While You're Out of Office, They're Just Getting Started
If you run a law firm, a long weekend does not lower your risk. It
exposes where your coverage actually stops.
Your attorneys are offline. Your office is quiet. But your systems are
still active. Client files are still accessible. Remote logins are still
accepted.
The question is not whether something happens.
It is whether anyone sees it fast enough to matter.
Most firms assume they will.
That assumption is where the problem begins.
Where This Actually Breaks
This is not about having the "right tools."
It is about what happens when those tools produce a signal at 1:12 AM on
a Saturday.
We routinely see firms with good software and weak response:
- Alerts exist
but go to an inbox no one checks
- Accounts stay
active longer than they should
- No one is
clearly assigned to act after hours
- "IT support"
starts when Monday morning tickets come in
That is not a security gap.
That is a timing failure.
And timing is what attackers use.
Real Example: What Happens Over a Holiday Weekend
This is not theoretical.
In one law firm we worked with, the issue started exactly this way:
Friday, late afternoon
A contractor finished work earlier that week. Their account was never
removed.
No one noticed. No one reviewed access before closing.
Saturday, early morning
Several failed login attempts hit the firm's remote system.
Eventually, one attempt succeeded using a dormant account.
Detection did not happen immediately. Alerts were configured, but they
were routed to email.
No one saw them.
Sunday
The attacker moved quietly:
- Checked file
access
- Touched shared
folders
- Identified
higher-permission accounts
Still no response.
Monday
The issue surfaced as "something isn't working."
Detection took too long.
Now the firm was not preventing risk. It was reacting to damage.
Nothing about that scenario required advanced techniques.
It required one thing that was missing: active coverage when no one was
in the office.
If This Happens Saturday Night, Here's What Should Happen Next
The first 15 minutes matter more than the next 48 hours.
If a suspicious login or abnormal activity occurs, response should look
like this:
- Disable the
account immediately
- Terminate all
active sessions tied to that user
- Check for
additional logins from new locations
- Review recent
activity for lateral movement (files, systems, permissions)
- Flag any
privilege escalation attempts
- Notify the
designated escalation owner
- Begin
documented incident tracking
This is not overreaction.
It is containment.
Waiting for "confirmation" before acting is what turns a simple issue
into a firm-wide problem.
Basic After-Hours Response Playbook (Law Firms)
Make this usable without interpretation.
Suspicious login activity
- Verify whether
the user is actively logging in
- If not
confirmed immediately, disable access
- Require
password reset and review recent activity
Abnormal file behavior
- Identify the
user and device involved
- Isolate the
device from the network
- Review file
access patterns and changes
Unknown admin or privilege change
- Revoke elevated
access immediately
- Audit admin
logs for related activity
- Escalate for
full review
Multiple failed login attempts
- Trigger alert
after defined threshold
- Block the
source or lock account temporarily
- Confirm with
user if attempts were legitimate
If your team cannot run through these steps without discussion, the
process is not ready for after-hours reality.
The Minimum You Need Covered Before Any Long Weekend
At minimum, your environment should meet these conditions:
- Login activity
is monitored continuously, not just recorded
- Multi-factor
authentication is required for all remote access
- Inactive
accounts are removed quickly and consistently
- Alerts are
routed to a system that is actively monitored
- Admin access is
limited and reviewed
- There is a
defined response owner outside business hours
These are baseline controls aligned with widely accepted standards like
NIST and CIS.
You do not need to know those frameworks in detail.
But your environment should behave like they expect.
Bad vs Good: What This Actually Looks Like
Area
Weak Setup
Covered Setup
Alerts
Sent to inbox only
Reviewed by a 24/7 monitored system
Access
Old accounts remain active
Accounts removed immediately when no longer needed
Monitoring
Logs stored but not reviewed
Suspicious activity flagged and investigated in real time
Response
Wait for user complaints
Immediate action within minutes
Ownership
No clear after-hours owner
Defined detection, response, and escalation roles
This is the difference between "we have security" and "we are actually
protected."
The Outside Lens: What an Auditor Would Ask
If a cyber insurance reviewer or external auditor looked at your firm,
they would not ask what tools you bought.
They would ask:
- Who sees alerts
at 2 AM?
- How fast are
they reviewed?
- Who can act
immediately?
- How quickly are
unused accounts removed?
- What happens
between detection and containment?
If those answers are unclear, your risk is not hidden.
It is documented.
2-Minute Exposure Test
Answer these without guessing:
- Who is watching
your systems tonight?
- Where do alerts
go, and who sees them?
- How long before
someone takes action?
- Who can disable
access immediately?
- When were
inactive accounts last reviewed?
If those answers are slow or uncertain, your exposure is operational, not
theoretical.
What To Do Next Week
Do this before the next long weekend approaches:
- Review all
active accounts (especially vendors and contractors)
- Confirm
multi-factor authentication on every remote login
- Test where
alerts actually go and who receives them
- Define one
person responsible for after-hours response
- Walk through a
real Saturday night scenario as a team
This is not a major project.
It is clarity.
And clarity is what closes the gap.
The Goal
You are not trying to become an expert in cybersecurity.
You are trying to ensure your firm does not depend on luck when no one is
in the office.
Because that is when problems are tested.
Quietly.
And quickly.
Schedule your 10 minute discovery call with 911 IT.
We'll walk through what actually happens in your firm after hours — who sees
alerts, how fast they're handled, and where gaps exist.
You'll leave knowing if this risk applies to you and what to fix before the
next long weekend.
