A ransomware attack on a 30-person construction firm is really eight separate costs, and the ransom demand is rarely the largest one. This post walks through the four structural features of construction work that widen your exposure, the eight cost lines that pile up while you're down, the one variable driving majority of the costs, and why paying the ransom is not a recovery plan. As you go, think about your crew count, your loaded rates, your draw amount, and your bid pipeline, and you'll finish with a working idea of what an outage would cost your firm.
Why the Ransom Is Rarely the Biggest Number
When a firm gets hit, everyone stares at the ransom. It's the number on the screen, it has a deadline attached, and it feels like the decision that determines everything else. The conversation becomes "do we pay or not".
The ransom is one number, but there are seven other invisible numbers you need to be aware of. These numbers multiply by the number of days you're down. A firm that recovers in two days and a firm that recovers in fourteen can face the same demand and end up with costs that are miles apart.
Four Things That Make a Construction Firm More Exposed
A 30-person insurance agency and a 30-person subcontractor do not have the same exposure. Four structural features of the construction business drive the difference:
- Cash flow is tied to a monthly draw cycle. You submit a pay application and if you miss it, the money arrives a cycle later.
- The deadlines don't move because you had an outage. Concrete pours, inspections, crane time, submittal due dates, and bid dates are all set by other people. Nobody is rescheduling a pour because your file server is encrypted.
- File access is shared across firms. Drawings, models, and submittals move between you, the GC, the architect, and your own subs and vendors. That's a wide attack surface, and it's also a wide notification obligation when something goes wrong.
- Some field devices can live outside the office network. Trailer laptops, tablets in trucks, the superintendent's personal device with a synced project folder. They're often the entry point and the reinfection point during recovery.
8 Common Costs Associated with Ransomware
- Stopped field production.
- Stopped office production.
- Recovery and remediation labor. Think outside incident response and forensics engagement, plus internal people pulled onto recovery.
- Delayed billing and draw impact.
- Schedule delay exposure.
- Contractual and notification obligations. Think counsel time to review your contracts and notification duties. Most master subcontract agreements contain a data incident notification clause with a clock on it.
- Lost bids. A firm that can't run a takeoff can't bid and bid dates don't slide. This line is pure lost future revenue.
- The ransom itself - if paid.
What Actually Reduces the Number
One variable will show up in almost every item above: days down. Recovery time is the single biggest lever on the total, and it's the one you can buy down in advance. Everything below is aimed at that variable.
- Tested, offline or immutable backups.
This is the whole ballgame. Backups that ransomware can also encrypt are not useful. Modern attacks look for the backup system first and destroy it before triggering. You need copies the attacker cannot reach or alter, and you need a documented restore test periodically so recovery time is a measured fact instead of a hope.
- Managed EDR on every device, including field devices.
Endpoint detection and response, include ransomware detection, is what catches behavior early enough to help contain it. The devices most often missing it are the field ones.
- MFA everywhere, with no executive exemptions.
A large share of these events start with one stolen password on an account that had no second factor. Owner and PM accounts are the ones attackers want, because they have the broadest file access.
- A written incident response plan.
This one is undervalued and it directly shortens days down. The plan names who decides, who calls counsel, who calls the carrier, who notifies the GC, and what the restore order is - systems that unblock the draw submission first, not whatever is easiest to bring up. Without it, you lose the first day and a half to deciding who's in charge.
- Access scoped by role.
If an estimator's compromised account can reach every project folder in the company, one endpoint becomes a company-wide event. Scoped access shrinks the blast radius before anything happens.
These same controls are what most cyber insurance carriers now require, which means the money you spend here does double duty.
Paying the Ransom Is Not a Recovery Plan
We'll be blunt, because this is the section that matters when it's three in the morning and the demand is on the screen.
Paying is not a recovery plan. It's a purchase with no warranty, from a counterparty whose entire business model is bad faith. You may get a decryption key that works on some systems and not others. You may get a key that works and still spend a week rebuilding, because you cannot trust any machine that was in the attacker's hands. And if data was stolen before encryption, which is usually what they do, paying doesn't retrieve it. It buys a "promise" to delete it.
Why Construction Firms Work With Alexaur
We've supported architecture, engineering, and construction firms across Katy, TX and Greater West Houston since 2001, and we're still family-owned. The person who answers your call knows why the trailer machine matters.
- 98% of support tickets resolved on the first call
- Average client tenure of more than 10 years
- 100+ combined years of cybersecurity experience on staff
- Clients who have implemented our full security and business continuity recommendations have not reported a business-disrupting security incident.
- Fluent in the software you actually run: AutoCAD, Revit, Bluebeam, SolidWorks, Procore, Navisworks, ProjectWise, and OnScreen Takeoff.
- Dell & Lenovo Partner
- Managed Protection Security Suite Associate Accreditation
- MSP Pro
- Keeper Sales Professional
- Network+ Certified
- SonicWall Certified
Run Your Number, Then Decide
Take fifteen minutes and put a rough dollar figure on the cost lines above, using your own crew count, loaded rates, draw amount, and bid pipeline. Whatever total you get, that's your firm's exposure for a single outage, and dividing it by days down tells you exactly what faster recovery is worth.
Book a 15-minute discovery call and bring your numbers. We'll walk through the costs, assess your exposure, and tell you honestly how long your current setup will take to recover (if at all).
Call 281-646-1200 or email results@alexaur.com
