Construction
Your job sites are not your office, and your IT was built for the office.
Construction and development firms have a technology profile almost nothing else shares: a workforce that is mostly not in the building, headcount that moves with the season, subcontractors who need access to some things and not others, and payment processes involving amounts large enough to be worth stealing.
A twenty-person firm we assessed turned out to have twenty-eight people actually touching company systems once contractors and seasonal crew were counted. Nobody had done that arithmetic before, and it changed both the risk picture and the price.
What makes this different
The pressures specific to construction.
Wire fraud on draw payments
Progress payments and draws are large, scheduled, and involve several parties emailing each other about money. That is close to an ideal target. The fraud is almost never technical. It is a plausible email about changed banking details, sent at exactly the right moment by someone who has been reading the thread.
You have more users than employees
Subcontractors, seasonal crew, temporary site staff, the bookkeeper who works two days a week. Every one is a login. Almost nobody counts them, and almost nobody removes them afterwards.
The field is not the office
Tablets in trucks, phones on site, plans accessed from a job trailer over whatever connection exists. Security designed for people at desks does not survive contact with a job site. It gets worked around, which is worse than not having it.
Project data is the business
Drawings, submittals, change orders, photographs, correspondence. Losing a project archive mid-build is not an inconvenience; it is a dispute you will lose because you cannot document your position.
Owners increasingly ask
Larger clients and public work bring contractual security requirements. Firms that cannot answer are quietly excluded from bid lists.
A client
Twenty employees. Twenty-eight actual users.
A construction firm came to us believing they had twenty people to protect. The assessment counted every person who could reach company systems, including contractors and seasonal crew nobody had thought of as users, and found twenty-eight. Their monthly cost reflected the real number rather than the payroll number, which is the only version that actually protects the business.
Details anonymized. Figures are real.
- Users found vs. assumed
- 20 → 28
- More people than expected
- 40%
Questions we get
From construction, specifically.
Our crews are not technical. Will this get in their way?
It should not, and if it does we have designed it badly. The controls that matter most in construction sit on identity and payments, not on the tablet in someone's truck. Where a control genuinely interferes with field work, that is a signal to find another way to achieve the same protection rather than to insist on it.
How do we handle subcontractor access?
Time-limited access to specific things, rather than an account that works forever because nobody remembered to close it. The practical difficulty is not technical. It is having a process that triggers when a sub finishes. That is usually the first thing we build.
What actually stops wire fraud?
A verification process nobody is allowed to skip, backed by controls that make the mailbox harder to get into in the first place. Any change to payment details gets confirmed by phone, on a number you already had, before money moves. It is not sophisticated and it is not expensive. It just has to be a rule rather than a habit, because the fraudulent request will arrive on a day when everyone is busy.
Our headcount swings a lot. How does pricing handle that?
We agree the count at the start of the term and revisit at agreed points rather than billing a moving number every month. If you run genuinely seasonal swings, tell us on the first call. It changes how we would structure the agreement.
Written for construction
Are Your Vendors Secretly Putting Your Business at Risk? How to protect yourself from supply-chain attacks.
Supply chain attacks reach small businesses through the vendors they trust. How to vet suppliers, what to ask them, and how to limit the damage.
Technology Lifecycle Management: Why Planning Your Technology Matters
Imagine your company loses two full days of productivity because an outdated server crashed without warning.
Based in Prescott, we work with construction companies on-site in Prescott, Prescott Valley, Chino Valley, and Dewey-Humboldt, and remotely across the rest of Arizona.
We also work with
The next step
Find out where your construction actually stands.
Three minutes, nine areas, no email address. Or book fifteen minutes and we will tell you honestly whether an assessment makes sense for an organization your size.
No pitch on the first call. If we are not a fit, we will say so and point you somewhere better.