Beyond AI: The Strategic Technology Priorities Reshaping Law Firms
Key findings from the 2026 ILTA Technology Survey from one of its long-time authors
This is not another article about artificial intelligence.
The Strategy section of the newly published 2026 ILTA Technology Survey points to a different set of pressures that may matter more to law firms in the near term: proving that their technology environments are secure and well governed, while also showing the shareholders that the investment is affordable. The year-over-year results make that tension clear. Security compliance and risk management rose 13 percentage points, the largest increase of any item, while the general high cost of technology rose 7 points. Together, they now sit at the top of the list.
What’s New
Other changes in the results are equally telling. Concern about users’ acceptance of change fell 13 points, keeping up with new software versions dropped 9 points, and email management declined 4 points. Those issues have not disappeared, but they appear to be losing some of their urgency as cloud platforms, continuous updates, and newer ways of working become familiar. At the same time, project load rose 5 points (likely due to AI tools). The challenge is shifting from getting people through modernization to proving that the resulting environment is controlled, supportable, and worth the cost.
Evidence of this trending is demonstrated by security standards and assurance programs moving higher on the agenda. SOC audits, ISO 27001, the NIST Cybersecurity Framework, and the CIS Critical Security Controls are not interchangeable, but each gives firms a structured way to examine its controls and explain its security program to clients and other stakeholders. A SOC 2 engagement, for example, results in an independent attestation report. ISO 27001 is a certifiable information security management standard. NIST and CIS provide practical frameworks for organizing and improving controls. The right choice depends on what a firm is trying to demonstrate and to whom.
For many firms, SOC 2 is becoming especially useful because it addresses a question clients increasingly ask: are the firm’s controls not only documented, but actually operating as intended? A Type 2 examination evaluates selected controls over a defined period. That evidence can make client reviews and procurement discussions more efficient, while giving firm leadership a clearer view of where the security program is mature and where more work is needed.
Next Steps
Kraft Kennedy helps clients prepare for and complete SOC 2 audits by assessing readiness, identifying gaps, organizing evidence, and aligning technology operations with audit requirements. Existing Kraft Kennedy MSP clients may have a head start because relevant managed services and controls are already included within Kraft Kennedy’s own SOC 2 Type 2 audit. That does not eliminate a client’s responsibilities, but it can reduce duplicate validation and give the client’s auditors an established body of independent assurance to review.
Identity is another area drawing more and more attention. As firms rely on cloud services, remote access, and applications outside the traditional network perimeter, authenticating users becomes a larger part of the security model. The practical question is straightforward: how confident is the firm that the person requesting access is really who they claim to be? Passwordless authentication and passkeys can strengthen that confidence, particularly for privileged users and high-risk workloads, by reducing dependence on credentials that can be stolen, reused, or socially engineered.
Final Words
The broader message from the survey is that law firms are being asked to show their work. Clients want evidence that security controls are real. Firm leaders want evidence that technology spending is justified. Auditors and insurers want a program they can evaluate. Kraft Kennedy helps firms respond with practical programs, including SOC 2 readiness and audit support, managed services backed by our SOC 2 Type 2 audit, alignment with NIST and CIS, and passwordless authentication for higher-risk use cases. The best starting point will vary by firm, but the direction is clear: security assurance, identity, governance, and cost discipline are becoming core measures of a modern legal technology program.
Stay Connected
Looking for more ways to interact with Kraft Kennedy?
Check out our upcoming events!