In March 2003, Cisco wrote a check for roughly $500 million that made America’s home networks easier to break into, and I watched it happen from the losing side of the deal. I worked at 2Wire, a San Jose company that built DSL gateways for SBC, later AT&T. We did something our competitors treated as an eccentricity: every unit left our factory with a unique administrator password and a unique wireless key, generated per device and printed on a sticker on the bottom of the box. No shared defaults. No admin/admin. An attacker who learned the password to one 2Wire gateway had learned the password to exactly one 2Wire gateway.

That design cost real money. Per-device key generation complicated manufacturing. Unique credentials complicated provisioning and lengthened support calls. The people writing the checks, the carrier customers buying gateways by the hundred thousand and the acquirers circling the company, discounted the work as burdensome. Cisco had talked to 2Wire, and 2Wire’s board declined the offer. What Cisco bought instead was Linksys, the retail market leader with 40 percent of the U.S. retail networking market by NPD Techworld’s count, for approximately $500 million in stock. Linksys products shipped by the million with a shared factory default. 2Wire found its exit seven years later, when Pace paid $475 million for the company in 2010, nearly the same price for the security-first design that Cisco had paid for the insecure one. The market eventually paid full price for security. It just paid seven years late, and it shipped tens of millions of insecure devices in the interval.

Thirteen years later, a Rutgers undergraduate named Paras Jha collected the dividend. Jha and two co-conspirators wrote Mirai, malware that scanned the internet for connected devices and tried to log in using a preconfigured list of 62 factory-default username and password pairs. That list, 62 entries long, conscripted a peak of 600,000 routers, cameras, and DVRs into a botnet that knocked Krebs on Security offline, staggered the DNS provider Dyn, and, through a variant, took down internet service for hundreds of thousands of Deutsche Telekom customers. All three men pleaded guilty in December 2017. The sentence the industry served was longer: two decades of shipped-insecure devices became the permanent attack surface that nation-state crews still walk through today, a surface the harvest-now-decrypt-later problem has already turned against law firms directly. [See The Breach That Hasn’t Happened Yet Is Already Over, The Technology Blind Spot (2026).]

Call it graft economics, because the sequence, not any single decision, is the point. Software markets build features first because features get demos, and demos get contracts. The same markets build security only after the breach, because breaches get subpoenas. The internet itself began this way: a research network designed for trusted colleagues, with identity, encryption, and authentication arriving decades later as retrofits, protocol by protocol. Nobody planned the insecurity. The incentives planned it, one rational quarterly decision at a time, and by the time the demand for security arrived, millions of lines of code and millions of shipped devices stood between the industry and the fix.

Legal AI vendors in 2026 face those incentives in their purest form. Venture funding rewards shipping speed, sales cycles reward the feature that wins the pilot, and the buyer evaluating the demo almost never asks to see the credential architecture. Every structural pressure that produced admin/admin is present in the current market, amplified by capital moving faster than it did in 2003. The only force pushing the other direction is the buyer who asks.

The Law Finally Reached the Factory Floor

Regulators have now decided to interrupt the sequence at the source. On September 11, 2026, seven weeks from now, Article 14 of the European Union’s Cyber Resilience Act enters into application. From that date, any manufacturer selling products with digital elements into the EU, whether or not the company has a single European office, must report an actively exploited vulnerability within 24 hours of becoming aware of it, file a fuller notification within 72 hours, and deliver a final report within 14 days of a fix. The obligation covers legacy products already on the market, not just new launches. For the first time, a major jurisdiction has made “graft it on later” a reporting event with a clock on it rather than a business model.

The American approach remains an honor system. CISA’s Secure by Design pledge, launched in 2024, now carries hundreds of signatories, and its seven goals read like an inventory of everything 2Wire argued about with its customers: eliminate default passwords, make multi-factor authentication standard, reduce whole classes of vulnerability by architectural choice. The pledge is voluntary. CISA enforces nothing and verifies nothing. What the pledge produced instead is a paper trail: signatories publish annual progress reports on cisa.gov, and procurement teams have started reading them. A vendor that signed and never published sits in the worst position of all, visible commitment, no visible delivery.

Which brings the question home to the one profession that never had the luxury of the graft-it-on-later model in the first place.

Privilege Is a Security Guarantee Wearing a Robe

A law firm does not sell documents. Clients can draft documents themselves, and increasingly their software can. What a firm sells is a protected space: the assurance that a client can hand over the worst facts of their business or their life, and those facts will emerge only where the client’s interests require. Model Rule 1.6(c) states the engineering requirement in legal language, obligating lawyers to make reasonable efforts to prevent unauthorized access to client information. ABA Formal Opinion 483 adds the incident-response half of the specification. Strip away the technology entirely: a firm that stored every client file in an unlocked cabinet in a public hallway never had a features problem. It had no product.

Confidentiality also fails differently than software fails. Cisco could patch Linksys firmware, and Microsoft spent a decade hardening Windows into something defensible. A retrofit cures an insecure product. No retrofit cures a disclosed secret. Once a third party outside the privilege has read the communication, the doctrine treats the protection as gone, the position Judge Rakoff’s memorandum in United States v. Heppner, No. 1:25-cr-00503-JSR (S.D.N.Y. Feb. 17, 2026), applied to AI platforms with terms of service that permitted third-party access. Privilege is the one asset class where the barn door truly does not matter after the horse. There is nothing left to lock in.

I have watched software hold that level of access before, built the opposite way. In 2008 I worked at Kazeon, an eDiscovery company EMC acquired the following year. Our product ran inside client datacenters with root access, crawling every repository in the enterprise, laptops, file shares, email archives, content systems, to identify, collect, and preserve evidence for litigation. Root access to everything, in the middle of some of the largest intellectual property, financial crime, and product failure cases then in motion. Customers granted that access because we engineered the product from its first line of code around three requirements: security, confidentiality, and preservation of evidence. Weaken any one of the three and the tool becomes an instrument for fabricating or destroying the very record it exists to protect, and every collection it touches becomes impeachable. Nobody grafted those properties on later. They were the reason customers let the product in the building.

Agentic AI tools are now requesting Kazeon-class access to firm systems, and almost none of them carry Kazeon-class design DNA. Generative AI raised the stakes of that asymmetry. Agentic AI multiplied them. A hallucinated citation embarrasses one brief in one matter, and a lawyer who verifies catches it. An autonomous agent is a different species of risk: it holds credentials, it acts at machine speed without a human reviewing each step, and firms are wiring it into the systems where everything lives, the document management system, the email archive, the billing database. This is no longer hypothetical behavior. On July 16, Hugging Face disclosed an incident in which an AI evaluation agent slipped its sandbox and worked a live network with no human intent behind any keystroke. [See The Hacker Found the Manifest, The Technology Blind Spot (2026).]

Now run the blast-radius math that makes agentic risk categorically different for a law firm. A misdirected email exposes one client. A stolen laptop exposes the matters on it. An agent provisioned with broad read access to the firm’s document management system, compromised once, or simply pointed at the wrong goal once, can exfiltrate or expose the confidences of every client the firm has ever represented, in a single event, at machine speed. The privilege analysis then runs client by client, matter by matter. The Formal Opinion 483 notification duty runs client by client. The malpractice tail runs client by client. One misstep, one shared credential, one over-scoped permission, and the firm is not managing an incident. It is managing every engagement letter it has ever signed, simultaneously. A firm that builds its own tools rather than buying them does not escape this analysis; it inherits the manufacturer’s chair, with the CRA’s definition of manufacturer waiting at the end of the logic. [See Roll Your Own Is a Warning, Not an Invitation, The Technology Blind Spot (2026).]

The Case for Waiting, Stated Fairly

The strongest opposing position deserves an honest hearing, because reasonable people at reasonable firms hold it. It runs like this: every computing market has matured on the retrofit model, and it worked. Early Windows was a sieve; modern Windows is defensible. Early browsers leaked everything; modern browsers sandbox aggressively. Buyers who waited got hardened products at commodity prices, while buyers who demanded fortress-grade assurance from two-year-old vendors paid a premium for security theater and lost ground to competitors who shipped. Legal AI will harden on the same curve, the argument goes, and the rational move is to adopt carefully, verify outputs, and let the market do the maturing.

A second, more sophisticated variant follows: the certification answer. Our vendor holds a SOC 2 Type II report, the argument runs, so the security question is already asked and answered by professionals better equipped than a law firm to ask it. This deserves respect too, because a clean SOC 2 report is genuinely better than no report. But a SOC 2 audit examines the controls a vendor chose to define, over the period the vendor chose to define them, and nothing in the framework requires the auditor to evaluate whether an autonomous agent’s permission scope, model update cadence, or sandbox architecture was designed securely in the first place. The audit certifies the fence around the factory. It says nothing about whether the product rolling off the line ships with the equivalent of admin/admin. [See Your SOC 2 Audit Stops Where Your AI Privilege Risk Begins, The Technology Blind Spot (2026).]

Nearly every clause of the wait-and-harden case is true, and the conclusion still fails, because the argument assumes the firm gets to live through the maturation interval. Retrofit maturity arrives in years. Privilege waiver arrives in milliseconds and never leaves. The Windows analogy holds only for harms that patches can cure, and a client confidence read by the wrong party is not that kind of harm. The market’s hardening timeline and a client’s confidentiality timeline do not intersect at any point a managing partner can bill for.

One limit in my own analogy deserves naming before a critic names it. A 2Wire gateway was a fixed-function device: secure at the factory meant secure in the field, more or less permanently. An agentic AI system changes behavior with every model update, every new tool connection, every revised prompt. Security at ship, the thing 2Wire got right and Linksys skipped, is the admission ticket for legal AI, not the finish line. The analogy holds for the foundational question, whether security was a first-order design requirement or a retrofit. It does not hold for the comfortable idea that a one-time secure design ends the obligation. For legal AI, the obligation never ends.

Two Documents and One Question by Thursday

The procurement posture this argument demands is concrete, and the artifacts now exist because regulators forced them into existence.

First, email your AI vendor’s account representative and request the company’s CISA Secure by Design pledge progress report. If the vendor never signed, ask for a written explanation of what equivalent commitments it has made and where they are published. The answer arrives in one of three forms: a report with numbers, a report with adjectives, or silence. All three tell you what you bought.

Second, if the vendor sells into the European Union, request its Article 14 reporting-readiness statement for the September 11 deadline. This is not European trivia. A vendor that has built the muscle to notify a European regulator of active exploitation within 24 hours has built the muscle to notify you, and Formal Opinion 483 makes the speed of that notification your problem, not just theirs.

Third, put one question to your IT lead, or to the vendor directly if the firm has no IT lead: does every AI agent and integration touching firm systems run on unique, scoped credentials, or do any of them share accounts and API keys? That is the 2Wire question, twenty-three years of security economics compressed into a single line, and it has a yes-or-no answer someone can retrieve by Thursday.

Every gateway we shipped carried its password on a sticker on the bottom of the unit. Unique to that box. Unglamorous. Cheap at scale, and dismissed as burdensome by people optimizing for the demo. The buyers who called it overhead spent the next two decades funding the cleanup, and this September, European regulators start the meter on the shortcut. Your clients are not buying your AI tools. They are buying what the sticker stood for: proof that somebody made security a condition of shipping. Make sure your vendors printed one.

About the Author

JD Morris is Co-Founder and COO of LexAxiom, an Agentic AI platform for the business of law. Over a 25-year career, he has built and scaled enterprise technology products across Dell, EMC, VMware, and Cisco, including the first exabyte eDiscovery platform. He holds dual MBAs from Columbia Business School (Finance) and UC Berkeley Haas (Marketing), a Master of Legal Studies in Cybersecurity Law from Texas A&M, and a Master of Engineering from George Washington University. He writes The Technology Blind Spot on the intersection of emerging technology and law. Connect with him on LinkedIn at www.linkedin.com/in/jdavidmorris, on X at @JDMorris_LTech, or on Bluesky at @JDMorris-ltech.bsky.social.

References

1. Cisco Systems, Cisco Systems Announces Agreement to Acquire The Linksys Group, Inc., Cisco Newsroom (Mar. 20, 2003), https://newsroom.cisco.com/c/r/newsroom/en/us/a/y2003/m03/cisco-systems-announces-agreement-to-acquire-the-linksys-group-inc.html.

2. Jim Duffy & Toni Kistner, Cisco Buys Home Networker Linksys, Network World (Mar. 20, 2003), https://www.networkworld.com/article/896045/network-security-cisco-buys-home-networker-linksys.html.

3. Pace Buys U.S. Broadband Co 2Wire for $475 Mln, Reuters (July 26, 2010), https://www.reuters.com/article/world/europe/pace-buys-us-broadband-co-2wire-for-475-mln-idUSTRE66P1UL/.

4. Manos Antonakakis et al., Understanding the Mirai Botnet, Proc. 26th USENIX Sec. Symp. 1093 (2017), https://www.usenix.org/system/files/conference/usenixsecurity17/sec17-antonakakis.pdf.

5. Press Release, U.S. Dep’t of Just., Justice Department Announces Charges and Guilty Pleas in Three Computer Crime Cases Involving Significant DDoS Attacks (Dec. 13, 2017), https://www.justice.gov/archives/opa/pr/justice-department-announces-charges-and-guilty-pleas-three-computer-crime-cases-involving.

6. Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024 (Cyber Resilience Act), art. 14.

7. European Comm’n, Cyber Resilience Act: Reporting Obligations (June 8, 2026), https://digital-strategy.ec.europa.eu/en/policies/cra-reporting.

8. Eur. Union Agency for Cybersecurity, Single Reporting Platform (SRP), https://www.enisa.europa.eu/topics/product-security-and-certification/single-reporting-platform-srp.

9. Cybersecurity & Infrastructure Sec. Agency, Secure by Design Pledge, https://www.cisa.gov/securebydesign/pledge.

10. Cybersecurity & Infrastructure Sec. Agency, Secure by Design Progress Reports, https://www.cisa.gov/securebydesign/pledge/progress-reports.

11. Model Rules of Pro. Conduct r. 1.6(c) (Am. Bar Ass’n 2024).

12. ABA Comm. on Ethics & Pro. Resp., Formal Op. 483 (2018).

13. United States v. Heppner, No. 1:25-cr-00503-JSR, ECF No. 27 (S.D.N.Y. Feb. 17, 2026).

14. Press Release, EMC Corp., EMC to Acquire Kazeon Systems Inc. (Sept. 1, 2009), https://www.dell.com/en-us/dt/corporate/newsroom/announcements/2009/09/20090901-03.htm.

15. Security Incident Disclosure, July 2026, Hugging Face (July 16, 2026), https://huggingface.co/blog/security-incident-july-2026.