The firm declined to comment on any client engagements.

Mullen said he's been approached by many a Big Law firm about the prospect of combining with a much larger, sometimes global, practice. But he's turned down offers each time for many of the same reasons he broke off from Lewis Brisbois in 2016.

"I could sell our business to a big fancy law firm and make a decent chunk of change for myself and for the equity partners. But then, you're fighting for the five to seven big cases a year with another 10 law firms that are doing the same thing," he said. "So you're looking to build five Ferraris a year, or do what we do and build 10,000 Honda Accords."

'How We Get In'

Leaders at Mullen Coughlin said it was founded by partners who sought to practice a fast-growing area of law without the constraints of larger firms—namely, territorial competition for clients and origination credit, pressure to maintain a sizeable book of business and inefficiency in checking for conflicts of interest.

"We need to be fast on conflict checks, and when you're at a firm with 1,000-plus lawyers, you can't," said Mullen, who added that conflict checks can take to multiple days based on his experience in Big Law. "There's too many lawyers with too many clients who keep them as clients forever."

Mullen Coughlin began with 13 attorneys and has grown to 94 as of June 21, according to the firm.

The firm has attracted talent from Nelson Mullins Riley & Scarborough, Wilson Elser Moskowitz Edelman & Dicker and, most recently, Lewis Brisbois again in June, with the addition of partners Katie Butler and Elizabeth Dill. Firm leaders said they will work remotely from Arkansas and Virginia.

Mullen said he never anticipated growing the practice to its current size and has never had a head count goal in mind. Instead, he said he uses trends in the cybersecurity insurance industry to guide his growth strategy.

"We try our best to balance the pulse of the growth of the industry—is it trending up, is it selling more, is it penetrating that big marketplace? The answer is yes," Mullen said, noting the market for cybersecurity insurance is 15-20% penetrated. "How many clients are buying cyber insurance? Because that's how we get in."

Rather than market to individual companies, Mullen said, his firm works to establish relationships with the country's largest insurance carriers and brokers. To that end, he said it helps to be situated in Pennsylvania, along a string of major players in the insurance industry running from Philadelphia to Hartford, Connecticut.

The development of cyber insurance as a product took place over a similar five-year time frame as the launch and growth of Mullen Coughlin. Cyber insurance has evolved into a popular product over the past five or six years, said James Carter, an insurance recovery counsel with Blank Rome, who litigates exclusively on behalf of corporate policyholders to maximize their coverage.

"Cyber insurance is a new product that has been in a state of evolution since it really was popularized about five years ago," he said. Making things more complicated for policyholders, Carter said, is the lack of standardization for policies related to cyber events.

Five or six years ago, the focus of cyber insurance coverage was on data breaches, Carter said. Today, companies sometimes find their policies lacking in coverage for penalties resulting from increased regulatory scrutiny that could lead to penalties or cyber attacks that result in damaged property.

Ransomware, which coerces companies to pay up in order to reclaim data, could be a waning feature of cyber insurance plans, he said.

"As ransomware has become more frequent, the insurance industry has made noises about the need to cut back on cyber extortion coverage," Carter said. "I think we're going to start to see either elimination of that coverage or insurers continue to cover it but put some limits on it to curtail their liability for payment of ransomware."

With all this constant evolution on the insurance side, it creates opportunities for a law firm fluent in the issues to help business clients navigate them.

Fighting a 'Lucrative Business'

Jennifer Coughlin, a co-founding partner of Mullen Coughlin, said cyber threats have evolved significantly over the last few years, and laws requiring organizations to have certain protections are evolving.

"Threat actors have become much more sophisticated and often work in tandem with each other," she said. "They realize this is such a lucrative business for them that they have dedicated resources to them."

At Mullen Coughlin, 50% of client legal needs involve ransomware, 20% involve business email compromises, another 10% would be considered third-party vendor breaches, Mullen estimated.

Mullen said the industry composition of its clientele is "across the board," with more heavily-regulated industries, such as financial services and health care, particularly vulnerable because of their trove of personal information.

The legal industry is another such area.

The event that affected Goodwin Procter earlier this year involved the breach of a third-party vendor, and it also affected other law firms, including Jones Day and Foley & Lardner. A spokesperson for Goodwin Procter declined to comment on the incident.

Dozens of law firms have experienced breaches, some of which became public right away due to resulting tech problems. A Law.com investigation identified more than 100 law firm breaches based on public records—and that was nearly two years ago.

Headed West

Mullen said his firm's biggest competitors include Baker Hostetler and McDonald Hopkins, a midsize firm based in the Midwest. He said competitors in Big Law often can't afford to charge rates as low as Mullen Coughlin's. Overhead costs in Big Law have increased every year, forcing billing rates above what many carriers are willing to pay, Mullen said.

Coughlin said shifting to remote recruitment, beginning with partner Gregory Bautista and his team from Wilson Elser in January 2020, initiated a hiring strategy that was unconstrained by geographic locations and the overhead costs that often come with expanding a footprint. However, she said this required a shift in philosophy for Mullen.

"It was a lot of work on my part to convince John that we can have remote talent," Coughlin said. "He's old school; he has been practicing much longer than I have. He has seen firms collapse, and he wanted to keep doing things the right way. And what we were doing was the right way, except we had the opportunity to build the team with great talent, which was Greg and his team."

Mullen said he's looking to expand westward by way of remote lateral recruitment and the potential for future office openings. Currently the firm has a footprint in Dallas, Texas and Nashville, Tennessee.

"I think we're going to push further west," he said, noting that, if a potential client based out west had two choices, they might go with the one with a West Coast presence. Then, he said, "we can comfortably say we have the country covered."