The construction industry is undergoing a massive digitization, adopting advanced technology to lower costs, speed up timelines, decrease wasted materials, and improve overall job site safety. These new technologies offer many benefits, but they also come at a cost—cyber risk.
A 2023 survey conducted by Dodge Construction Network and Egnyte found that 70% of general contractors have reported encounters with cybersecurity threats and 59% of contractors have fallen victim to a cyberattack between 2021 and 2023. Those numbers will only increase with the push to adopt new AI, IoT technology, BIM, and digital twin software, especially if security programs don’t grow along with a company’s tech stack.
So why is the construction industry so frequently targeted, and what can construction companies do to defend against these growing threats? We’ll guide you through all that and more, with practical strategies you can implement to protect your organization and projects from the day you break ground to ribbon cutting.
Why construction project data is uniquely vulnerable
Anyone working in security knows that as digital environments become increasingly interconnected, supply chain attacks increase as well. This is true across industries, but what makes the architecture, engineering, and construction (AEC) industries so vulnerable is the volume of partners working on any given project.
The National Association of Home Builders found that most builders work with 11 to 30 subcontractors when building a single-family home. Contractors working on larger commercial projects use dozens. Each handoff to a contractor, architect, engineer, inspector, vendor, and their employees becomes a vulnerability as well as an opportunity for bad actors to access your environment. Your security program is only as strong as your weakest link, and many contractors fail to include cybersecurity requirements in vendor contracts, meaning they have limited control over the security of their data.
Not only do bad actors have several access points in the construction supply chain, but they also have time to break in and move around. Project lifecycles are long, ranging from six months to several years. As the project progresses, access to various systems and documents needs to be granted, adjusted, and revoked, and that’s assuming someone is tasked with managing access and overseeing security.
What makes the industry even more enticing for hackers is the valuable nature of the data. Intellectual property such as architectural drawings, BIM or CAD files, and sensitive information like the personal data of employees, project bids, critical infrastructure details, and site security plans make ransomware plays lucrative.
Finally, many construction companies are using legacy tools and security practices. Though new technology is being adopted, many companies still rely on shared drives and email to distribute sensitive BIM and CAD drawings, RFPs and project bids, along with timeline or budget updates. Likewise, many construction companies and contractors use shared logins and generic subcontractor portal accounts. These practices fail to properly secure IoT devices, leaving them open to attack.
For all these reasons, and more, the construction industry has been a top target for bad actors over the last several years. Fortunately, there are steps security and IT teams can take to protect the organization from today’s threats. And understanding the threat landscape is the best place to start.
Most common cybersecurity risks in AEC industries
Long project timelines and even longer supply chains don’t, in and of themselves, make a company vulnerable to attack. But these considerations must be addressed in a comprehensive security program to avoid a costly breach.
Unfortunately, many construction companies with small or non-existent security teams fail to build security programs that adequately protect their organizations, and this allows a breach to occur. Here are some of the key risks organizations need to be aware of and create countermeasures for in the construction industry.
- Overprivileged access and orphaned accounts: Given the vast number of subcontractors working on any given project, contractors and construction companies need to enact the principle of least privilege. Subcontractors and collaborators should only have access to systems and data they need to perform their role and only for the duration of their engagement on the project. If the data isn’t essential to their work, they shouldn’t be able to see it, and access should be revoked as soon as their portion of the project is complete.
- Shadow IT: Security and IT teams can only monitor and secure the tools they know about. When employees are using personal productivity and AI tools or are sending and storing files and data (sometimes unknowingly) using unsanctioned software, it puts the company at risk. That risk grows exponentially as new vendors are added to the supply chain.
- On-site mobile device usage: Mobile devices are notoriously difficult to secure. Unsecured devices that contain unapproved apps are connecting to unsecured networks, which makes it easy for bad actors to get in. These devices are often essential to completing work on the jobsite, but when the devices are personal, the jurisdiction of a security team is limited. It’s vital for companies to establish mobile device security protocols, educate employees and subcontractors about common scams and threats, and protect these devices—and the data stored on them—wherever possible.
- Small or nonexistent security teams: IT and security teams at construction companies are often small, generalist, and stretched thin — or they don’t exist at all. They barely have the bandwidth to manage IT tools and infrastructure, let alone handle 24/7 monitoring and detection, security protocols, and user permissions across dozens of external parties per project. But, even if bandwidth weren’t an issue, IT and security are two entirely different areas of expertise, which are too often lumped together. Sooner or later the cracks start to show, and hackers will jump at the chance to take advantage.
- Lack of visibility: Whether it’s due to too many users, unapproved tools, data being stored on personal devices, or a lack of ownership around security, companies often don’t have full visibility into all the activities happening in their environment. Inevitably, this leads to disaster. Leadership has no idea who has access to what data, where the data is being stored, or where it’s being moved. Without visibility into the full environment, companies have no means of monitoring or stopping nefarious activity. Compromises occur, remediation takes longer, and business and partner trust is lost.
These are just a few of the cyber risks companies in the construction industry are facing today. While these problems may loom large, and in some cases feel unsolvable, there are solutions for construction companies of all sizes to ensure their data is protected.
The identity-first solution
In the first half of 2025, identity-based attacks rose 32%, and a study by Palo Alto Networks found that identity weaknesses played a material role in almost 90% of breaches. By investing in identity and access controls, organizations can significantly reduce their chances of a damaging breach.
While firewalls and endpoint detection tools are key elements of any sound security strategy, companies need to establish rigorous guidelines for managing access to sensitive information and invest in ongoing support for identity management. For instance, access should be tied to roles, project phase, and the scope of work. Any access to systems should be time-bound and expire automatically at the end of a contract.
According to CISA, the use of multi-factor authentication (MFA) on your accounts makes you 99% less likely to be hacked, so MFA is a must for employees and should be a baseline requirement for any subcontractors or vendors accessing your systems and data. Centralized identity management is also key for vendors, including the use of single sign-on (SSO), a single directory to manage access, and instant removal of users once their work on a project is complete.
Construction companies must also keep detailed audit trails with user IDs, timestamps, and metadata to ensure security and IT teams know exactly who accessed which document–when and from where–as well as what changes were made. This is especially important for design and engineering files.
Not only will these practices secure an organization, but they will go a long way in maintaining compliance with government regulations.
Building subcontractor security into the project lifecycle
One of the biggest challenges construction companies face when it comes to security is the holistic and evolving nature of cybersecurity. Security isn’t something that can be set up and left alone, nor is it enough to buy a suite of tools and hope they work. Security needs to be woven into every stage of the project lifecycle. It must also be continually monitored, tested, and tweaked to ensure it is effective. When thinking through a security program, IT and security teams in the construction industry can break things down into the following project phases.
- Pre-award: Security requirements for vendors such as the use of MFA, data handling standards, and breach notification clauses should be stated in RFPs, considered during the selection process, and written into contracts to ensure your supply chain is secure.
- Onboarding: Once a subcontractor is chosen, IT should carefully review that sub’s needs to determine who should be granted access to systems and at what level. Access should automatically be revoked at the end of the contract and reviewed on an ongoing basis.
- Mid-project: In addition to access reviews that are scheduled at regular intervals, access should also be reviewed and revised any time the project scope or timeline changes, whenever an employee of your company or a vendor’s company leaves, or when new subcontractors join.
- Offboarding: As soon as a project is complete, access for contractors should be immediately revoked. This step is often skipped, and it’s where construction companies become vulnerable. After completing a project, your team won’t be aware of any changes to a subcontractor’s security posture. So if they still have access to your systems but weaken their security, you also become vulnerable to attack.
Establishing internal security controls at each stage of the project lifecycle is vital. These security controls should be well-documented and shared throughout the organization with key stakeholders.
Cybersecurity checklist for construction companies
So which specific security practices should construction companies implement to get the most bang for their buck? The most effective way to protect your organization is with a holistic security program that involves 24/7 monitoring and detection services as well as a full suite of security software. But to get started, construction companies need an identity and access management framework, plus a few other key elements to get their program off the ground and start building up their security posture.
- Audit current subcontractor access today and create policies (if they don’t already exist) to ensure access is limited exclusively to the systems and data vendors need to perform their functions
- Implement MFA for internal teams and contractors across all projects
- Set access expiration dates tied to contract end dates
- Schedule quarterly access reviews in addition to those at project close
- Centralize file sharing using secure software rather than allowing files to be sent via email or drive links
- Invest in 24/7 detection and response tools to continuously monitor for intrusions
- Create an Incident Response Plan, then test its effectiveness through tabletop exercises
If your organization’s security and IT teams don’t have the bandwidth to build and manage a security program that continuously adapts to new threats, you need an outsourced security partner. An MDR will not only provide you with the security tools and policies you need, but it will also offer 24/7 detection, response, and remediation services at a significantly lower cost than supporting an in-house team.
SolCyber is a fully managed, human-led MDR that can manage your supply chain and take on your threat detection and response efforts to ensure your company is protected from attack.
Our team resolves more than 95% of incidents without ever involving your team, at a third of the cost of building an in-house SOC. We also partner with leading insurers to ensure you get a discount on cyber insurance–they know, with us, you’re protected.
If you’re ready to take action and secure your construction company from a cyberattack, contact the experts at SolCyber today.
Photo by Evgeniy Alyoshin on Unsplash
