Most managing partners assume the first-year associate and the new paralegal know how to stay safe on a phone. They grew up with one, after all. Nobody checks, and it’s an easy assumption to make.
Kaspersky surveyed 7,200 people in 18 countries in March 2026 and published the results on July 24. Among Gen Z respondents, 59% said they feel confident online, but only 28% rated their own digital skills as advanced. Just 27% use antivirus on their mobile devices, which Kaspersky says is considerably fewer than other generations (it doesn’t publish the comparison figure). And 52% have already had a device, an account or some data attacked.
Kaspersky sells security software, and none of the 18 countries is the US. I’d read the survey as a signal and not a ruling. It still points at a gap your firm should look at.
The phone is where client information sits
Say a paralegal is at lunch when a sign-in request for firm email lands on their phone. It looks like the ones they approve every day, so they tap it. That one tap hands an attacker the mailbox.
That mailbox holds client email and attachments. The phone also has Teams messages about open matters and, for many firms, a practice management app such as Clio. In most firms it’s a personal phone that nobody set up for work, and the paralegal alone is responsible for protecting it. Only 28% of Gen Z respondents regularly back up the important data on their phones.
When this comes up in conversations with other firm owners, the instinct is usually to get everyone to install an antivirus app. I’d skip that. An app on a personal phone belongs to the employee, and the firm has no way to see whether it’s installed or running. The protection that matters is the kind the firm controls.
The duty of confidentiality doesn’t exempt personal devices. ABA Model Rule 1.6(c) calls for reasonable efforts to prevent unauthorized access to client information. California firms reach a comparable duty through Rule 1.1, Business and Professions Code section 6068(e) and State Bar Formal Opinion 2010-179, though the rule structure is different. If the firm’s answer to how client email is protected on that phone is that you trust the paralegal, a bar inquiry or an insurance questionnaire will find the gap.
What I would do
If your firm already requires a passcode on work phones, that’s a good start. Next, cover every phone that touches firm email. Require a passcode and encryption on each. Turn on multi-factor authentication (MFA) with number matching, so a sign-in request can’t be approved without typing in a number shown on the login screen. It works like the second signature on a trust account withdrawal: a stolen password isn’t enough by itself.
After that comes mobile device management (MDM), software that lets the firm manage work data on a phone without touching anything personal. Firm email and files sit in a protected space on the device. When a contract attorney’s matter closes or a paralegal leaves, you remove firm data the same day and their personal data stays untouched. Old employee logins are where most firms fall behind on offboarding.
Training should cover everyone, partners included. Partners usually hold the widest access, so they belong in the room.
You can phase all of this. Phones first, training next, in whichever order fits the firm’s calendar. That part is up to you.
If your insurer, a client or the bar asks how client email is protected on phones, the answer should already be written down. Our managed IT services for law firms can set up MFA and device management and document the setup so you have that answer ready.