Cybersecurity for Construction Firms in West Michigan
Construction firms lose more money to wire fraud and business email compromise than to any other attack. We help West Michigan GCs, subcontractors, and A/E/C firms stop those attacks and meet the cybersecurity requirements their clients now push down.
Book a Free Security AssessmentWhy Construction Is a Prime Target
Wire fraud and business email compromise are the dominant cybersecurity threat for construction, not ransomware. Construction projects move large sums of money on predictable schedules: draw requests, pay applications, subcontractor invoices, and supplier payments create a constant flow of high-value wire transfers. Attackers have learned to intercept these flows. FBI data consistently shows construction among the top three industries by BEC dollar loss. A single compromised email account at a subcontractor can redirect a $500,000 draw to an attacker's account in under an hour, and that money is almost never recovered once it crosses international banking rails.
The mobile, distributed nature of construction work creates a second major vulnerability. Project superintendents, foremen, estimators, and project managers work from job sites, trucks, and field trailers, on personal phones, shared tablets, and laptops connected to whatever WiFi is available. Personal devices holding project credentials, Procore access, and email accounts are routinely lost, stolen, or compromised. Company data sits on devices your IT department has never seen, managed, or secured.
Modern construction projects involve extraordinary amounts of data sharing across organizations that have no shared security standard. Owners, architects, engineers, GCs, subs, inspectors, lenders, and government reviewers all touch the same project documents, through Procore, Autodesk Construction Cloud, Box, Sharefile, or email. Every external party in that network is a potential attack vector. One compromised sub email account gives an attacker a foothold in the project communication chain, and insight into every wire transfer, draw request, and banking relationship on the job.
Construction ranks among the top 3 industries for BEC losses annually (FBI IC3 Report, 2024)
Median BEC loss per incident in construction, money that is rarely recoverable once wired
Typical window to attempt a wire recall after BEC fraud, most firms don't detect the fraud in time
of construction cyber incidents involve human error, phishing, credential reuse, or weak MFA practices
Wire Fraud and Business Email Compromise, How Attacks Actually Work
A typical construction BEC attack unfolds over days or weeks. The attacker first compromises a subcontractor's email account, usually through a credential phishing email that tricks an employee into entering their Microsoft 365 or Google password on a fake login page. With inbox access, the attacker reads weeks of email threads to understand active projects, payment relationships, upcoming draw dates, and the names of contacts at the GC. They identify an upcoming invoice or pay application and wait. When the real invoice is submitted, the attacker replies from the sub's actual email address, not a spoofed domain, saying that banking information has changed due to an account switch or bank merger. A new routing number and account number are provided. The GC's accounts payable processes the draw to the new account. The funds move within hours, routed through multiple domestic and international accounts. By the time anyone detects the discrepancy, the money is gone.
The defenses are specific and proven. MFA on every email account eliminates most initial credential theft, an attacker who has your password still can't log in without the second factor. DMARC, DKIM, and SPF email authentication records prevent external attackers from spoofing your domain in outbound attacks (protecting your firm from being used as the attack vector against others). A mandatory callback verification policy for any wire change request, voice call to a known number, not a reply email, stops the attack even if the email is convincing. Treasury segregation of duties ensures no single person can both approve and execute a wire. These controls together make BEC attacks against your firm dramatically harder to execute and dramatically easier to catch before the money moves.
Cybersecurity Requirements Flowing Down from Your Clients
Owners, developers, and institutions are increasingly embedding cybersecurity requirements into construction contracts before bid award. Healthcare systems building new facilities, universities running major capital programs, DoD and GSA construction contracts, and publicly traded real estate developers all now routinely ask GCs to demonstrate MFA across all accounts, EDR on all company devices, encrypted and tested backups, a written incident response plan, and wire-transfer verification procedures. Some owners require a third-party security attestation or a SOC 2 report from key contractors. Firms that can't produce this documentation are being passed over in competitive bids, not because of price or capability, but because the owner's risk management or cyber insurance policy requires it.
For construction firms pursuing Michigan state or local government projects, there is an additional layer: agencies are beginning to reference StateRAMP compliance for cloud-based project management tools used in state construction programs. If you use Procore or Autodesk Construction Cloud to deliver state-funded projects, your vendor's StateRAMP status, and your own security controls, may become part of contract qualification. For firms who also work with insurance agencies or financial institutions as building owners, NAIC Data Security Model Law requirements may be referenced in owner cybersecurity questionnaires as well.
Security Services Built for Construction
Scoped to your firm's size, project types, client requirements, and geographic footprint.
Wire-Fraud Prevention Program
Email security (DMARC, DKIM, SPF), AI-powered BEC detection, mandatory callback verification policy for wire changes, and treasury segregation of duties controls.
Mobile Device Management for Job Sites
MDM deployment for job-site iPads, iPhones, Android tablets, and rugged devices, enforcing encryption, remote wipe, app policies, and MFA without slowing field crews.
Multi-Site VPN and Secure Remote Access
Zero-trust VPN architecture connecting field offices, trailers, and job sites to corporate systems, replacing insecure RDP exposure with monitored, MFA-gated access.
Project Data Room Security
Access governance for Procore, Autodesk Construction Cloud, Box, and Sharefile, role-based permissions, MFA enforcement, sub access reviews, and audit logging.
Subcontractor and Vendor Access Controls
Formal sub access provisioning and deprovisioning workflows, credential hygiene enforcement, and quarterly access reviews that satisfy owner cybersecurity requirements.
Incident Response with Construction Playbooks
Pre-positioned IR retainer with wire-fraud recovery procedures, project continuity protocols, owner notification templates, and surety/bonding communication guidance.
Cyber Insurance and the Questionnaire Problem
Cyber insurance questionnaires for construction firms have become significantly more demanding. Carriers now require verified attestation of MFA on all remote access and privileged accounts, EDR deployed on all endpoints, offline or immutable backups tested within 90 days, a written and tested incident response plan, and, increasingly, documented wire-transfer verification procedures specifically addressing BEC. Getting these wrong on the application is not just a compliance problem: it's a coverage exclusion. If your firm experiences a wire fraud event and you attested to controls you didn't actually have, the carrier will deny the claim. Several West Michigan construction firms have been in exactly this position.
Our approach pairs a fractional CISO to own the security program with 24/7 monitoring to satisfy the continuous detection requirement carriers increasingly list as a preferred control. We also produce the evidence package, backup test results, MFA deployment reports, IR plan documentation, and BEC procedure sign-off, that gives your broker what they need to place coverage at the best available terms. The goal is to make your cyber insurance questionnaire a straightforward factual exercise, not a guessing game.
Related Services & Locations
Other industries we serve
Frequently Asked Questions
What's the biggest cybersecurity risk for a construction firm?
Wire fraud and business email compromise (BEC) are the dominant threat for construction firms, by a wide margin. A typical attack involves an attacker compromising a subcontractor's or supplier's email account, monitoring payment threads, and then inserting updated wire instructions into an ongoing invoice conversation. Draws go to the attacker's account, and by the time the fraud is detected, the money is gone and unrecoverable through normal banking channels. The FBI's Internet Crime Complaint Center consistently ranks the construction industry among the top BEC victims by dollar loss.
How do wire fraud attacks actually hit construction companies?
The attack usually starts with a credential phishing email targeting a subcontractor's controller or project accountant. Once inside their email, the attacker reads active invoice threads to understand the relationship, payment terms, and bank details. They then send a convincing reply, from the sub's actual email account, saying that banking information has changed, with a new routing number and account. The GC processes the draw to the new account. Money moves within hours, crossing multiple banks and often international borders. By the time anyone notices, the funds are irrecoverable. Defenses include MFA on all email accounts, DMARC/DKIM/SPF email authentication, a mandatory callback verification policy for any wire change request, and segregation of duties so no single person can both approve and execute a wire transfer.
Our clients are asking for 'cybersecurity attestations', what does that mean?
Cybersecurity attestations are formal declarations, often signed by an executive, that your organization has implemented specific security controls. Owners, particularly healthcare systems, universities, publicly traded companies, and government agencies, are increasingly requiring GCs and prime subs to attest to controls like MFA on all accounts, endpoint detection and response (EDR) on all devices, encrypted backups tested within 90 days, a written incident response plan, and wire-transfer verification procedures. Some ask for a SOC 2 report or a third-party security assessment. Evolv builds the control program that lets you sign those attestations truthfully and provides the documentation evidence to back them up.
Do construction firms need to worry about ransomware?
Yes, though wire fraud causes greater direct losses in construction. Ransomware hits construction firms through two primary vectors: phishing emails targeting office staff, and compromised remote access (RDP, VPN) with weak credentials or no MFA. When ransomware encrypts a construction firm's systems, it typically hits project management data, estimating databases, CAD/BIM files, contract documents, and accounting systems, all of which are needed to run active projects. Recovery without clean backups can take weeks. The business continuity impact on active contracts and bonding capacity can be severe. Ransomware-resilient backups and tested recovery procedures are essential even if wire fraud is the primary threat.
How do we secure Procore / Autodesk Construction Cloud access across subs?
Project management platforms like Procore, Autodesk Construction Cloud, Box, and Sharefile create a significant shared-access security challenge: dozens of subcontractors, vendors, inspectors, and owner representatives all touch the same project data environment. The baseline controls are: enforce MFA for all external users (most platforms support this), use role-based access so subs only see their own scope, review and revoke access at subcontract completion, audit the user roster monthly for departed employees still holding credentials, and never share login credentials across multiple individuals at a sub. For firms with sensitive project data (healthcare, government, DoD), additional controls like watermarking downloads and disabling bulk export prevent mass data exfiltration.
What should we do if we suspect a wire fraud is in progress right now?
Act immediately, speed is the only thing that can save the funds. First, call your bank's fraud line directly (not through email, use a known phone number) and request an emergency wire recall or freeze. Banks have a narrow window, often less than 24 hours, to attempt a recall before funds are moved internationally. Simultaneously, contact the FBI's IC3 at ic3.gov to file a complaint, which can trigger bank-to-bank communication to freeze destination accounts. Document everything: the fraudulent email thread, the wire confirmation, timestamps. Do not contact the attacker or the sub's compromised email, this tips them off to move funds faster. Then engage your incident response team to contain the compromised account and preserve evidence. Evolv's incident response retainer includes construction-specific wire fraud response procedures for exactly this scenario.
Serving Construction Firms Across West Michigan
Evolv serves GCs, subcontractors, and A/E/C firms across West Michigan and mid-Michigan , Grand Rapids (commercial GCs, healthcare facility construction, mixed-use development), Kalamazoo (higher-education capital projects, pharma facility construction), Holland (industrial and warehouse construction, automotive facility work), Muskegon (marine and port infrastructure, lakefront development), and Lansing (state government construction, capitol campus projects, MDOT-adjacent work). Each location page details on-site and remote security services available to construction firms in that area.
Ready to Stop Wire Fraud Before It Hits?
Book a free 30-minute security review. We'll assess your BEC exposure, email authentication posture, and wire-transfer controls, and give you a prioritized action plan.
Book a Free Security ReviewLet's build something extraordinary
Schedule a free discovery call with our solution architects. No pressure, just a conversation about what's possible.