Guest Introduction

Andrew DeBratto, Chief Information Security Officer at Hunton Andrews Kurth LLP, leads cybersecurity strategy for one of the world's top 100 law firms. With more than 25 years in IT and two decades in the legal sector, Andrew combines operational discipline with forward-thinking innovation. His leadership at Hunton Andrews Kurth emphasizes cybersecurity as both a client obligation and a business enabler. Guiding a global IT team of more than 90 professionals, he champions "operational excellence" as the foundation for secure innovation. His practical insights reveal how large legal organizations can maintain stability while exploring emerging technologies like AI, automation, and micro-segmentation.

 

Here's a Glimpse of What You'll Learn

• Why operational excellence is the foundation of every successful IT department

• How Hunton Andrews Kurth builds trust through proactive cybersecurity practices

• The role of ethical AI use in the legal industry

• Why attitude and aptitude outweigh certifications in IT hiring

• How the firm applies micro-segmentation and zero trust principles effectively

• Why lawyers must remain human-in-the-loop when using AI tools

• How innovation and practicality coexist in modern law firms

 

In This Episode

Andrew DeBratto shares an inside look at how Hunton Andrews Kurth balances cybersecurity, innovation, and productivity across its global operations. He explains that "keeping the lights on" through operational excellence creates the foundation for innovation. When systems run smoothly and attorneys can focus on their clients, IT earns the credibility to explore transformative projects like AI integration and advanced endpoint protection.

Andrew dives into the realities of cybersecurity in the legal sector, where firms are prime targets for sophisticated threat actors. Hunton Andrews Kurth conducts regular penetration tests and tabletop exercises not for compliance, but for genuine improvement. "Find the flaws," Andrew insists, emphasizing that vulnerability detection drives resilience. His team uses a best-of-breed approach, prioritizing specialized tools that deliver depth of security over one-size-fits-all platforms.

The discussion also explores AI's growing influence on legal practice. Andrew acknowledges its potential but insists that every AI implementation at the firm is bound by responsible-use training. Attorneys must complete ethical certification before using any generative AI platform. "You are still responsible for your work," he reminds listeners, underscoring that human judgment must remain central even as technology accelerates productivity.

Later in the conversation, Andrew highlights the firm's AI strategy, which blends internal development on Microsoft Azure OpenAI with external best-of-breed tools. Rather than chasing every new platform, the firm uses a "buffet approach," allowing experimentation without overspending. AI, he notes, is still in its exploratory phase, and meaningful productivity gains will come only when the right tools align with specific workflows.

On leadership, Andrew emphasizes hiring for attitude and aptitude. Technical skills can be taught, but curiosity, collaboration, and integrity are essential. His philosophy has built a team that is both technically capable and deeply aligned with the firm's mission of trust, innovation, and client service.