Harvey AI

Harvey AI is becoming one of the most talked about AI platforms in legal tech.

So we decided to pull it apart.

Not to review the features.

To understand what it meant from a cybersecurity perspective.

We assessed everything from vendor reputation and security certifications through to Microsoft 365 permissions, AI and data handling, infrastructure, authentication and access controls.

One thing stood out immediately.

The Outlook Add In requests broad mailbox permissions.

At first glance, that sounds concerning.

In reality, that's exactly what you'd expect from an AI platform designed to summarise email threads, analyse attachments, draft client ready responses and integrate directly with legal workflows.

After completing our assessment, we found no material cybersecurity concerns that would prevent deployment into a well managed Microsoft 365 environment.

That's only part of the story though.

A secure product deployed into an insecure environment is still a security risk.

Technology doesn't exist in isolation.

Every application should be assessed alongside the environment it's being introduced into.

Every application asks for trust.

Our job is to determine whether that trust is earned.