Phishing simulation for law firms
A phishing simulation for a law firm sends the lawyers and staff decoy emails that imitate requests typical of legal work, and measures who opened, clicked or reported. With PhishingU you can run it yourself from ₪999 per one-time campaign (up to 100 employees), in Hebrew and with a summary report.
Last updated: 19.10.2026 | Written and reviewed by the PhishingU team
* Setup in under 15 minutes, with no technical knowledge - one simple action is required from IT (allowlisting the sender), and launch is subject to a security review of up to one business day.
Why law firms are a phishing target
- A law firm holds clients' confidential information, so a single breached email may expose material that must be protected.
- Legal work is conducted by email with many external parties: clients, the opposing side, courts and authorities, so it is easy for an attacker to hide among real requests.
- Urgent requests from a manager or a partner are part of the routine, so a message that asks for quick action looks reasonable.
Three scenarios that suitlaw firms
The scenarios are general types of requests for practice, with no impersonation of a real brand.
What is measured inlaw firms
- Whether lawyers and secretaries open links in emails that look like shared documents or messages from office systems.
- Who reports a suspicious email to the office manager, and how fast.
- Whether the differences between partners, trainee lawyers and secretaries require different training.
How to prepare the team
- Coordinate with the partners and the office manager the date of the exercise and who receives reports.
- Announce in general terms that periodic exercises take place, without specifying a date.
- Plan a short training after the exercise that shows examples from legal work.
What you get at the end
A summary report with open, click and report rates, and a certificate of participation in awareness training. The certificate is evidence of training that helps meet part of the requirements of Amendment 13; it is not a confirmation of full compliance with a law or a standard. Payment is a one-time payment from ₪999 per campaign (up to 100 employees), with no subscription. See the The full price list.
Frequently asked questions
Why does a law firm need a phishing simulation?
Because the firm's employees receive many emails from external parties and hold confidential information. A simulation shows in practice who falls for typical scenarios and provides a basis for focused training.
Is it suitable for a small firm of a few lawyers?
Yes. The price is from ₪999 per one-time campaign, up to 100 employees, so even a small firm receives a full report with no subscription.
How do you handle the duty of confidentiality when running an exercise?
The exercise uses decoy emails and does not collect the content of real emails or client documents. We recommend checking with a legal advisor the need to notify employees and to regulate the exercise in the firm's procedures.