Ari Kaplan recently spoke with Edward Chick, the chief revenue officer at NopalCyber, a managed security services provider that offers outsourced cybersecurity support while seeking to democratize enterprise-level security for law firms and organizations in other sectors.

They discussed best practices to help law firm leaders identify cyber threats, mistakes that they are making with their cybersecurity protocols, how often they should test and update their cybersecurity procedures, and where to leverage artificial intelligence and machine learning to enhance cybersecurity.

Ari Kaplan: Tell us about your background and your role at NopalCyber.

Edward Chick: I have been in high-tech software and services for decades. I’ve worked with SAP, IBM and Oracle. Additionally, I have experience with smaller companies, including startups, and I have successfully helped them establish a stronger presence in the marketplace. I’m passionate about assisting customers in leveraging technology and services to enhance their operations.

Ari Kaplan: What makes NopalCyber’s method of identifying and prioritizing internal and external threats unique?

Edward Chick: Cybersecurity is sometimes not seen as important as it truly is because it operates behind the scenes. Many individuals using technology or engaged in business assume that others are managing these aspects. At NopalCyber, we have observed that a lot of complexity leads organizations and business executives to categorize it as an IT issue. Therefore, our business goal is to democratize cybersecurity, making it more accessible and bringing it to the forefront of business leaders’ awareness. We aim to collaborate with IT professionals to provide them with the support and resources necessary to achieve greater success. We serve multiple industries and possess decades of experience in the legal sector and many others. What we’ve observed is that the battle continues and is becoming more severe. The value we provide is our tech stack neutrality; we work with technologies that organizations have already invested in, often heavily. Many of these technology platforms come with built-in tools, like those from Microsoft or AWS. On average, organizations use about 30 different cybersecurity-related protection tools. These organizations may encounter thousands of alerts and alarms daily, facing a ‘needle-in-a-haystack’ challenge to identify the most critical issues. They must find ways to resolve these problems and take proactive measures to prevent them from occurring. There is enormous pressure on IT, especially in the United States. At NopalCyber, we bring both expertise in the particular industries these companies operate in, such as legal, and the resources to work with all the various technologies they are employing, thereby supplementing and strengthening their security posture.

Ari Kaplan: Which assets are most critical for law firms to protect?

Edward Chick: Absolutely everything. We begin by helping individuals become more savvy in protecting their interactions with technology, such as passwords. However, many bad actors are also targeting website applications or platforms or underlying data to gain access to something valuable. In business, there are two key areas of truth: the accounting systems and the contracts they manage. These represent formal areas of substance, with legal practitioners overseeing one-half of that. The bad actors are aware of this and see legal activities as potential targets. We’ve noticed that midsize law firms often lack sufficient protections. Insurers recognize this and the cost of cyber insurance, especially in the legal field, is quite high while coverage is actually declining, meaning you pay more for less. One of NopalCyber’s added values is our ability to strengthen these companies’ postures, which can help reduce cyber insurance costs and provide better protections from insurers. Another critical factor involves regulators. Even if a specific company is not heavily regulated by, for example, the SEC, the customers they work with may be subject to regulations. Over the past six months, we’ve seen an increasing requirement from the SEC for companies to enhance their compliance. They now have a duty to report any concerns. In the legal field, because lawyers collaborate with other firms, they engage in a community of activity related to specific matters or contracts, potentially involving participants who are heavily regulated. Naturally, insurance companies are aware of this and heighten exposure due to the regulators mandating protections that the insurance companies are then expected to cover. This creates a network of interlocking dependencies, and at NopalCyber, we can significantly assist in strengthening the postures of these companies, allowing them to achieve a more favorable cost structure from their insurers and, of course, adhere better to the regulators’ requirements.

Ari Kaplan: What mistakes are law firm leaders making with their cybersecurity protocols?

Edward Chick: They’re often taking it for granted. These are competent professionals with expertise in their field, and they reasonably assume that IT has this under control. However, the fact is that IT is under tremendous pressure; the bad guys are constantly changing their strategies and tactics. We also often notice that general counsel and legal practitioners don’t offer their assistance frequently enough. They could take a leadership position by regularly reaching out to IT and asking, “How can we help? How can I prioritize the risks associated with the particular tools I’m using? How can I provide you with more information about my business activities to give IT and your chief security officers better visibility into what’s important for the business?” We’ve seen that this leadership fosters prioritization regarding budgets, costs and awareness of regulatory exposures.

Ari Kaplan: How often should law firms test and update their cybersecurity procedures?

Edward Chick: Definitely not once a year. Companies conduct annual penetration tests on their platforms or specific applications, for example, but that’s not really good enough. We’ve seen organizations increase the frequency to quarterly or even monthly. Our position is that all these aspects should be inspected 24/7. The bad guys aren’t waiting for an annual opportunity to act. Consequently, the exposures are permanent and require full-time attention. Legal professionals can play a very helpful role in drawing attention to this issue and ensuring that they stay up to date. They are trained to follow protocols for even simple tasks, like changing passwords. It is extraordinary how people take these matters for granted, and everyone assumes that someone else will be impacted, which is simply not the reality. It’s similar to any good business practice. The teams are in alliance with the rest of the organization they support; if leadership recognizes this and provides support to the individual security teams, then everyone benefits. At NopalCyber, we offer complementary services to organizations. We can manage the entire security environment for an organization or complement and support the various teams they may have in place. We view this as a proactive security posture, enabling us to identify issues before they arise because we can see much more than an individual firm might perceive. We play a critical role in providing early warnings about things they might not be aware of from an offensive security perspective, and we can provide the necessary assistance for defense. Some organizations are uncertain about their security standing, and we help them gain clarity on their position. We conduct something called “attack surface discovery,” which produces an analysis from an outside-in perspective without any privileged access to show what an organization looks like from a potential hacker’s viewpoint. We can share those results, and when we do engage, we leverage the tools they already have while streamlining all the alerts into a single ‘pane of glass.’ With our reporting tool, Nopal360, we make this accessible on desktops and mobile devices 24/7. The best practice is to always have these protections in place, maintain awareness of potential attack sources, and act quickly and effectively. Legal professionals who understand their own personal liability as lawyers, as well as the company’s exposure from a risk management standpoint, can be immensely helpful allies in this overall strengthening of security posture.

Ari Kaplan: How can legal organizations utilize artificial intelligence and machine learning to strengthen their cybersecurity?

Edward Chick: Virtually every law firm and legal practitioner worldwide is now aware of the benefits of various AI tools. I entered this space relatively early at IBM, engaging with legal applications using Watson over a decade ago, and I have seen remarkable results. Major benefits arise from leveraging AI, and the pace of advancement is accelerating; however, it also introduces certain risks. Malicious actors are using AI for hacking and exposing various cyber vulnerabilities. Moreover, employing AI often involves integrating data from large language models or utilizing third-party tools, which may require inputting sensitive information into these external systems that may not be entirely secure. Since lawyers and legal practitioners play an incredibly important role within an organization, they inadvertently raise risks associated with the use of AI, as these systems are often federated and rely on tools and data sources from outside to achieve business results, potentially exposing them to further risks. A key part of our mission at NopalCyber is to strengthen this posture and instill confidence in legal practitioners, so they can reap the benefits of these new tools while ensuring they do not create additional vulnerabilities. Our stance is to engage with these new innovations enthusiastically, embrace the benefits they offer—but with a vigilant awareness of cybersecurity realities.

Ari Kaplan: How does focusing on cybersecurity enable law firms to foster innovation?

Edward Chick: This will enable them to be more experimental and try various approaches. They should view cybersecurity exposure as a crucial aspect of engaging in innovation. Cybersecurity is essential to ensure that you’re prepared to embrace new innovations.

Ari Kaplan: How do you see cybersecurity evolving?

Edward Chick: It’s constantly changing every day, every hour, and trying to handle all this by yourself is truly challenging. The bad actors recognize that midsize firms don’t have the resources to manage this effectively. Our business value proposition is to assist those organizations in achieving a stronger security posture in a cost-effective manner that they would typically be unlikely to accomplish on their own, allowing them to focus on their core business. They should concentrate on what they excel at. Another critical aspect is engaging with their clients. It’s a good practice to initiate discussions with clients by stating that everything they’re going to do for that client incorporates cybersecurity awareness. Legal practitioners often lack knowledge about cybersecurity and don’t address it. However, if they become more informed and bring it up during their client interactions, we’ve seen that it significantly enhances engagement. It fosters trust, which is essential in the legal community. We see our role as helping organizations strengthen their relationships with customers, especially when acquiring new clients, as well as enhancing the existing portfolio of customers, some of whom they’ve served for decades. We’ve observed an engagement model where they reconnect with their clients and present the realities of cybersecurity in a way that they haven’t done before it resonates very well. This is part of a broader customer care journey and is quite powerful.

---

Listen to the complete interview at Reinventing Professionals.

Ari Kaplan regularly interviews leaders in the legal industry and in the broader professional services community to share perspective, highlight transformative change and introduce new technology at his blog and on iTunes.

---

This column reflects the opinions of the author and not necessarily the views of the ABA Journal—or the American Bar Association.

Ari Kaplan recently spoke with Lynn Tubalinal, the director of litigation support at Dykema, and Julia Voss, the director of litigation support and e-discovery at UB Greensfelder.

Both are among the industry leaders who contributed to the recently published report Advancing Litigation Support to Fuel Growth in a Changing Legal Market, supported by Opus 2.

They discussed the effect of the increasing volume and variety of data, how a team knows that it is time to upgrade its technology, successful strategies for driving adoption, and effective generative artificial intelligence use cases.

Ari Kaplan: Tell us about your background and your current role.

Lynn Tubalinal: I started my career as a paralegal and leveraged my technical background into a litigation support role. I began to lead teams at Sidley Austin, where I spent eight years, and three and a half years ago, I moved to Dykema.

Julia Voss: I am an antitrust litigator turned e-discovery professional. Twenty years ago, I had one of the more significant cases in the firm, while the Federal Rules of Civil Procedure were changing. I was tasked with figuring it out and then started teaching my peers about those developments. So in 2014, when the firm decided that a lawyer should lead litigation support, they asked me to move into that role. I have been the director of litigation support and e-discovery for 11 years.

Ari Kaplan: Did anything in the Advancing Litigation Support to Fuel Growth in a Changing Legal Market report surprise you?

Lynn Tubalinal: What is really surprising to me, and it’s not necessarily related to the content overall, is that we are all going through the same issues and figuring this out as we go. In these roles, you tend to feel like you’re on an island and don’t hear about what everyone else is experiencing until you begin talking to them. In this fast-paced industry, we don’t always get to speak to one another and connect. Through these reports, I could relate to the perspectives of my peers and identify strategies that could work for us internally and as an industry.

Ari Kaplan: One theme in the report was the increasing volume and variety of data. What effect do you expect this trend to have?

Julia Voss: The growing data volumes are driving more litigators to realize they need a technical solution to manage their dockets. When they had small cases with a few hundred documents, they could manage, but that is no longer possible. The variety of data is the most complex issue today because many different data sources are available. Every day it seems as if there’s a new app or an update to the phone or Microsoft. Litigation support professionals are constantly chasing updates and developing new methods for collecting data. There was a time when we felt like we knew e-discovery because we could effectively collect emails. Then Teams came along, followed by Slack and then WhatsApp, and now, it feels like a never-ending cycle of chasing the newest app.

Ari Kaplan: What advice would you offer to others who are managing these changes?

Lynn Tubalinal: Don’t get overwhelmed. We are all going through this at the same time. Identify what works best for your team. Meet with your peers, and discuss specific issues, like processing unique data types and learn which solutions you can offer to the case team. It is typically not a single solution. You may need different applications for some instances, such as those with modern attachments. We focus on understanding the case team’s challenges to help develop a holistic strategy, rather than solely provide technical support. They are our internal clients, and we need to help them communicate more effectively with the firm’s external clients. It can really be easy to get overwhelmed because there are many different data types, and you will not be the expert on everything, but rely on those who are the experts and get information from them.

Ari Kaplan: Outdated technology, specifically case management, was another theme in the Advancing Litigation Support to Fuel Growth in a Changing Legal Market report. How do you know when it’s time to explore a new solution, and what are your tips for others as they select new applications?

Julia Voss: You start to realize it might be time to look at a new solution when people aren’t using the one you have or there is better technology that can provide more support. Focus on listening to the people around you to understand their evolving needs better. The hardest part of exploring a new solution is finding people with time to test the options and help determine the best way to move forward, especially with all the technology available due to developments in generative AI. With many things changing at once, you need a group of people who understand what your technology is doing and what a new product could improve.

Ari Kaplan: Does outdated technology contribute to a lack of adoption?

Lynn Tubalinal: Litigation support teams must always balance the use of outdated technology with the cost of moving to a newer, faster and better solution. Getting teams to buy into that upgrade can be a challenge. As technologists, we are enthusiastic about improving our tools, but cost, adoption and other variables factor into the ultimate decision to change.

Ari Kaplan: What strategies have been successful in encouraging adoption in your firm?

Julia Voss: Presenting the attorneys with the benefits instead of highlighting features alone is essential. The most effective strategy is to begin with a small team that pilots the application and presents the results to influence adoption. Once users see results, they are more likely to take advantage of the new tool.

Ari Kaplan: Generative AI has been and will continue to be a hot topic. How are you using AI in your firm, and what have you learned from your experiences so far?

Lynn Tubalinal: There are different types of AI, not just generative AI, and we have been utilizing more traditional AI in our workflows for years. We just purchased a generative AI component for our e-discovery document review platform and are excited to deploy it. I’m trying to identify my champions, who can use it in their matters and provide honest feedback. Most lawyers want to see results, rather than the nuts and bolts of how the technology works. Based on the impressions of generative AI that I have heard, everybody’s waiting to see what others are doing. Nobody wants to be behind the curve, and we want to adopt it, but we’re cautiously treading into the arena.

Julia Voss: We have also been using different kinds of AI for a long time, but generative AI is the obvious new shiny toy. We had been testing generative AI in our document review platform for a few months and are starting to expand access to grow adoption. For resources and training, we need to persuade the professionals on our team to allocate the time to update their skills using generative AI products, so that the great people we have can continue to help the legal teams move forward.

Ari Kaplan: What is your team doing in 2025 to maintain its competitive edge?

Lynn Tubalinal: Ensuring that the talent that we have can utilize our full suite of tools and be our champions. Education and marketing are paramount. I spent much of 2024 marketing my team because not everyone fully understands what we do. My team is just trying to get the work done but may not necessarily know how to market the team while they are supporting others. I have been working on that internally by encouraging more direct support, such as a phone call over an email or Teams chat. We are moving back to basics to better showcase our talent and capabilities.

Julia Voss: What didn’t surprise me about this report is that we’re all trying to do some of the same things. We are internally rebranding our group as the data intelligence team. We are showcasing the skills of our technologists and e-discovery counsel to raise their profile and highlight where they can provide support, so the trial teams can focus on the merits of their cases.

Listen to the complete interview at Reinventing Professionals.

Ari Kaplan regularly interviews leaders in the legal industry and in the broader professional services community to share perspective, highlight transformative change and introduce new technology at his blog and on iTunes.

---

This column reflects the opinions of the author and not necessarily the views of the ABA Journal—or the American Bar Association.

Ari Kaplan recently spoke with John Marshall, the CEO, and Dan Quintas, the head of legal solutions at Airia, a generative artificial intelligence platform for law firms and other organizations.

They discussed the hurdles that firms face in adopting AI, their progress, common mistakes that legal teams make when deploying generative AI, and how to keep up with rapid technological changes.

Ari Kaplan: Tell us about your background and the genesis of Airia.

John Marshall: I have been in enterprise software for 30 years, focusing on solutions that serve as the back-end infrastructure solutions to business problems. One example is AirWatch, a mobile device management company where we worked closely with Apple and helped companies roll out mobility at scale. At AirWatch, we enabled technology deployment across firms of all sizes, integrating systems like email, documents and certificates. After selling AirWatch to VMware, I co-founded OneTrust, which focused on enterprise privacy, GDPR compliance and consent management. When AI emerged into the mainstream, I created Airia because I anticipated similar challenges as we saw with mobility in that AI is powerful but needs infrastructure that is secure, integrated and easy for end users to adopt. Our experience uniquely positions us to provide the enabling technology that law firms need to optimally leverage AI.

Ari Kaplan: Tell us about your background and the unique aspects of legal that appeal to Airia.

Dan Quintas: I started my career at AirWatch and later moved to OneTrust. Like other sectors, legal services face a broad AI adoption spectrum driven by the complexity of the use cases. Currently, the focus is on document-driven applications, which is a sweet spot for AI adoption. Document-heavy workflows naturally benefit from AI-driven efficiencies, particularly in discovery and contracts.

Ari Kaplan: What hurdles must law firms and legal organizations overcome to fuel AI adoption?

John Marshall: The first hurdle is getting started. Many firms already use AI without realizing it through tools like Microsoft Copilot or integrated AI features in more extensive legal tech solutions. The following two obstacles are fear and uncertainty associated with security and governance. I recommend starting small with public information use cases, like document comparison or caselaw research. By beginning with low-risk tasks, firms can see the benefits of AI without overwhelming security concerns.

Ari Kaplan: How much progress have law firms made in leveraging generative AI?

Dan Quintas: We are seeing impressive progress, especially among early innovators in the legal space. While some firms are experimenting with AI to gain a competitive advantage, others use tools like Copilot for specific use cases. However, most firms are still in the early majority phase, looking for high-value applications they can confidently roll out to their professionals. This group needs the most guidance in identifying the best use cases and developing a robust AI strategy.

Ari Kaplan: What mistakes are legal teams making in their deployment of generative AI?

John Marshall: I would not call them mistakes. Rather, they are learning opportunities. Firms should avoid putting their heads in the sand and instead take small, calculated steps to experiment and learn. The worst error is inaction. Much like others, the legal industry will see rapid adoption as AI becomes a standard tool. As I often say, you will not lose your job to AI but to a colleague who uses AI.

Ari Kaplan: How can people keep up with the rapid changes in generative AI?

Dan Quintas: It is overwhelming to track all the developments in AI. With new models and updates arriving regularly, businesses must understand how these changes affect them. The key is partnering with the right tools and platforms focusing on AI, combined with a clear strategy from leadership. Our mission at Airia is to make AI accessible to everyone, helping firms stay ahead of these advancements.

Ari Kaplan: How do you see the future of AI evolving in legal?

John Marshall: The legal industry is competitive, and no firm wants to be left behind. AI adoption will increase because of its competitive advantage—from faster processes to more accurate outcomes. We will see the adoption of generative AI start with simple tasks, like discovery or caselaw research, but eventually, tasks will be combined in more complex workflows. Law firms will likely use a variety of domain-specific and regional AI models, tailoring them to their needs, which will lead to an exciting evolution in the ecosystem.

---

Listen to the complete interview at Reinventing Professionals.

Ari Kaplan regularly interviews leaders in the legal industry and in the broader professional services community to share perspective, highlight transformative change and introduce new technology at his blog and on iTunes.

---

This column reflects the opinions of the author and not necessarily the views of the ABA Journal—or the American Bar Association.

Widely hated by lawyers and clients alike, the billable hour has nevertheless proven to be more resilient than cockroaches, Twinkies and those nonbiodegradable containers that you used to get fast-food restaurants.

It seems like every time that there’s a major disruption or event that threatens to upend the legal industry, it spells doom for the billable hour. But that could be more out of hope than anything else. The billable hour survived the Great Recession and the COVID-19 pandemic, despite many people thinking—or maybe wishing—that it wouldn’t.

But with the advent of generative artificial intelligence tools that can perform tasks in minutes but might take lawyers or legal professionals hours, could we finally see the end of the billable hour?

In this episode of the Legal Rebels Podcast, Reid Trautz, a senior director of the Practice and Professionalism Center at the American Immigration Lawyers Association, talks to the ABA Journal’s Victor Li about the thing that so many lawyers and clients love to hate but can’t seem to quit. They discuss the billable hour and how AI might—or might not—affect it.