Security's Biggest Names Show Their Work. Law's Keep It Sealed.
Ask a security researcher what they have done and you will usually be sent a link. Put the same question to a litigator and the answer arrives more slowly, as a careful sentence about the kind of matter they handle that gives a stranger nothing to look up. Neither is being evasive, though only the researcher has offered something a reader can check.
Our Top 25 Cybersecurity Leaders and Top 25 Legal Leaders lists for 2026 were selected on the same basis, and they could hardly look more different. Fourteen of the twenty-five cybersecurity honourees are publicly known for a specific piece of their own work, whether a kill switch registered, a bug bounty programme invented, a national agency built or an intrusion traced to its source. None of the twenty-five legal honourees is publicly known for a case.
That ought to be the wrong way round. Law manufactures public documents for a living: judgments name counsel, filings sit on a docket, and the whole apparatus of precedent exists so that what a lawyer did last year can be read by anybody this year. The central event in cybersecurity, the breach, is something organisations spend heavily to keep quiet. Yet the security list is full of people known for a particular piece of work, the WannaCry kill switch among them, while the legal list is full of people known chiefly for their opinions.
In law, the better the work, the fewer people are allowed to hear about it.
Twenty-five lawyers, and not one named case
The legal list contains plenty of lawyers and very few practitioners. Most of its members are professors, journalists, analysts or founders of legal-technology firms. Richard Susskind, at the top of it, advised England and Wales's most senior judge on technology for a quarter of a century and has written a shelf of books on where the profession is heading. Bob Ambrogi runs the most widely read independent publication on legal technology, Jordan Furlong and Bill Henderson analyse law-firm economics, and Vivia Chen writes about the profession's culture from outside it.
Five of the twenty-five still practise (Carolyn Elefant, Scott Greenfield, Mitch Jackson, Erin Gerstenzang and Hana Laurencikova), all of them alone or in small firms. No partner at a large commercial firm appears anywhere on the list, and Mark Cohen, the one person on it who held such a job, left it to write about the industry.
The only lawyer in the Class of 2026 known for his cases sits elsewhere in the cohort. Bryan Stevenson has argued before the United States Supreme Court and his work is a matter of public record, yet he appears on our Top 25 Nonprofit & Social Impact Leaders list rather than the legal one. What made him visible to the outside world was his cause, which, unlike a client's affairs, is something a lawyer is free to talk about.
Why security's work ends up in public and law's stays under privilege
The finished product of security work is usually a disclosure. Vulnerability reports, breach notifications and published advisories are written to be read by strangers, and the profession has spent two decades building the machinery to circulate them, which is why its reputations are so concrete. Marcus Hutchins registered a domain in May 2017 and halted WannaCry while it was still spreading through hospitals. Katie Moussouris built the first bug bounty programmes at Microsoft and the United States Department of Defense, creating the paperwork by which a stranger gets paid for telling you that you are broken. Eva Galperin assembled the Coalition Against Stalkerware, Dmitri Alperovitch's firm traced the 2016 breach of the Democratic National Committee, Troy Hunt built Have I Been Pwned as a public ledger of other people's worst days, and Ciaran Martin built a national cyber-security agency from nothing. All of it can be verified with a browser.
Legal work is confidential, and the better it is the more confidential it tends to be. The best legal work of any year is likely to be a settlement nobody announced, a deal that closed without incident or a clause never tested because it was drafted properly. Even visible wins belong to the client, who is usually the only person entitled to discuss them and often prefers not to. A lawyer has about as much scope to build a public reputation from client work as a priest has from the confessional. What remains open to public discussion is the profession itself, including its economics, technology and training, and that is precisely what the twenty-five people on our list are known for.
A third explanation concerns our own method. The Industry Leaders selects on published commentary, media presence, speaking and peer recognition, all of which require work to have been made visible first. A method built on what professionals say will find those who are free to speak and miss those who are not, and in law the second group covers most of the profession on most working days. The list therefore maps who shapes the public conversation about law rather than who practises it best, and we would be wrong to suggest otherwise.
Even so, the oddity survives. The same method, applied to cybersecurity, where confidentiality agreements are standard and incident response is often itself privileged, returned fourteen people in working security posts, among them the engineer who runs Chrome's security programme and an analyst who defends industrial control systems. What the method filters out, then, is people barred from describing their work, and law has more of them than any other profession we cover. The open question is why law has separated so completely the people who do the work from the people permitted to discuss it.
This year has pushed the two professions further apart
That separation widened in 2026. The Thomson Reuters Institute's 2026 Report on the State of the US Legal Market, published on 7 January, found worked rates up 7.3%, a record, with average profit growth of 13% and 90% of legal spending still billed by the hour. An hour of senior lawyer time has never been worth more, which makes an hour spent writing something nobody will be invoiced for more expensive than ever.
Clio's 2026 Legal Trends Report, published on 26 October, points the same way. It projects the billable share of a lawyer's working day to reach 42% in 2026, up from 39% a year earlier, with lawyers averaging 3.4 billable hours a day, 53% more than in 2016. Meanwhile 85% of legal professionals report some AI adoption at their firm, and the time that software frees up appears to be going into more billable work rather than into publishing.
Security moved in the opposite direction. HackerOne's tenth annual research report, Exposure Debt, published on 7 October, recorded $89 million paid to researchers between July 2025 and June 2026, up 18% and the platform's largest annual total, while average resolution time fell from 135 days to 62. That is a market paying cash, at scale, for findings published under the finder's own name, a transaction for which the legal profession has no equivalent.
The public record of security failures keeps growing too. In its Annual Review published on 3 November, the UK's National Cyber Security Centre reported 1,831 cyber attacks referred to its incident management team and 80 nationally significant incidents, state-published figures about private failures of a kind with no counterpart in legal work. We expect the 2027 Legal Leaders list to include no large-firm partner and no honouree known for a case, and the cybersecurity figure to stay in double digits. Next year's cohort will test that forecast.
What it adds up to
For a lawyer who wants to be known beyond their own client list, the data points to a route the profession does not train people for. Excellence at the work does not travel, because the work itself cannot be shown. What travels is an argument about the work, published repeatedly, under your own name, somewhere a stranger can find it. That amounts to a second job, and all five practising lawyers on our list took it on alongside their practices.
Security professionals have the asymmetry on their side for now, and should recognise it before it shifts. Their profession hands out reputational capital as a by-product of doing the job properly, because its output is a public artefact, an arrangement that is unusual and unlikely to last. As incident reporting hardens into a regulatory exercise run by counsel, more of the detail will move behind privilege and security's best-known names will start to resemble law's. Lawyers, who have worked under those conditions for a century, can tell them what it costs.
Read next
Top 25 Legal Leaders 2026 — the full list, with locations and biographies.
Top 25 Cybersecurity Leaders 2026 — the full list, with locations and biographies.
Where the most influential people in business live, 2026 — the whole cohort mapped.
All 26 Top 25 lists for 2026 — every industry in the Class of 2026.
The Industry Leaders names the 25 most influential professionals in each of 26 industries every year. Selection is editorial — based on published work, media presence, speaking and peer recognition — and cannot be bought or influenced. The figures above were computed on 10 November 2026 from the 25 entries on the Top 25 Legal Leaders 2026 list and the 25 entries on the Top 25 Cybersecurity Leaders 2026 list, using the honouree biographies in our own records, which are complete for all 50 entries. A named piece of work means a case, breach, investigation, tool or programme the honouree personally worked on; a book, column, podcast, award or job title does not count. Practising means currently representing or advising clients as a lawyer, or currently holding a post doing or directing security work. They describe those two lists and no others.
