Breaches don't start as breaches.
They start as a normal email. A routine login. Something that felt fine at the time. By the time anyone questions it, it's already moving through your network.
Most orginazations don’t think anything is wrong.
Until they see how it actually plays out.
Where this starts to show up
This doesn't show up as an attack.
It shows up in ways that look completely normal:
A routine email with a link no one questions
Different people handling the same login slightly differently
Verbal confirmations that bypass written process
Approvals that felt right in the moment
Access that was never revoked after someone left
Individually, nothing seems off.
Collectively, it becomes hard to see what’s actually happening.
Most organizations don't notice the exposure.
Until they try to trace it back.
What I actually look at
Not policies.
Not what’s written down.
What actually happens.
How instructions move from one person to another.
How access is granted — and whether it's ever reviewed.
How decisions get made when something looks right.
Across emails, conversations, and day-to-day work.
Because that's where risk starts to build.
Not in the system.
In how the work is actually carried out.
I've spent over 30 years finding where breakdowns actually start, not where they're assumed to exist.
The Cyber Readiness Snapshot
The Snapshot shows how this actually plays out inside your organization.
Not how it’s supposed to work.
How it actually happens across people, emails, and day-to-day decisions.
What It Shows
It shows you:
• How security instructions are received and acted on
• How approvals are interpreted across different roles
• Where small variations start to appear
• How disbursement decisions actually move forward
Most firms use it to confirm things are consistent.
Some use it to uncover variation they didn’t realize was there.
Either way, you walk away knowing exactly how this actually operates inside your firm.
Firms this tends to show up in
• Multiple people are involved in moving settlement instructions
• Responsibilities are shared across attorneys and staff
• Communication happens across email, phone, and conversation
• Approvals rely on context, not just process
• Case volume is increasing and things move quickly
The question is whether it’s as consistent as it seems.
Most firms assume it is.
Until they take a closer look.
Clarifications for Leadership
Does this involve handling client data or financial accounts?
No. This work does not involve handling client funds, participating in trust account activity, or executing settlement disbursements. The focus is strictly on reviewing how these processes are performed internally.
Does this replace attorney oversight or responsibility?
No. Attorneys retain full responsibility for settlement handling, trust account management, and client obligations. The Snapshot is designed to support leadership visibility — not replace professional judgment or oversight.
Is this cybersecurity or IT-related work?
No. This is not a technical or infrastructure-focused engagement. The focus is on operational workflow — how settlement instructions, verification, approvals, and disbursement processes function across the firm.
Is this typically done after a problem occurs?
No. The Snapshot is designed to be non-intrusive. It involves leadership discussions and workflow review without interrupting case handling or client service.
What type of firms is this most relevant for?
This is most valuable for growing personal injury firms where settlement volume, staff coordination, and internal approvals have become more complex across teams or offices.
What This Is Not
This is not trust account management.
There is no involvement in handling client funds, executing disbursements, or participating in trust account activity.
This is not a replacement for attorney oversight.
All professional and ethical responsibilities remain fully with firm leadership and attorneys.
This Is not cybersecurity or IT-related work.
All professional and ethical responsibilities remain fully with firm leadership and attorneys.
A Brief Leadership Conversation
If maintaining operational discipline around settlement revenue as your firm grows is a priority, a brief leadership conversation is the best place to begin.
In this conversation we typically discuss:
• How settlement instructions move across staff and inboxes
• How verification and approval occur before disbursement
• Whether a Snapshot assessment would provide useful leadership visibility
Most firms requesting a conversation simply want confirmation that settlement safeguards are keeping pace with their growth.
Typical conversation: 15–20 minutes
Format: Phone or Zoom
Jeffrey Lyon brings more than 30 years of experience helping organizations strengthen governance, risk management, and operational discipline.
Lyon Advisory Group
Governance for Settlement Revenue Protection