Notifications
Clear all
Topic starter
12/07/2026 12:19 pm
TL;DR: Law firms faced a 74% rise in cyberattacks in 2024, with 954 incidents and an average breach cost of $4.88 million per organisation, according to the source article. In practice, SSL/TLS and broader PKI are less about branding and more about protecting client data, preserving trust, and reducing exposure in digital legal workflows.
NHIMG editorial — based on content published by GlobalSign: SSL/TLS and PKI for law firms in a digital environment
By the numbers:
- According to the source article, cyberattacks on law firms rose 74% in 2024, reaching 954 incidents.
- According to our Ultimate Guide to NHIs, 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
Questions worth separating out
Q: How should law firms govern SSL/TLS and PKI across client-facing systems?
A: They should govern certificates as lifecycle assets with named owners, defined issuance criteria, renewal monitoring, and revocation procedures.
Q: Why do certificate outages create identity governance risk instead of just downtime?
A: Certificate outages create identity governance risk because the certificate is what allows systems to trust each other.
Q: What breaks when certificate lifecycle management is still manual?
A: Manual certificate management breaks at the point where expiry, ownership, and renewal do not line up.
Practitioner guidance
- Map all certificate-bearing assets Build an inventory of every legal portal, subdomain, email domain, and document-signing service that relies on SSL/TLS, S/MIME, or PKI-backed trust.
- Automate certificate expiry and revocation controls Replace manual renewal tracking with monitoring that flags expiring certificates, orphaned subdomains, and revoked trust chains before service interruption or impersonation risk appears.
- Treat signing and email certificates as privileged credentials Classify document-signing certificates and S/MIME identities as privileged trust assets with clear issuance, approval, and offboarding steps.
What's in the full article
GlobalSign's full article covers the operational detail this post intentionally leaves for the source:
- Guidance on choosing between domain validation, organisation validation, and extended validation for legal-sector websites.
- Examples of how S/MIME and document-signing certificates support confidential email and legally binding digital signatures.
- Practical considerations for managing multi-domain certificates across multiple subdomains and legal properties.
- The article's own discussion of renewal monitoring and certificate handling for firms without automation.
👉 Read GlobalSign's guidance on SSL/TLS and PKI for legal-sector trust →
SSL/TLS for law firms: what matters for trust and data protection?
Explore further
12/07/2026 12:33 pm
Certificate governance is a lifecycle problem, not a web security checkbox. Law firms often treat SSL/TLS as a deployment task, but the real risk sits in issuance, renewal, scope, and revocation. A certificate that is valid but mis-scoped, forgotten, or attached to the wrong service creates a trust gap that attackers can exploit. For legal teams, the governance question is who owns the certificate lifecycle and how exceptions are handled before exposure occurs.
A question worth separating out:
Q: Who is accountable for PKI risk when legal data moves through portals and email?
A: Accountability should sit jointly with security, infrastructure, and the business owner of the workflow, because PKI controls identity, transport trust, and service availability at the same time. If those responsibilities are split, renewal failures and revocation gaps tend to fall between teams.
👉 Read our full editorial: SSL/TLS and PKI are becoming legal-sector trust controls
