated and debriefed audit.
Vulnerabilities ranked by severity, technical evidence, business impact and prioritized remediation guidance.
Access by email and OTP code. Contractual documents, report and exchanges centralized, available whenever you need them.
A video call with an expert to walk through the findings, answer questions and guide you on the fixes.
The Privacy Gateway tokenizes every sensitive value (IPs, hostnames, URLs, emails, credentials, internal paths) on your machine before anything reaches the model, and rehydrates it locally. Self-host the whole engine with a local LLM, or let our experts run the managed engagement: in both cases the evidence stays in a space you control.
Law firms are not a sector listed in NIS2 Annex I or II. Their security duties come from professional secrecy, from GDPR and from their clients' contracts, and a documented penetration test is one way to evidence them.
In France, art. 66-5 of loi n° 71-1130 covers consultations, correspondence, interview notes and every piece of the file; RIN art. 2 makes the secret absolute, general and unlimited in time; art. 226-13 of the Code pénal sanctions its breach. In the US, ABA Model Rule 1.6(c) requires reasonable efforts to prevent unauthorized access to information relating to a client.
Article 32 requires appropriate technical and organisational measures proportionate to the risk; Article 33 requires notification of a personal-data breach to the supervisory authority within 72 hours. A penetration test can document the measures Article 32 requires and shows which breach scenarios are realistic for your firm.
Where a client is itself an essential or important entity, NIS2 Article 21(2)(d) obliges it to manage supply-chain security, and law firms receive security questionnaires and contractual clauses as a result. The directive itself does not list law firms.
Insurers ask how remote access, email and backups are protected before quoting a firm; a recent test report answers with evidence rather than declarations, without being a prerequisite in itself. The ABA frames confidentiality as a reasonable-efforts duty, and a test is one way to show those efforts.
This section describes the legal context as of October 2026 and is not legal advice: confirm your own obligations with counsel and your bar. Darkmoon does not certify compliance; it produces documented, reproducible findings you can present to your management committee, auditors or insurer as part of your evidence base.
A corporate client, itself a NIS2 entity, sends a supplier security questionnaire with a clause requiring evidence of security testing. The firm orders a managed engagement covering its Microsoft 365 tenant, client portal, DMS web front end and VPN. Darkmoon finds legacy authentication still accepted on the tenant, a portal that serves documents across matters once a user is logged in, and an RDP gateway reachable with a single factor.
Exploited findings with their evidence, a debriefed report in the secure client space, a fix plan the IT provider can execute, and an answer to the questionnaire that rests on a test rather than a declaration.
The price is known before payment. No quote, no surprise. Indicative price, adjusted to the final scope. If the scoping call changes the scope and the price, you are told before anything starts.
Legal framework & authorizations included
Yes, within a signed authorization. The engagement starts with a test authorization, a scope and liability clauses signed electronically, and the firm decides which systems are in scope. Authorization gaps are confirmed on test accounts, the evidence is stored in a client space you control, and the Privacy Gateway tokenizes hostnames, emails and credentials before anything reaches the model.
Law firms are not a sector listed in NIS2 Annex I or II. NIS2 reaches a firm indirectly when a client is an essential or important entity and passes supply-chain requirements down under Article 21(2)(d). Your direct duties come from professional secrecy and GDPR Article 32.
Yes, for the part the firm controls: the accounts, sharing links, guest access and permissions of the e-signature service, the data room and the document-exchange platform, tested on test matters created for the engagement. The provider's own infrastructure stays outside the scope unless the provider authorizes it. The report shows what an outsider holding an invitation link or an expired guest account can still reach.
The Pentest on Demand flat rate is €799 per engagement, shown upfront and adjusted to the final scope after the scoping call. The timeline depends on the scope and is set in the contractual framework, typically a few business days after scoping.
The Community edition is GPLv3 and self-hosted, with a local LLM option through Ollama or llama.cpp. Firms with an in-house IT team sometimes do. Most law firms prefer the managed engagement because the legal framework, scoping and debrief are included.
A written authorization for the targets in scope (the legal framework you sign at order time), the URLs, hostnames or network ranges to test, test accounts where authenticated testing matters, and a contact for the scoping call. Our experts confirm the scope and the constraints with you before the engagement starts.
Yes. The report is yours. It documents each finding with its evidence, severity and remediation guidance, so it can be handed to a cyber-insurer, a client's procurement team or an auditor as a dated, factual description of what was found. It is evidence, not a certification.
You get a prioritised fix list with the evidence for each finding, a debrief call to walk through it, and the option to retest once the fixes are in. Teams that self-host can schedule recurring campaigns (Pro) so the same checks run after each change; the Pro remediation agent can also open sandbox-validated fix pull requests for your developers to review.
The checklist rewritten as attack paths: identity, portals, DMS, remote access, with what to verify first.
Guided order, legal framework signed online, flat rate shown upfront, report and debrief in a secure client space.
How client names, hostnames and credentials are tokenized before the model sees anything.
Who is listed, who is reached through supply-chain clauses, and where France stands on transposition.
How Darkmoon handles your data, the evidence it keeps and the controls around tool execution.
Payroll runs, client bank details and tax seasons: the neighbouring profession's attack surface.
Order a managed engagement on your tenant, portals and remote access, or talk to the team about the scope first.