Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Short answer: a 2022 report placed construction fifth among the sectors it assessed, with a risk score of 39. That was a composite, report-specific ranking—not a count of attacks and not proof that construction is still fifth today.
The latest UK government survey presents a more measured picture. Its 2025/2026 results put construction’s reported breach and attack rate close to the business average and found no statistically significant sector difference. Construction still has clear reasons to take cyber security seriously: firms hold sensitive project information, move large payments and rely on extensive digital supply chains.
As an Amazon Associate I earn from qualifying purchases.
What the 2022 “most at risk” headline actually measured
Building’s July 2022 coverage of the Hiscox Cyber Readiness Report gave construction a risk score of 39, ranking it fifth among the industries listed. The score combined two different ideas: how confident business leaders were that they could handle future attacks, and the number and cost of cyber events reported by the firms surveyed.
That distinction matters. A composite risk or readiness score is not the same as the percentage of construction companies attacked. It also cannot establish a worldwide ranking, because the result depends on the report’s sector list, sample, questions, weighting and fieldwork period. The original Hiscox report and full methodology are not available in the evidence for this article, so the score and fifth-place position should be attributed to Building’s account of Hiscox rather than treated as an independently verified current league table.
#1 Best Overall
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
In practical terms, the headline is best read as a warning that construction businesses in that 2022 sample faced a combination of costly incidents and relatively limited confidence in their ability to respond. It should not be repeated as “construction is the fifth-most-attacked industry today.”
What the latest UK evidence says
The Department for Science, Innovation and Technology and Home Office Cyber Security Breaches Survey 2025/2026 is a more recent benchmark for UK businesses. Its fieldwork took place from August to December 2025, and its percentages refer to the previous 12 months. The survey is UK-specific; it does not describe construction firms in other countries.
Recommended Free Tools
| Measure | Construction businesses | All businesses | How to interpret it |
|---|---|---|---|
| Identified a breach or attack in the previous 12 months | 45% | 43% | A broad measure covering reported breaches or attacks, not confirmed successful criminal intrusion in every case. |
| Reported cyber crime in the previous 12 months | 21% | 19% | A narrower category than any breach or attack. |
| Businesses reporting phishing as a breach or attack type | 38% of businesses | This is an all-business figure in the survey, not a construction-specific rate. | |
The 2025/2026 release says there were no other significant sector differences. The small gaps between construction and the all-business figures therefore should not be presented as proof that construction is unusually exposed in this latest survey.
The preceding Cyber Security Breaches Survey 2025 reported 40% of construction businesses and 43% of businesses overall identifying a breach or attack in the previous 12 months. It recorded cyber crime for 17% of construction businesses and 20% overall. Those figures come from a different release and should not be turned into a trend without checking the question wording, fieldwork and comparability. A change between releases may reflect sampling or methodology as well as real-world change.
Why construction still needs a serious cyber-security plan
A near-average survey result does not make an individual contractor safe. Construction projects connect owners, architects, engineers, surveyors, principal contractors, specialist subcontractors, manufacturers, merchants and building sellers. A compromise at one participant can expose documents or credentials used by others.
The National Cyber Security Centre (NCSC) and the Chartered Institute of Building (CIOB) guidance for small and medium-sized construction businesses and the wider supply chain divides the working environment into design, construction and handover. Each stage creates different digital dependencies:
- Design: drawings, specifications, surveys, planning material and client information are stored and shared electronically.
- Construction: scheduling, site reporting, procurement, invoices, plant systems and mobile access depend on connected accounts and devices.
- Handover: as-built information, operating manuals, access credentials and maintenance data must move to the client or facilities team.
The NCSC’s launch notice highlights spear-phishing, ransomware and supply-chain attacks. It also notes that construction firms handle sensitive data and high-value payments. That combination gives criminals several potential objectives: stealing information, encrypting files to demand a ransom, impersonating a supplier or redirecting a payment.
Sarah Lyons, NCSC Deputy Director for Economy and Society Engagement, described the practical principle this way: “As construction firms adopt more digital ways of working, it’s vital to put protective measures in place to stay safe online – in the same way you’d wear a hard hat on site.”
Rank #2
- WatchGuard Firebox T45 tabletop appliances bring enterprise-level network security to small office/branch office and retail environments. These appliances are small-footprint, cost-effective security powerhouses that deliver all the features present in WatchGuard’s higher-end UTM appliances, including all security capabilities, such as AI-powered anti-malware, threat correlation, and DNS-filtering.
- 5G and Wi-Fi 6 enabled models available. Up to 3.94 Gbps firewall throughput, 5 x 1Gb ports, 30 Branch Office VPNs
- Zero-touch deployment makes it possible to eliminate much of the labor involved in setting up a Firebox to connect to your network - all without having to leave your office. A robust, Cloud-based deployment and configuration tool comes standard with WatchGuard Firebox appliances. Local staff connects the device to power and the Internet, and the appliance connects to the Cloud for all its configuration settings.
- Firebox T45 models make network optimization easy. With integrated SD-WAN and optional 5G technology, you can ensure failover to the cellular network, minimize disruptive connectivity, and establish secure and reliable connections for small offices.
- Standard Support includes 24x7 access to technical support, with an unlimited number of incidents with a targeted response time of 24 hours for low priority, 8 hours for medium priority, 4 hours for high priority, and live calls for critical priority. Support is Web-Based and Phone-Based.
How the main attack routes work
Spear-phishing and account takeover
Spear-phishing is a targeted message designed to look as though it came from a client, director, quantity surveyor, subcontractor or software provider. It may ask a recipient to open a document, sign in to a portal or change bank details. If the attacker obtains a mailbox password, they can read project correspondence and send convincing follow-up messages from the compromised account.
Reduce the risk by using unique passwords, multi-factor authentication where available, and a second-person check for requests involving payment details, urgent transfers or new bank accounts. Staff should know how to report a suspicious message without replying to it.
Ransomware
Ransomware can make shared files, estimating data, payroll records or project documentation unavailable. The operational damage may exceed the ransom demand: work can stop, payment certificates may be delayed and a firm may be unable to prove what it delivered.
Backups are the recovery control, but only if they are protected from the same compromise. Keep more than one recoverable copy, maintain a version history, restrict who can delete backups and retain at least one copy disconnected from ordinary user accounts. Test restoration before an emergency.
Supply-chain compromise
Construction companies routinely grant external parties access to collaboration spaces, document systems, accounting platforms and remote support tools. An attacker may target a smaller supplier whose security is weaker, then use stolen credentials or a trusted connection to reach a larger project participant.
Share only the information and access a supplier needs, remove accounts when a contract ends, review external users regularly and require prompt notification of suspected incidents. A supplier’s size is not a substitute for checking how it protects accounts and data.
A practical resilience plan for a construction business
The NCSC and CIOB guidance turns the broad threat picture into actions that a small or medium-sized firm can assign and check.
1. Map critical information and access
List the systems used at design, construction and handover: email, file storage, estimating, accounting, payroll, project-management platforms, site tablets and remote-access tools. Record who administers each system, which suppliers connect to it and what would stop if it became unavailable. This inventory gives an incident team a starting point instead of forcing it to discover dependencies during an outage.
Rank #3
- Integration with Unifi Controller. Powerful firewall performance
- Convenient VLAN support. QoS for enterprise VoIP
- VPN server for secure communications. 10/100/1000Base-T
- 3 Ports - Management Port - SlotsGigabit Ethernet - Wall Mountable, Desktop
- Refer instruction manual for troubleshooting steps.
2. Back up business data and prove that recovery works
Identify the files whose loss would halt work or create legal, contractual or safety problems. Schedule backups, protect them with separate credentials and retain an offline or otherwise isolated copy. An external drive can be one physical component of that arrangement, but it must be disconnected when not being used, stored securely and checked by restoring sample files. A drive by itself is not a ransomware-resilience strategy.
3. Protect office computers and mobile devices
Apply operating-system and application updates, use supported anti-malware protection, enable device lock and encryption where appropriate, and remove software that no longer has a business purpose. Site devices deserve the same attention as office desktops: a lost tablet containing drawings or cached credentials can create an incident even when no one “hacks” the office network.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →4. Use passwords to protect data
Give every worker an individual account, prohibit shared administrator credentials and use long, unique passwords stored in an approved password manager. Turn on multi-factor authentication for email, cloud storage, finance systems and remote access. Review dormant accounts whenever employees, subcontractors or temporary staff leave a project.
5. Make phishing reporting routine
Teach staff to pause when a message creates urgency, secrecy or an unexpected payment change. They should verify a request through a known telephone number or a separate conversation, not through contact details in the suspicious message. Provide a simple reporting route and treat a near miss as useful information rather than a reason to blame the person who clicked.
6. Collaborate securely with suppliers and partners
Use named accounts and controlled project workspaces instead of sending sensitive files to uncontrolled personal addresses. Agree which party owns an account, how access is removed and how an incident is communicated. Before sharing a drawing set, client record or payment schedule, check that the recipient and the requested scope are genuine.
7. Prepare an incident response plan
Write down who can disconnect a device, who contacts the bank, who speaks to clients and who makes legal or regulatory notifications. Keep emergency contact numbers offline in case email is unavailable. Include a decision on when to involve specialist responders, insurers, law enforcement or the NCSC. Rehearse the plan with a short scenario such as a locked file server or a fraudulent change-of-bank-details request.
Free tools Windows power users keep installed
One-click scans. No signup required.
What to do when an attack is suspected
- Contain the immediate problem: disconnect a clearly compromised computer from networks, but do not wipe it or destroy evidence before receiving advice.
- Protect money and accounts: call the bank using a verified number if a payment or bank-detail change may be fraudulent; reset affected credentials from a clean device.
- Activate the response team: record the time, symptoms, systems affected and people involved, then use the contacts in the incident plan.
- Preserve evidence: keep suspicious emails, headers, invoices, logs and screenshots. Do not continue communicating with an attacker beyond what responders advise.
- Communicate carefully: tell project partners what they need to protect their own accounts and agree one person to issue updates.
- Recover methodically: restore from known-good backups, patch the weakness that allowed the incident and monitor accounts after systems return.
Fast isolation can limit spread, but an improvised shutdown can also destroy evidence or interrupt safety-critical operations. The response should therefore follow the written plan and the advice of qualified incident professionals.
How to judge future claims that construction is “most at risk”
Before accepting a ranking, check five details:
- Date and geography: a UK survey from 2025 cannot establish the situation worldwide in 2026.
- What is being measured: a readiness score, any breach or attack, cyber crime, financial loss and attempted attacks are different metrics.
- Reference period: “in the previous 12 months” is not the same as incidents recorded on the day of publication.
- Denominator and population: ask whether the sample covers all businesses, a size band, insured firms or respondents from selected sectors.
- Statistical significance: a percentage a few points above the average may not represent a meaningful sector difference.
Using those checks, the 2022 Hiscox result remains a dated warning about the firms and measures in that report. The 2025/2026 UK survey does not support calling construction one of the highest-exposure sectors on its own; it does support treating cyber security as a normal operational, financial and supply-chain responsibility for every construction business.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
