Law firm makes a stolen password useless by requiring the device, not just the user, to be known
A regional law firm. Outcome verified
The problem
A regional law firm knew that a stolen password, or even a stolen session token, could give an outsider access to client matters from any device. It wanted only firm-managed devices to reach its systems, without disrupting attorneys' daily work. The firm ran domain-joined PCs plus personal phones, and its small IT team had to own the solution afterward.
Why it mattered
Client confidentiality is the firm's core obligation, and cyber-insurance requirements were moving toward exactly this kind of device-based control.
What we did
Vizius scoped a four-week pilot instead of a firm-wide cutover. Access policies were built in report-only mode first, computers enrolled automatically through existing directory policy, phones enrolled through a company portal with IT approval, and exclusion groups were designed up front so exceptions could be tracked rather than improvised. Written guides and training let the firm's own IT staff run the rollout.
What changed
The pilot validated the policies on 10 test computers, resolved device-registration issues, and moved both conditional access policies from report-only to enforced. The firm began a user-by-user rollout with its own staff.
- Legal and professional services
- Unknown company
- Cyber insurance requirements