Skip to main content
Industries · Construction and property

IT and security for builders, renovators and property teams.

We keep your crews connected in the field, keep plans and payments safe in the office, and help you answer the security questions lenders and insurers send you.

Book a consultation Call 424.437.8173

A 15-minute call with an engineer who works with builders.

Trusted byGround Up Renovations
Sound familiar?

What we hear from builders.

Construction companies run on trust, deadlines and a lot of people who are not in the office. That shapes what goes wrong with IT, and what attackers go after.

01

The office is wherever the crew is.

Supers, project managers and foremen work from phones, tablets and laptops on job sites, in trucks and at home. Those devices hold plans, photos, email and sometimes the banking app. When one goes missing or a password is weak, there is no IT desk down the hall to catch it.

02

Plans, bids and change orders live in ten places.

Files get passed around by email, text, shared drives and personal Dropbox accounts. Nobody is quite sure which version is current. Nobody is sure who still has access to last year's project folder either.

03

Everyone wants proof that you are secure.

Lenders, insurers and general contractors send security questionnaires before they fund, renew or award work. The questions are full of terms like MFA and EDR. An answer you can't back up can slow a deal or change what your policy covers.

Know what you are up against

The attacks that actually hit construction, explained.

You don't need to know how hackers work. It helps to know what an attack looks like when it reaches you, why builders are a good target, and the one habit that stops most of it.

01

Fake payment instructions

Called business email compromise, or BEC

What it looks like

An email from a sub, a supplier or your own bookkeeper says their bank changed. It asks you to send the next draw or change-order payment to a new account. It may come from a look-alike address, or from their real mailbox after someone broke into it.

Why builders get hit

Large payments move every week between owners, lenders, GCs, subs and suppliers. Many people send invoices, so one more doesn't stand out.

What stops most of it

Call to confirm any change to bank details, using a phone number you already have on file.

02

Ransomware

Files locked until you pay

What it looks like

Files on the server or shared drive suddenly won't open, and a note demands payment to unlock them. Sometimes the attacker copied your files first and threatens to publish them.

Why builders get hit

Deadlines create pressure. A company that can't open its plans the week of a bid or an inspection is more likely to pay.

What stops most of it

Backups kept where ransomware can't reach them, and tested so you know a restore works.

03

A stolen password

On a shared, staff or sub account

What it looks like

Someone signs in to a shared mailbox, a project app or a sub's account with a password from a data leak, or one they tricked someone into typing. Nothing looks wrong at first.

Why builders get hit

Shared logins like office@ or estimating@, plus dozens of outside users on project apps, mean many passwords and few people watching them.

What stops most of it

MFA on every account: a second check, like a code on your phone, when someone signs in. A stolen password alone stops working.

04

A lost or stolen device

The site laptop or tablet

What it looks like

A tablet left on a tailgate, or a laptop taken from a truck. It still has email signed in, plus plans, photos and sometimes saved passwords.

Why builders get hit

Field devices move between job sites, trucks and homes every day, and they are often shared between people.

What stops most of it

Devices that lock with a passcode, keep their data encrypted (scrambled without the passcode) and can be erased remotely.

Illustration. The names, companies and numbers are made up.

Up close

What a fake payment request looks like.

This kind of email usually lands in the middle of a real conversation, right when money is about to move. Here is how to read it.

  1. 1The address has one letter swapped. The real company is westlineframing. This one is westIineframing, with a capital I where the lowercase l should be. On a phone screen, you would not notice.
  2. 2It replies to a real thread. Attackers often read the real emails first, so the names, the job and the amount are all correct.
  3. 3The money goes somewhere new. That one change is the whole attack.
  4. 4It steers you away from a phone call. A call to a number you already have is exactly what would expose it.

The habit that stops it: before changing where money goes, call the person at a number you already have. Never use a number from the email.

$2.9 billion

in reported losses from business email compromise in 2023, across 21,489 complaints to the FBI. That is out of about $12.5 billion in total reported losses from internet crime that year.

Source: FBI Internet Crime Complaint Center (IC3), 2023 Internet Crime Report.
Check your exposure

Check your exposure in 60 seconds.

Seven yes-or-no questions about how your company works today. You'll see where you stand, and the three moves that would help most.

  1. 01
    Do you call to confirm before changing anyone's payment details?Using a number you already have, not one from the email.
  2. 02
    Does everyone, subs included, use MFA on email?MFA is a second check when someone signs in, like a code on their phone.
  3. 03
    Are backups tested, and stored somewhere ransomware can't reach?“Tested” means someone restored files from them in the last few months.
  4. 04
    When a sub or employee leaves, is their access removed the same day?Email, project apps, shared drives and the Wi-Fi password.
  5. 05
    Do field devices lock, and can you wipe them remotely?Laptops, tablets and phones used on job sites.
  6. 06
    Do you have a written plan for who to call if you get hit?Your bank, your insurer, your IT team, and who makes the decisions.
  7. 07
    Does your team know how to spot and report a fake email?Including office staff who pay invoices.
Nothing you click here leaves your browser.No email, no form.
IT across the life of a project

From the bid to the warranty call.

Every stage of a job brings new people, new devices and new files. Pick a stage to see what tends to go wrong there and what we put in place.

Bid

Plans, specs and your numbers go out to people you may never have worked with. It is also when attackers find out who you are about to pay.

What can go wrong
  • Plans and bid numbers sent as attachments get forwarded well past the people who should see them.
  • Someone registers a look-alike of your web address and sends fake bid invites or invoices in your name.
What we set up
  • Secure plan sharing, with links that expire and a record of who opened them.
  • A watch on look-alike domains, so we see fakes registered in your name.
  • Email settings (SPF, DKIM and DMARC) that prove mail from your domain really came from you.
Software we already support

Keep the tools you already use.

You picked your software for good reasons. We look after the accounts, access, backups and connections around it, so it stays secure without getting in the crew's way.

ProcoreProject management

Accounts and MFA for staff, clean access for subs and owners, and removal when a job ends.

Autodesk Construction CloudPlans and project collaboration

User access by project and role, and a review of who can still see old jobs.

BluebeamPlan markup

Licenses, installs on field laptops, and shared sessions set up so the right people can join.

BuildertrendResidential project management

Staff and client logins, MFA, and offboarding when someone leaves.

Sage 300 CREConstruction accounting

The server or hosted setup, backups you can restore, and tight control over who can approve payments.

QuickBooksAccounting

Separate logins for each person, MFA, and a check on who has admin rights.

Microsoft 365Email, files and Teams

Set-up, MFA, email filtering, shared mailboxes and backups of mail and files.

Google WorkspaceEmail, files and Drive

The same care: sign-in protection, sharing rules for Drive, and backups.

Using something else? Ask on the call, and we will tell you honestly what we can look after.

Lenders and insurers

Questions your lender or insurer will ask, and the honest answers.

These questions show up on most cyber-insurance applications and lender security reviews in some form. Here is what each one means, and how we help you answer yes and back it up.

Ground Up Renovations

We run IT and security for builders and property teams across Southern California.

Client stories
Questions

What builders ask us.

Sources

  1. FBI Internet Crime Complaint Center, 2023 Internet Crime Report
Talk to us

Talk to an engineer who knows construction.

Fifteen minutes, no slides. Bring your questions, or the questionnaire sitting in your inbox.

Book a consultation 424.437.8173
On the call
  1. 01We ask how your office, crews and subs work today.
  2. 02We look at any lender or insurer questionnaire you are facing.
  3. 03You leave with the first thing to fix, in plain English.