Bank of America’s reported hiring of 1,000 contractors to help repair software vulnerabilities exposed by advanced AI offers law-firm owners a practical warning: discovering a weakness is only the beginning. Someone still has to assess it, address it, and verify that the fix works.
That work affects more than IT. A firm’s ability to protect information and maintain access to its systems influences client service, revenue, business continuity, and trust.
The banking story also provides a useful way to think about risk. A lender depends on a borrower’s ability to keep operating and repay its obligations. A client depends on a law firm’s ability to keep working and protect sensitive information. Cyber disruption can interfere with both relationships.
What happened at Bank of America?
According to The Next Web’s October 15, 2026 report on Brian Moynihan’s comments the previous day, Bank of America added approximately 1,000 outside contractors in the second quarter to help remediate software weaknesses exposed by advanced AI models, including Anthropic’s Mythos. Moynihan said they supplemented roughly 3,000 internal staff in that area. The work involved software used by the bank and its vendors. [1]
The report describes a remediation effort. It should not be presented as proof that the bank suffered a successful AI-driven breach.
Another detail matters: reported quarterly remediation spending also included work on anti-money-laundering controls. Assigning that entire combined amount to AI cybersecurity would misrepresent the reporting. [1]
The broader technology context is documented by Anthropic itself. Its Project Glasswing announcement describes using Mythos Preview to discover software vulnerabilities and give defenders an opportunity to address them. Those are the developer’s claims about its technology, rather than an independent assessment of every finding. [2]
Why faster discovery creates a management problem
A vulnerability report does not automatically make an organization safer. A useful response requires someone to confirm that the finding applies, assess the affected system, decide on a remedy, implement it safely, and check the result.
For a law firm, those responsibilities can be spread across an internal administrator, an outsourced IT provider, a website agency, and several software vendors. Without clear ownership, each party may assume someone else is handling the problem.
AI can increase the pace of discovery. A firm’s processes still determine how quickly findings become completed repairs.
The practical implication is to measure progress by risk addressed and fixes verified. Counting alerts alone tells an owner very little about whether the firm is becoming safer.
The connection between cyber risk and financial performance
Consider a hypothetical business whose essential systems are unavailable for several days. It may struggle to deliver services, issue invoices, collect payments, or respond to customers. Those disruptions can affect cash flow and, potentially, its ability to meet financial obligations.
That is the business-risk connection between cybersecurity and lending. It is an inference about how operational disruption can affect repayment capacity, rather than a claim that Bank of America announced new lending conditions in this project.
For a law firm, the same reasoning extends to client service. Losing access to documents, calendars, communications, or billing can interrupt the work clients hired the firm to perform.
A firm also has a connected intake operation to consider. Its website may still generate inquiries while a compromised email account or unavailable CRM prevents staff from responding. Marketing performance depends partly on the reliability of the systems that receive and manage those opportunities.
Do borrowers and law firms have to prove security and insurance?
Requirements depend on the specific relationship. A client engagement, vendor agreement, loan agreement, or insurance policy may create obligations to maintain controls, provide documentation, or carry particular coverage. Those documents need to be reviewed individually.
The public sources reviewed for this article do not establish a blanket Bank of America requirement that all borrowers or law firms provide proof of cyber insurance and cybersecurity implementation because of this remediation effort.
There is, however, established evidence of clients asking law firms to demonstrate their security practices. The ABA’s discussion of its 2022 Legal Technology Survey describes client requests for assessments, security documentation, and questionnaires. It also notes that insurers may use assessments and questionnaires in evaluating firms. This is historical evidence of due diligence, rather than a current survey estimate. [3]
The useful lesson is to prepare evidence before someone requests it.
What should a law firm be able to demonstrate?
A sensible management review starts with questions that produce records and decisions:
- System ownership: Which provider handles each critical platform, and who inside the firm oversees that relationship?
- Vulnerability response: Which findings affect the firm, what is the proposed response, and who verifies completion?
- Access protection: Where is multifactor authentication enforced, and who reviews administrative privileges?
- Recovery: When did the firm last successfully restore important information from backup?
- Vendor dependence: How would the firm operate if an essential software provider became unavailable?
- Incident coordination: Who contacts IT, the insurer, outside counsel, and affected stakeholders when appropriate?
Treat these as discussion prompts for qualified providers, then document the actions that follow. A policy document can describe an intended practice; operational records help establish whether the practice is happening.
Which vulnerabilities should get attention first?
Ask your security provider to explain priorities in terms of exposure, exploitation, and business impact. A weakness affecting a publicly reachable system that supports essential work may deserve different treatment from one affecting an isolated, unused component.
CISA recommends that organizations monitor its Known Exploited Vulnerabilities catalog and prioritize remediation of listed vulnerabilities. The catalog is a useful input because it identifies weaknesses known to have been exploited. It does not replace an assessment of the firm’s own environment. [4]
For each significant finding, request a named owner, a target date, and a verification step. Where a repair cannot be completed immediately, ask what interim measures reduce exposure and who approves the remaining risk.
Where cyber insurance fits
Cyber insurance is one part of financial preparation. Depending on the policy, it may address specified incident-response expenses, business interruption, or third-party claims. Coverage varies, and the State Bar of Michigan’s overview explains the distinction between first-party and third-party protection. [5]
Review your policy with a qualified broker against the way your firm actually operates. Discuss vendor-related interruptions, relevant exclusions, deductibles or retentions, waiting periods, and incident-reporting procedures. Confirm that statements made during underwriting accurately describe implemented controls.
Insurance and security perform different jobs. Coverage can help finance recovery from covered events. Safeguards and remediation reduce exposure before an incident, while tested recovery procedures help restore operations afterward.
Make the next conversation specific
Bank of America’s response illustrates the resources that can be required to turn vulnerability discovery into corrective work. A smaller firm can apply the lesson through clear responsibility and focused oversight.
At your next management meeting, ask: what are our most consequential unresolved weaknesses, who is addressing them, and what evidence will show that the work is complete?
For law-firm owners investing in AI, automation, and digital growth, those questions belong alongside lead generation and conversion. The systems supporting growth also need to support continuity and client trust.
To discuss how your firm’s marketing and intake systems support reliable growth, connect with Thrive Business Marketing. Involve your IT and cybersecurity professionals in technical assessments and remediation.