Best Penetration Testing Companies for Law Firms (2026): Ranked for Legal Confidentiality and Client Audits

Legal services accounted for 18 percent of the more than 1,400 ransomware complaints the FBI's Internet Crime Complaint Center received in 2025 from organizations outside the 16 critical infrastructure sectors, more than any other industry, according to the FBI 2025 Internet Crime Report. In the American Bar Association's 2023 Cybersecurity TechReport, 29 percent of respondents said their firm had experienced a security breach, and half of respondents at firms with more than 100 lawyers said a client or prospective client had asked the firm to complete a security questionnaire. Firms hold deal terms, litigation strategy and privileged advice, and clients now audit how it is protected.

Where Stingrai fits: Stingrai is a CREST-accredited penetration testing service provider at firm level, headquartered in Toronto with a London office and founded in 2021. Two named penetration testers holding OSCE³, OSWE, OSEP, CREST CRT and CISSP staff each human-led engagement, backed by 18 published CVEs and Hall of Fame listings at Apple, Google, the US Department of Defense and the US Federal Reserve. For a law firm that means Microsoft 365 and Entra ID tested for consent grants and Conditional Access gaps, Active Directory for Kerberos and delegation paths, client portals across every client and matter, and vishing aimed at the help desk and the people who move client funds. It is delivered as a one-time annual engagement or a continuous program through the PTaaS portal, with retesting and an attestation letter included. Published pricing is US$3,000 for an Autonomous Pentest and US$6,800 for a Hybrid Pentest covering one web application and its APIs (pricing); firm-wide scopes are quoted.

Quick answer: who are the best penetration testing companies for law firms in 2026?

The best penetration testing companies for law firms in 2026 are Stingrai, CBIZ Pivot Point Security, NCC Group, Kroll, LevelBlue, GuidePoint Security, Sikich, ISA Cybersecurity, TrustedSec, Optiv, Packetlabs and LMG Security. Stingrai ranks first for named, certified penetration testers on the systems law firms are breached through, with retesting and an attestation letter included, one-time or continuous. CBIZ Pivot Point Security, NCC Group and Kroll follow for the most law-firm-specific practice, a legal practice backed by the broadest CREST accreditation here, and testing informed by incident response.

What law firms are actually required to test

No bar rule, law society rule or privacy statute in either country names penetration testing. They require reasonable security, competence with the technology in use, and prompt notice when client information is exposed. The test itself arrives through client contracts, and that decides what the report has to prove.

ABA Model Rules 1.1 and 1.6(c)

Comment 8 to Model Rule 1.1 says a lawyer "should keep abreast of changes in the law and its practice, including the benefits and risks associated with relevant technology." Model Rule 1.6(c) sets the duty: "A lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client."

Comment 18 weighs the sensitivity of the information, the likelihood of disclosure without added safeguards, the cost and difficulty of those safeguards, and their effect on the representation. It also contains the sentence behind most law firm security budgets: "A client may require the lawyer to implement special security measures not required by this Rule." The rule sets a floor. The client sets the test.

ABA Formal Opinions 477R, 483 and 512

Formal Opinion 477R, issued in May 2017, reads reasonable efforts as a "process" to assess risks, implement appropriate security measures, "verify that they are effectively implemented, and ensure that they are continually updated." A penetration test is the most direct evidence that the verification happened.

Formal Opinion 483, issued in October 2018, adds a duty to "employ reasonable efforts to monitor the technology and office resources connected to the internet, external data sources, and external vendors," to stop a breach, determine what occurred and notify current clients when material client information is compromised. Formal Opinion 512, issued in July 2024, warns that self-learning generative AI tools can expose one client's information to lawyers on other matters "even if the tool is used exclusively by lawyers at the same firm," and requires informed client consent before client information goes into such a tool. None of the three names penetration testing.

State bar requirements: New York, California and Florida

New York requires at least one CLE credit hour in Cybersecurity, Privacy and Data Protection in each biennial cycle, effective 1 July 2023. California's Formal Opinion 2020-203 says lawyers must "take reasonable steps to secure their electronic systems to minimize the risk of unauthorized access." Florida requires three of the 30 credit hours in each three-year cycle in technology programs.

Outside counsel guidelines and client security questionnaires

This is where penetration testing is written down. The Association of Corporate Counsel published its Model Information Protection and Security Controls for Outside Counsel in 2017 so legal departments could set consistent expectations for the firms they retain. Section 7 reads: "At least annually, Outside Counsel will perform vulnerability tests and assessments of all systems that contain Company Confidential Information." For the firm's own applications that process that information, it adds manual penetration tests using intercept proxies, plus code review or other manual verification, at least annually or on any major software change.

The rest of the model reads like the questionnaires banks, insurers and health systems send: breach notice within 24 hours, two-factor authentication for remote access, review rights for the client and its auditors and regulators, a possible request for ISO 27001 certification or SOC reports, at least US$10 million of cyber liability insurance, and flow-down to subcontractors. In practice those questionnaires commonly ask for an annual independent penetration test, a summary or attestation letter the client can file, and remediation of critical and high findings within a set period.

Clients have their own regulators behind those clauses. A New York-licensed bank or insurer must keep written policies for third-party service providers under 23 NYCRR 500.11, including "periodic assessment of such third-party service providers based on the risk they present," and Part 500 defines those providers broadly enough to capture outside counsel who receive client data. The NYDFS guide covers the client's side.

HIPAA for firms that handle protected health information

The business associate definition at 45 CFR 160.103 names legal services where the work involves disclosure of protected health information, and HHS's direct liability fact sheet lists "Failure to comply with the requirements of the Security Rule" among the violations business associates answer for directly. The Security Rule in force today does not name penetration testing, and the proposed rule at 90 FR 898 that would require it every 12 months is still only a proposal under RIN 0945-AA22 as of 25 September 2026, as the HIPAA requirements guide details.

ISO 27001 and SOC 2 for firms and legal technology vendors

Firms answering outside counsel guidelines, and the e-discovery, practice management and legal AI vendors that sell to them, increasingly hold ISO 27001 certificates or SOC 2 reports. ISO/IEC 27001:2022 names no penetration test; a test serves instead as evidence for controls such as A.8.8 and A.8.29 (ISO 27001 guide). SOC 2 mentions it once, in a point of focus under CC4.1 (SOC 2 ranking).

Federation of Law Societies Model Code, rule 3.1-2

Canada's equivalent of Comment 8 is commentary [4A] and [4B] to rule 3.1-2 of the Federation of Law Societies' Model Code, as amended April 2024. A lawyer should understand "the benefits and risks associated with relevant technology, recognizing the lawyer's duty to protect confidential information set out in section 3.3." In deciding what technology is reasonably available, the commentary weighs practice areas, geography and "the requirements of clients." Rule 3.3-1 requires client information to be held "in strict confidence." No test is named. Client requirements are.

Law Society of Ontario

Ontario adopted the same commentary to rule 3.1-2 in June 2022. Section 5.10 of its Technology Practice Management Guideline says lawyers "should be familiar with the security risks inherent in any of the information technologies used in their practices," including unauthorized copying of electronic data and outside access to electronic files, and "should adopt adequate measures to protect against security threats." Neither document names penetration testing.

Law Society of British Columbia

British Columbia added commentary [4.1] and [4.2] to rule 3.1-2 of the BC Code in March 2024, and its rules go further than any other in this section. Rule 10-4 requires a lawyer to protect practice records "by making reasonable security arrangements against all risks of loss, destruction and unauthorized access, use or disclosure," and to notify the Executive Director immediately in writing if "anyone has improperly accessed or copied any of the lawyer's records." Testing finds that exposure before it becomes a report.

PIPEDA and provincial privacy laws

PIPEDA applies to personal information handled in the course of commercial activities. Principle 4.7 requires "security safeguards appropriate to the sensitivity of the information," section 10.1 requires a report to the Privacy Commissioner of any breach creating a real risk of significant harm, and the Breach of Security Safeguards Regulations require a record of every breach for 24 months. British Columbia's Personal Information Protection Act, section 34, requires "reasonable security arrangements." None names a test.

Quebec Law 25

Quebec firms answer to the Act respecting the protection of personal information in the private sector, as amended by Law 25. Section 10 requires security measures "reasonable given the sensitivity of the information, the purposes for which it is to be used, the quantity and distribution of the information and the medium on which it is stored," and section 3.5 requires prompt notice to the Commission d'accès à l'information of incidents presenting a risk of serious injury. The Act does not mention penetration testing, though the Commission's privacy impact assessment guide lists a test d'intrusion among a report's annexes, as the Law 25 guide sets out.

The law firm attack surface: what a good scope covers

A test that stops at the perimeter misses the systems where client files live.

• Document management systems. iManage and NetDocuments hold the work product. Try to cross an ethical wall through search, the API, desktop sync clients and email filing, and check how far integration service accounts can reach.

• Microsoft 365 and Entra ID. Conditional Access exceptions, legacy authentication, OAuth consent grants, mailbox forwarding rules and guest access to sites shared with clients. The Azure and Entra ID scope guide lists the checks.

• Active Directory. Kerberos and delegation paths, ACL abuse and certificate template misconfigurations turn one phished workstation into domain admin, as the Active Directory testing guide describes.

• Client portals and extranets. Deal rooms and matter portals must keep each client out of the others' documents, which takes an authorization test across every client, matter and role.

• E-discovery and litigation support. Review workspaces hold whole custodian mailboxes, so workspace permissions, temporary reviewer accounts and production exports belong in scope.

• Remote access. VPN appliances and virtual desktop gateways face the internet, and the ACC model controls expect two-factor authentication for remote access.

• Wire fraud and social engineering. The FBI's 2025 report counts US$3.05 billion in business email compromise losses across 24,768 complaints, and describes buyers closing on a home who wired more than US$449,000 after an email impersonating their attorneys. Real estate and transactional practices need phishing, vishing of the help desk, tests of the payment instruction change process and lookalike domain checks, as the social engineering testing guide explains.

• Mobile devices and generative AI. Test device enrollment and data leakage controls, and whether a firm AI assistant connected to the DMS can reach a walled matter or follow instructions planted in a document under review.

How we ranked them

Twelve vendors were scored against ten criteria. Every accreditation was checked on the CREST Marketplace or the accrediting body's own register and every rating on the review site itself, and every vendor entry links to a page on the vendor's own site, verified on 25 September 2026.

1. Published legal-sector security work on the vendor's own site.

2. Firm-level accreditation on the CREST Marketplace, plus the company certifications listed there.

3. Coverage of the law firm attack surface described above.

4. Named testers, identified with their certifications before signing.

5. Retest policy stated in writing.

6. Delivery: a portal for findings, and both one-time and continuous options.

7. Evidence for client audits, such as a report and attestation letter a client will accept.

8. Pricing transparency.

9. North American delivery in the United States, Canada or both.

10. Independence from the firm's IT and managed security providers.

The 12 companies at a glance

"Not stated" means the vendor's own site does not say. Ask for it in writing.

1. Stingrai

Stingrai is a global CREST-accredited penetration testing services company founded in Toronto, Canada in 2021, trusted by companies from startups to enterprises to meet audit requirements for SOC 2, ISO 27001, CMMC, PCI DSS and HIPAA. OSCE³, OSWE, OSEP, CREST CRT certified pentesters, who are also world-class security researchers and bug bounty hunters. Choose from fully human-led or hybrid (AI agents plus human penetration testers) engagements across web, API, mobile, AI and LLM, cloud, network, Active Directory and social engineering penetration tests and red team engagements.

What a firm's security committee can check. The firm-level accreditation is on the CREST Marketplace supplier page for Stingrai Inc, separate from the CREST CRT certifications individual testers hold. Ratings are 5.0 out of 5 across 19 reviews on Clutch and 4.9 out of 5 on G2. The team has published 18 CVEs, including CVE-2025-50674, a privilege escalation to root in OpenMediaVault, and CVE-2024-32136, an SQL injection in a WordPress plugin. Two named penetration testers run each human-led engagement, reviewed by the team lead and an engagement partner, under founder Arafat Afzalzada, who has 11 years in offensive security.

How a law firm engagement is tested. Cloud testing treats Microsoft 365 and Entra ID as an attack path: app registrations, service principals, consent grants, Conditional Access gaps and hybrid-join trust back to on-premises AD. The Active Directory assessment follows ACL abuse and Kerberos and delegation paths to domain admin, and network testing covers the external perimeter including remote access, lateral movement and segmentation. Client portals are tested black, grey or white box, authenticated across every role, for broken authorization, IDOR and business logic under OWASP Top 10 and ASVS. Phishing and vishing campaigns test the help desk and the payment instruction process, and AI and LLM testing covers prompt injection and excessive agency in assistants connected to firm data, mapped to the OWASP LLM Top 10.

Evidence and delivery. Findings post to the PTaaS portal as they are confirmed, each with a working proof of concept and remediation guidance, with live chat to the assigned testers and Jira and Slack integration. Reports are redactable, which matters when privilege limits what a client can see. Retesting is included, and every report ships with an attestation letter and a verified badge. Stingrai runs both one-time annual engagements timed to a client audit cycle and continuous programs that test every release.

Where Snipe fits. Snipe, Stingrai's autonomous AI penetration testing agent for web applications and their APIs, covers the client portals, extranets and legal technology products in scope. It hunts broken authorization, IDOR and business logic flaws, reviews code, and opens AutoFix pull requests. The Autonomous tier is Snipe alone, with no penetration testers; in a Hybrid engagement Snipe and the penetration testers test together throughout, with the testers directing its focus. Microsoft 365, Active Directory, network, social engineering and AI scopes are tested by penetration testers.

Pricing: US$3,000 for an Autonomous Pentest and US$6,800 for a Hybrid Pentest per assessment of one web application and its APIs, or US$650 and US$1,275 per month on 12-month continuous plans, on the pricing page. Every other scope is quoted through get a quote.

Strength: every claim a client's security team will ask about has a public source, from the CREST listing to the CVE records and review profiles. Limitation: a deliberately small team, which the CREST listing reflects, so multi-office physical and social engineering programs need scheduling lead time, and the fixed-price packages cover web applications and their APIs only. Best for: large and mid-size firms and legal technology vendors in the US and Canada that need named, certified penetration testers and an attestation letter for client audits, one-time or continuous.

2. CBIZ Pivot Point Security

CBIZ Pivot Point Security, headquartered in Hamilton, New Jersey with staff across the United States, publishes the most law-firm-specific practice page in this ranking. Its legal industry page says the firm helps law firms "address ABA ethical guidance around confidentiality and data protection, satisfy corporate clients' demands," with gap assessments that can be scoped to "Document Management Systems, eDiscovery platforms, and Litigation Support Systems." Its penetration testing page covers networks, wireless, applications, databases, physical security and social engineering including vishing, and a legal case study describes an NLJ 250 firm facing client questionnaires, tested with an external penetration test, a credentialed internal assessment and a phishing exercise. CREST lists Penetration Testing with nine years of membership, plus ISO 27001. Named testers, retest terms, a findings portal and pricing are not stated.

Strength: it speaks the language of the outside counsel guideline, from ABA guidance to e-discovery scoping. Limitation: testing sits beside ISO 27001 and SOC 2 readiness consulting, so document how testers are separated from the consultants who designed the controls. No Canadian office is listed. Best for: firms whose clients are pushing them toward ISO 27001 certification or a SOC 2 report.

3. NCC Group

NCC Group is headquartered in Manchester, England, with its North American regional headquarters at 11 E Adams Street in Chicago and a Canadian office in Waterloo, Ontario. Its legal and professional services page lists "red teaming, incident response, and penetration testing for law firms," and states that the work is done in-house without contractors. It also publishes a legal sector threat intelligence report. Its CREST listing is the broadest here: Penetration Testing, Threat Led Penetration Testing, Cyber Threat Intelligence, Incident Response, Security Operations Centre and Vulnerability Assessment, with 19 years of membership. A Cyber Services Portal tracks testing and remediation, and a continuous testing service is offered. Named testers, retest terms and pricing are not stated.

Strength: a named legal practice backed by the widest accreditation set in this list. Limitation: the legal page is written for an international audience, so confirm the North American team. Best for: large firms that want red teaming and penetration testing from one firm with a legal practice.

4. Kroll

Kroll is headquartered at One World Trade Center in New York and lists a Toronto office at 333 Bay Street. Its penetration testing page describes a six-phase approach across web, API, cloud, AI and LLM, mobile, network and IoT testing, plus red teaming, informed by its incident response practice. Its legal-sector product is risk tooling: the Legal Threat Detector is a guided assessment built into matter onboarding "to identify threats or hidden risks before commencing a client engagement." CREST lists Penetration Testing, Incident Response and Security Operations Centre accreditations with eight years of membership, and a presence on more than 60 cyber insurance carriers' and brokers' preferred panels. Named testers, retest terms, a findings portal and pricing are not stated.

Strength: testing, forensics and incident response under one contract, with a Toronto office. Limitation: testing is one line in a very large risk advisory firm, and no commercial terms are published. Best for: firms that want testing from a provider on many cyber insurers' response panels.

5. LevelBlue

LevelBlue, headquartered in Plano, Texas according to its own contact page, describes itself as the largest pure-play managed security services provider and has completed its acquisition of Trustwave, whose SpiderLabs threat intelligence now backs its testing. Its legal services page addresses law firms directly and points to its bench of "pen testers." The penetration testing page covers infrastructure, applications, OT and IoT, physical security, social engineering and red teaming, with a PTaaS option and retesting "at no additional cost." CREST lists LevelBlue Cyber Solutions Ltd with Penetration Testing, Threat Led Penetration Testing, Application Security Testing and Mobile Application Security Testing, and 15 years of membership. Named testers and pricing are not stated.

Strength: retest included and a published legal page. Limitation: managed security is the center of gravity, and the CREST listing belongs to a UK entity, so confirm which entity delivers North American work. Best for: firms consolidating managed detection and testing with one provider.

6. GuidePoint Security

GuidePoint Security lists its headquarters at 1900 Reston Metro Plaza in Reston, Virginia. Its penetration testing page describes hands-on testing for complex, multi-step vulnerabilities, and its catalog adds a PTaaS platform, phishing as a service, red teaming, an incident response retainer and ransomware negotiation. Its legal-sector material is response work: a customer story in which a Florida personal injury firm, hit by ransomware through its managed security service provider, was back online in about a week. CREST lists Penetration Testing with three years of membership. Named testers, retest terms and pricing are not stated.

Strength: testing, incident response and ransomware negotiation from one US firm. Limitation: the legal material is incident response rather than a legal testing practice, and the PTaaS platform leans on automation. Best for: firms that want a tester that has also handled a law firm ransomware event.

7. Sikich

Sikich, a professional services firm of about 2,500 people whose press releases are datelined Chicago, runs a legal practice covering law firm technology, Microsoft 365, Copilot and case management. Its April 2026 lawyer's guide to cybersecurity states: "We conduct vulnerability scans and penetration testing to identify weaknesses before attackers do," and describes simulated phishing campaigns for firm staff. Its cybersecurity practice lists penetration testing, social engineering and product security tests. Sikich is not on the CREST Marketplace, and named testers, retest terms, a findings portal and pricing are not stated.

Strength: a legal technology practice and a testing practice under one roof, with current legal-specific guidance. Limitation: no firm-level CREST accreditation, and if Sikich also manages the firm's IT, independence needs settling in writing. Best for: mid-size firms already working with Sikich on legal technology.

8. ISA Cybersecurity

ISA Cybersecurity has its head office at 3280 Bloor Street West in Toronto, with offices in Calgary and Ottawa. Its penetration testing page covers internal, external, wireless, mobile and web testing plus red and purple teaming, sold alongside managed detection and incident response. Its law firm cybersecurity article calls lawyers and law firms "prime targets for cyber attacks" and covers phishing, training and business continuity. ISA is not on the CREST Marketplace, and named testers, retest terms, a findings portal and pricing are not stated.

Strength: a Canadian-headquartered provider with offices in three provinces. Limitation: the law firm article dates from 2020, and legal is not among the industries in its menu. Best for: Canadian firms that want testing and managed services from a Canadian supplier.

9. TrustedSec

TrustedSec operates from 3485 Southwestern Boulevard in Fairlawn, Ohio. Its penetration testing page ends in validation testing: "After you've addressed identified vulnerabilities, we retest to confirm they've been successfully mitigated." Its social engineering service names email and spear phishing, phone phishing aimed at password resets, SMS and chat platform phishing, and on-site social engineering, which maps onto the wire fraud risk in transactional practices. CREST lists Penetration Testing with two years of membership. TrustedSec publishes no legal industry page, and pricing, a findings portal and named testers are not stated.

Strength: Active Directory, red team and vishing depth, with retest stated. Limitation: the legal context has to come from the firm's scoping brief. Best for: firms worried about a call to the help desk or a path from one workstation to the DMS.

10. Optiv

Optiv lists its corporate headquarters at 5100 W 115th Place in Leawood, Kansas, and a Canadian office in Mississauga, Ontario. Its attack and penetration service spans penetration testing, spear phishing assessments, application and mobile assessments and red and purple teaming. Optiv announced CREST accreditation for penetration testing in October 2025, and its legal-sector evidence is a case study of a leading national law firm that worked with Optiv on its Zero Trust policies. Named testers, retest terms, a findings portal and pricing are not stated.

Strength: one integrator for security technology and testing across the United States and Canada. Limitation: the law firm case study concerns architecture policy rather than testing, so name the testers in the statement of work. Best for: large firms buying testing inside a broader security program.

11. Packetlabs

Packetlabs lists its headquarters at 401 Bay Street in Toronto. It is a testing specialist covering applications, infrastructure, cloud, AI and LLM, red teaming and social engineering, and CREST lists Penetration Testing and AI-Enabled Penetration Testing with four years of membership. Its law firm material is a 2022 article on law firm data protection, and legal is not among the industries on its site. Named testers, retest terms, a findings portal and pricing are not stated.

Strength: a Toronto testing specialist with an AI-enabled CREST accreditation. Limitation: no legal industry practice is published. Best for: Canadian firms that want a domestic testing specialist.

12. LMG Security

LMG Security lists a mailing address in Missoula, Montana. It sells penetration tests, advisory and training, and runs continuing legal education seminars for attorneys on protecting client data, HIPAA security for attorneys, the ethics of email encryption and mobile device security. It is not on the CREST Marketplace, and named testers, retest terms, a findings portal and pricing are not stated.

Strength: the same team can test the firm and train its lawyers. Limitation: a small firm without firm-level accreditation. Best for: mid-size firms that want testing and attorney training from one provider.

Firms considered and not ranked

Some familiar names were left out because their sites publish no legal-sector testing work. Rapid7 and Coalfire appear in the USA ranking. In Canada, the legal industry pages of MNP and BDO Canada cover accounting, tax and advisory work for law firms, and Digital Boundary Group publishes no legal-sector material; the Canada ranking covers the national market. A firm's managed IT provider is a different case: whoever runs the network should not test it.

How much does law firm penetration testing cost in 2026?

Law firm scopes usually span Microsoft 365, Active Directory, the perimeter and a social engineering campaign. Stingrai publishes its package prices: US$3,000 for an Autonomous Pentest, which is Snipe alone with no penetration testers, and US$6,800 for a Hybrid Pentest, where penetration testers and Snipe test together, each per assessment of one web application and its APIs. The same tiers run at US$650 and US$1,275 per month on 12-month continuous plans. Every other scope is quoted through get a quote, with current figures on the pricing page.

The bands below are indicative, taken from our penetration testing cost guide for US dollars and the Canadian cost guide for standard Canadian scopes.

Three things move a law firm quote most: offices and domains in scope, whether social engineering includes vishing and on-site work, and how many portals need authenticated testing across roles. The cost calculator gives a starting figure.

Buyer checklist: questions to put to every vendor

The RFP template and statement of work template turn these into procurement language.

1. Who exactly will test, and can we see their names and certifications before we sign?

2. Where is your firm-level accreditation listed, and which legal entity will sign our statement of work?

3. Will you test Microsoft 365 and Entra ID as an attack path, including consent grants, Conditional Access exceptions and mailbox rules?

4. How will you test our ethical walls without opening privileged content? Synthetic test matters are the usual answer.

5. Do you run vishing against our help desk and payment instruction process, and how do you handle call recording rules in each jurisdiction?

6. What can we hand a client? Ask for the attestation letter, an executive summary and a redacted report that fits an outside counsel guideline.

7. Is retesting included, and within what window?

8. Where do you keep our findings, and for how long? Confirm residency for Canadian firms and destruction on request.

9. Are you independent of our IT provider, managed security provider and certification consultant?

10. Can you test our generative AI tools and their connections to the DMS and Microsoft 365?

Frequently Asked Questions

Who are the best penetration testing companies for law firms in 2026?

The best penetration testing companies for law firms in 2026 are Stingrai, CBIZ Pivot Point Security, NCC Group, Kroll, LevelBlue, GuidePoint Security, Sikich, ISA Cybersecurity, TrustedSec, Optiv, Packetlabs and LMG Security. Stingrai ranks first: a CREST-accredited penetration testing service provider at firm level with two named penetration testers holding OSCE³, OSWE, OSEP, CREST CRT and CISSP on every human-led engagement, testing Microsoft 365, Entra ID, Active Directory, client portals and staff vishing, with retesting and an attestation letter included on one-time or continuous terms. CBIZ Pivot Point Security, NCC Group and Kroll follow.

Do the ABA Model Rules require law firms to conduct penetration testing?

No. None of the ABA Model Rules or formal opinions names penetration testing. Rule 1.6(c) requires reasonable efforts to prevent unauthorized access to information relating to the representation of a client, and Formal Opinion 477R reads that as a process that includes verifying security measures are effectively implemented. Comment 18 to Rule 1.6 adds that a client may require security measures the rule does not, which is how a penetration test becomes a contractual obligation.

What do outside counsel guidelines require from a law firm penetration test?

The Association of Corporate Counsel's 2017 model controls for outside counsel show the typical shape: vulnerability tests of all systems holding company confidential information at least annually, and manual penetration tests of the firm's own applications that process it, at least annually or on any major software change. They also ask for breach notice within 24 hours, two-factor authentication for remote access, client review rights and at least US$10 million of cyber liability insurance.

Is a law firm a HIPAA business associate, and does HIPAA require penetration testing?

A firm providing legal services to a covered entity that involve disclosure of protected health information is a business associate under 45 CFR 160.103, and HHS states that business associates are directly liable for failing to comply with the Security Rule. The Security Rule in force today does not name penetration testing. A proposed rule at 90 FR 898 would require testing at least every 12 months, but as of 25 September 2026 the Federal Register lists only the proposal and no final rule.

Do Canadian law societies require penetration testing?

No law society rule names penetration testing. The Federation of Law Societies' Model Code, rule 3.1-2 commentary [4A] and [4B], asks lawyers to understand the risks of relevant technology, recognizing the duty to protect confidential information, and weighs the requirements of clients; Ontario adopted it in June 2022 and British Columbia in March 2024. British Columbia's Rule 10-4 also requires reasonable security arrangements for practice records and immediate notice to the Executive Director of improper access.

Does Quebec Law 25 or PIPEDA require a law firm to run a penetration test?

Neither statute names one. PIPEDA requires safeguards appropriate to the sensitivity of the information, reports of breaches creating a real risk of significant harm, and a record of every breach for 24 months. Quebec's private sector act, as amended by Law 25, requires reasonable security measures at section 10 and prompt notice to the Commission d'accès à l'information of incidents presenting a risk of serious injury at section 3.5. A penetration test is how a firm shows its measures were reasonable.

How much does law firm penetration testing cost in 2026?

Stingrai publishes US$3,000 for an Autonomous Pentest (Snipe alone, no penetration testers) and US$6,800 for a Hybrid Pentest per assessment of one web application and its APIs, or US$650 and US$1,275 per month on 12-month continuous plans; every other scope is quoted. Indicative bands from our cost guides put a US network test at US$5,000 to US$40,000 and a standard Canadian internal network test at C$20,000 to C$35,000.

Related reading

• Top Penetration Testing Companies in Canada (2026), Ranked

• Top 15 Penetration Testing Companies in the USA (2026)

• Best Penetration Testing Companies for SOC 2 (2026)

• ISO 27001 Penetration Testing Requirements (2026)

• Social Engineering Testing Services (2026)

• Active Directory Penetration Testing Services (2026)

• Quebec Law 25 and Penetration Testing (2026)

Ready to scope a law firm penetration test?

The breach that ends in a client notice rarely starts at the firewall. It starts with a consent grant nobody reviewed, a help desk that resets a password for a convincing caller, or a portal that shows one client another client's documents. Stingrai is a CREST-accredited penetration testing service provider whose testing supports the evidence outside counsel guidelines, ISO 27001, SOC 2 and HIPAA programs ask for, delivered as a one-time annual engagement or as continuous coverage, with named penetration testers, retesting and an attestation letter. Book a free scoping call, get a quote for a firm-wide scope, or see the published package prices on the pricing page.