Law firms confidence in their ability to weather worst case cyber scenarios belies some significant blind spots.