Business and technology leaders often dismiss lawyers as pedantic and obstacles to productivity. This is certainly something security and risk pros can relate to. However, it's important to get beyond these preconceptions and understand the critical role in security incident response (IR) that a lawyer, by training, is able to provide. This report examines the critical role that legal plays in a mature incident response program and how it can protect businesses from millions in breach costs.