The challenge
A partner at Gulf Coast Legal clicked a convincing invoice email. Fortunately nothing was lost, but the firm realized it had no tested recovery plan, inconsistent multi-factor authentication and a cyber insurance renewal that would require both.
What we did
We deployed managed endpoint detection and response across 48 devices, enforced multi-factor authentication on email, remote access and the document management system, rebuilt backups with immutable off-site copies, and ran a tabletop exercise with the partners so everyone knew their role in an incident. Staff completed quarterly security awareness training with simulated phishing.
The results
- Cyber insurance renewal approved with no exclusions
- Phishing simulation click rate down from 23% to 4% in two quarters
- Full restore of the document management system tested in under four hours
Gulf Coast Legal has since referred two other firms to Osprey Harbor.