Field Note: Which is More Secure, Google or Microsoft?
Most lawyers think Google versus Microsoft is a question about email preference. Ron Drescher argues it's really a question about client confidentiality, and that the answer depends less on the brand than on which protections you bought, turned on, and enforced. From phishing-resistant passkeys to data loss prevention to the hidden permission risks of Gemini and Copilot, this Field Note ends with five questions that tell you where your firm actually stands.
Listen/Watch On
Show Notes
Google or Microsoft? Most lawyers treat that as a question about Outlook versus Gmail. It isn't. It's a question about who protects your clients' confidential information, and the honest answer surprises people: neither platform wins on paper. The real question is whether you bought the right protections, turned them on, and trained your people to use them.
In this episode:
- Why passkeys and phishing-resistant authentication belong near the top of a law firm's security shopping list
- How one "anyone with the link" share can expose a client's tax returns, bank statements, and bankruptcy schedules
- Data loss prevention (DLP): what it does, and why both Google and Microsoft tie it to specific subscription tiers
- The lost-laptop scenario, and why Microsoft 365 Business Premium (Intune plus Defender for Business) gives Microsoft an edge for Windows-based firms
- Third-party AI apps that ask for access to your Google Drive or OneDrive, and who in your firm has authority to approve them
- Gemini and Copilot: why AI assistants inherit your existing permission problems and make them easier to exploit
- Why the cheapest subscription may not be cheaper in any meaningful sense
- Five questions every firm should be able to answer about its security posture
We also discuss:
- "Folder mania" and the stakes of giving an AI app access to entire folders
- Microsoft Purview sensitivity labels for classifying and protecting confidential documents
- Why Ron, a longtime Mac user, isn't sure Microsoft's device-management advantage applies to him
- Reviewing contractual commitments on data use, retention, and model training before enabling enterprise AI
- The three-legged stool of AI security: technology, configuration, and people
Companion Resources: AI Builds on Google Workspace and Microsoft 365
Ron's companion AI Builds episodes walk through the specific settings behind this comparison, with materials to help you find them.
- AI Builds: How Secure Is Google?
- AI Builds: How Secure Is Microsoft?
- Companion materials Google
- Companion materials Microsoft
Key Takeaway
Security isn't a brand you buy. Google and Microsoft both offer excellent technology. Whether it protects your clients depends on which edition you paid for, whether anyone configured it, and whether your people follow the rules. A locked front door does nothing if your paralegal hands out the key in a shareable link.
Flintstones lawyers who assume their email provider handles security by default need to look again. Simpsons lawyers about to switch on Gemini or Copilot need a permissions review first, because the AI will find every overshared folder. Jetsons lawyers connecting third-party apps to their files need to know exactly which ones have access and who approved them.
Mentioned in This Episode
- Google Workspace
- Google Drive
- Gmail
- Gemini
- Microsoft 365
- Microsoft 365 Business Premium
- Microsoft OneDrive
- Microsoft SharePoint
- Microsoft Outlook and Word
- Microsoft Copilot
- Microsoft Purview
- Microsoft Intune
- Microsoft Defender for Business
- Microsoft Entra
- AI Builds companion episodes on Google Workspace and Microsoft 365 (linked above)
- The three-legged stool of AI security
[email protected]
Highlight Reels on YouTube and Instagram
