This Week in Security: September 10, 2026

Security researchers this week published a technical breakdown of Active Directory Rights Management Services (AD RMS), the on-premises tool many firms still use, often unknowingly, to protect settlement agreements, medical records, and financial disclosures. The research maps exactly how an attacker could fingerprint a protected file and work toward the certificate that anchors the entire trust model.

Why this matters for your firm

This matters for a solo or small Florida law firm even without prior knowledge of AD RMS. Florida Bar Rule 4-1.6 requires reasonable efforts to prevent unauthorized access to client information, and a protection scheme nobody has reviewed in years does not meet that bar. Recommendation 25-1 goes further, calling for a documented cybersecurity assessment rather than an informal assumption of safety.

What to do this week

1. Confirm whether your firm's Microsoft environment actually runs AD RMS or a modern cloud alternative, and get that answer in writing.
2. Have someone independently review who controls the certificate the whole system depends on.
3. Document the review itself, so the firm has a defensible record rather than an undocumented assumption.

How ArisGate helps

ArisGate helps solo and small Florida law firms close exactly this kind of gap. Schedule a free security audit this week and find out what is protecting your client data, and whether it still can.