SESSION TOKENS ARE THE NEW PASSWORDS: WHAT LEGAL TECHNOLOGY LEADERS NEED TO KNOW
Identity security has moved well beyond passwords, and legal organizations still defending as if it has not are the most likely to find out the hard way, with client trust and professional obligations on the line.
By Vikram Chabra and Antonio Chelala
This article originally appeared in the November 2026 issue of Cybersecurity Law & Strategy. Read it here.
Attackers have largely stopped trying to steal passwords. They are stealing what a user receives after the password is typed in.
A password verifies identity at login. A session token is issued afterward so the user stays signed in. For law firms and corporate legal departments, that distinction matters. A stolen token is proof that authentication already happened. With it, an attacker can enter a document management system, e-discovery platform, client portal, or Microsoft 365 as the legitimate user, bypassing passwords, multifactor authentication, and standard alerts.
In 2025 alone, SpyCloud recovered 8.6 billion stolen cookies. For an industry built on confidential and privileged client information, this goes directly to a firm’s ethical duty to safeguard client data.
THE PROBLEM NOBODY BUILT DEFENSES FOR
Multifactor authentication proves identity before access is granted. It was never designed to protect what happens once the session begins. Many organizations, including firms that invested heavily in MFA to satisfy client security audits, have treated identity verification and session security as one problem. That conflation is where exposure begins.
Passkeys share the same blind spot: stronger at login, but no protection for the session that follows. They also add friction. Apple, Google, and Microsoft passkeys do not sync across platforms, and losing the device tied to one often means losing access entirely.
Attackers obtain session tokens through three main routes:
Infostealer malware on an infected endpoint quietly pulling cookies and saved credentials from the browser. A single compromised home computer used for remote work can be enough.
Malicious browser extensions often disguised as productivity, PDF, or citation tools that exfiltrate cookie data once installed.
Server-side web application vulnerabilities such as cross-site scripting, which AI-assisted tooling now finds and explains in seconds. One flaw in a client portal or cloud legal application can expose every connected user’s session at once.
Single sign-on raises the stakes. A token stolen from a federated identity provider can unlock every connected service, from document management to billing and litigation support, and long-lived sessions let that access persist. Firm credentials used for personal or third-party apps extend the risk to any breach at those services.
THE INVISIBLE BREACH
In most cases, token theft leaves no visible evidence. That has direct consequences for breach notification obligations, client reporting commitments, and incident response timelines.
Stolen passwords generate signals: failed logins, lockouts, triggered firewall rules. Replayed tokens produce none, because the system recognizes them as valid. An attorney opening Outlook and an attacker using that attorney’s stolen cookie look identical, and nothing gets flagged.
This is structural. Rules-based SIEM systems, which most security operations centers still depend on, catch known patterns such as failed logins and blocked IPs. A valid token replayed from a new location breaks none of them. Behavioral detection performs better, but separating stolen sessions from legitimate ones in real time still depends on correlating endpoint logs, location data, and activity timing, and error rates remain high.
Early detection is usually indirect: impossible-travel alerts or unusual activity spikes, such as a sudden bulk export from the document management system. Confirmation often comes from dark web monitoring, where stolen session data is eventually sold. That makes such monitoring an essential part of a modern legal security program.
WHAT ACTUALLY WORKS
Rotating tokens more frequently is not enough on its own. Effective protection requires layered, continuous verification rather than reliance on strong authentication at login.
Treat the browser as a risk surface. For most legal professionals, the browser is now the workspace: research, matter management, e-filing, and client collaboration all run through it. Organization-managed browsers can enforce cookie retention policies and harden against known extension-based attacks.
Invest in training and everyday habits. Firm credentials should never be used for personal accounts, and firm email should stay on firm-owned, monitored machines. A security partner can help design and enforce those policies across attorneys, staff, and contract reviewers.
Apply zero trust principles inside the identity stack. That means:
Short session lifetimes that require periodic reauthentication.
Device binding, so a token works only on the device it was issued to.
Continuous session validation throughout the session, not just at login.
Least-privilege, matter-based access that limits what a compromised session can reach.
Use deception technology. Mature security teams plant honeytokens, decoy session material with no legitimate use, so any attempt to use them trips an immediate, high-confidence alert. It is a well-established technique that gives firms a reliable signal where most others are ambiguous.
THE MATURITY GAP
The difference between legal organizations that detect token theft early and those that learn about it from the dark web is usually organizational structure, not budget.
A basic setup often relies on a single identity provider and treats offboarding as a checklist item: disable the account; remove the licenses. In a law firm, where lateral moves, departing associates, and rotating contract attorneys are routine, that approach leaves gaps. Delegated mailboxes, shared matter workspaces, and inherited permissions are frequently overlooked, leaving access paths that nobody is watching.
A mature organization integrates multiple platforms, cloud security tools, and SaaS-specific monitoring, backed by decommissioning checklists covering every system a user could reach, rather than relying on a single IT generalist.
The password was never really the prize; it was simply the easiest way in. Identity security has moved well beyond passwords, and legal organizations still defending as if it has not are the most likely to find out the hard way, with client trust and professional obligations on the line.
Reprinted with permission from the November 2026 edition of the Cybersecurity Law and Strategy Law.com Law Journal Newsletter © 2026 ALM Global, ALM Global Properties, LLC. All rights reserved. Further duplication without permission is prohibited, contact 877-256-2472 or [email protected].
