Privilege survives
the breach.

Because the threat model that targets law firms is no longer opportunistic. The 2016 Panama Papers leak (Mossack Fonseca, 11.5 million documents), the 2017 DLA Piper NotPetya outage and a continuous stream of ransomware incidents against AmLaw 100 and AmLaw 200 firms (Campbell Conroy & O'Neil 2021, Bryan Cave 2023, Orrick 2023, several 2024 incidents covered by Reuters and Bloomberg Law) all reinforce that mid-to-large firms are a deliberate target. ABA Formal Opinion 477R imposes a duty of competent communication of client information, Formal Opinion 483 imposes a duty to take reasonable steps to monitor for and respond to breaches, and Formal Opinion 498 (March 2021) extends those duties to virtual practice. An independent pentest produces the evidence that the firm exercised reasonable care — the standard the bar, the malpractice carrier, and the client outside-counsel-guideline (OCG) review all apply.

Three layers. First, the engagement is run under a written ethical wall — the test team has no exposure to live matter content, and all reproduction artefacts are redacted to hash-references rather than document bodies. Second, where reproduction of an authorisation flaw requires accessing a matter folder, we use a test matter seeded with synthetic privileged-looking content, not real client work product. Third, the master services agreement is structured so AxVeil is engaged through the firm's general counsel or managing partner under the work-product doctrine where US jurisdictions allow it, mirroring the Kovel arrangement firms use with forensic accountants. Reports are marked confidential and attorney-work-product where US-applicable; for India practice the agreement carves out the Bar Council of India Standards of Professional Conduct rule 24 confidentiality obligation explicitly. No live matter content leaves the firm's environment.

The M&A practice is treated as a sub-engagement with its own threat model. We exercise the deal-room platform (Datasite, Intralinks, Ansarada, SecureDocs, Firmex or in-house) for IDOR / BOLA on document IDs, watermark-stripping bypass, expired-link revocation lag and viewer-vs-downloader privilege escalation. We exercise the M&A team's endpoints under an assumed-breach mandate — Cobalt Strike / Sliver beaconing from a phished partner workstation, lateral movement against the file shares hosting due-diligence rooms, the iManage / NetDocuments / SharePoint matter store, and the time-and-billing system. We exercise the email surface for partner-impersonation BEC against the deal counterparties. The output is a deal-room hardening backlog plus a tabletop walking the partners through a ransomware-during-signing scenario — the incident class that has cost firms eight-figure remediation and reputational damage in the public record.

We treat the e-discovery custody chain as a single end-to-end system rather than a vendor questionnaire. The engagement walks the data from collection (forensic image, custodian self-collect, cloud-API collection via Microsoft 365 Compliance, Google Vault, Slack Discovery API), through processing and hosting (Relativity, Reveal, DISCO, Everlaw, Logikcull, Nuix), through review (privilege review workflow, redaction, production set assembly) and through production (Bates-stamped export, transfer to opposing counsel). At each handoff we test custody-chain integrity — cryptographic hash chain, write-once storage, access-log immutability — and the vendor's tenant-isolation posture. For matters in scope we run a control walk against the vendor's SOC 2 Type 2 report (CC6 logical access, CC7 monitoring, CC8 change management) and any ILTA LegalSEC self-attestation, and we exercise the vendor's review portal against the OWASP API Top 10 with credentials issued at every role (reviewer, admin, opposing-counsel guest). The deliverable is a per-vendor risk register the firm uses for OCG responses and for client custodial-letter exhibits.

The engagement is structured against the Bar Council of India Standards of Professional Conduct and Etiquette (Section 49(1)(c) Advocates Act 1961) rule 24 confidentiality duty, the Information Technology Act 2000 sections 43A (reasonable security practices for sensitive personal data) and 72A (penalty for disclosure of information in breach of lawful contract), the Digital Personal Data Protection Act 2023 and the 2025 Rules where the firm acts as Data Fiduciary for client personal data, and the CERT-In 6 April 2022 directions on six-hour incident reporting. Where the firm services foreign-listed corporate clients we additionally map to the client's outside-counsel guideline obligations under ABA 477R / 483 (US clients), the EU CCBE Code of Conduct (EU clients), and the Solicitors Regulation Authority Code (UK clients). The report appendix gives the General Counsel a control-by-control mapping suitable for forwarding to the bar council or regulator without exposing matter content.