Contractors · Cybersecurity & Resilience

Cybersecurity for contractors

Protect contractors from payment fraud, compromised email, and ransomware with MFA, account cleanup, verified payment changes, and tested backups.

Construction payments are large and frequent, which makes contractors a target for business email compromise. An attacker who gets into a mailbox can send convincing requests to change bank details on an upcoming draw. Ransomware is the other common threat, and it hits hardest during bid deadlines and closeouts.

We focus on the defenses that stop the common attacks. That means multi-factor authentication on email and banking, removing shared and stale accounts, a mandatory phone verification for any change to payment details, backups that restore, and short phishing training for office staff and project managers.

Things to keep in mind

  • Verify bank detail changes by phone, using a number you already have.
  • Former employees' accounts are a common entry point, so disable them promptly.
  • Insurance applications increasingly ask about MFA and backups.

How it works

  1. Assess

    Review email, accounts, devices, backups, and how payment changes are approved.

  2. Lock down email

    Enforce MFA and remove unused accounts and forwarding rules.

  3. Verify payments

    Require a call-back to a known number for any bank detail change.

  4. Back up and test

    Protect project files and accounting data with tested restores.

Frequently asked questions

What is business email compromise?

An attacker uses a compromised or look-alike email account to trick someone into paying them. See phishing in our glossary.

Where should a small contractor start?

MFA on email, a call-back rule for payment changes, and tested backups.

Talk through Cybersecurity & Resilience for your business.

Tell us what needs to work better. We reply within one business day with a clear next step.