Although the 2026 Travelers Risk Index reports U.S. businesses ranked cyber threats as the top overall concern in 2026, cyber threats were ranked 10th for construction companies, according to Construction Dive. Additionally, 48% of all construction companies surveyed said they consider themselves not big or complex enough to be the victim of a major cyberattack.
However, attorneys say small companies often are the weakest link when it comes to cybersecurity, especially when they are performing work for larger contractors with billions of dollars in revenue.
Trent Cotney, NRCA general counsel and partner and construction team leader for Adams & Reese, Tampa, Fla., said contractors’ systems typically are less sophisticated “the more you go down the food chain.”
“As you become a sub, or a sub of a sub, your net revenue is less,” Cotney said. “And as a result, your risk mitigation is probably less as well.”
Email scams allow hackers to take control of a user’s account, such as accounts payable, and send out invoices on their behalf. For a contractor lower on the food chain, the email and invoice may look like a typical request for payment from a known sender. Then, for example, if a payment is made to the hacker via wire, the money moves quickly and can be more difficult to recover.
The rapid growth of artificial intelligence reportedly has made cybersecurity concerns even worse because cybercriminals can use AI to to gain unauthorized access to systems more quickly.
“With AI now, it’s basically automated,” Cotney said. “Hackers can use agents to basically engage in these hostile attacks without even doing anything. They’re constantly probing and looking for potential issues.”
Additionally, because phishing emails now often are written by generative AI, there are no spelling or grammar errors that make it easy to flag false communications.
As cybersecurity risks become increasingly difficult, Malcolm Jack, chief technology officer at Granite Construction, Watsonville, Calif., said the industry needs to “lock arms” around cybersecurity as it does with physical safety.
“In construction, we don’t look at safety as a competitive advantage,” Jack said. “We have Safety Week. We bond together. If there’s that new safety methodology in which we can help each other or help protect our workers, we share it. We need to have the same mindset for cybersecurity, that cybersecurity is not necessarily a competitive advantage. It is something we need to share with one another.”
Attorneys recommend writing protections into the contract; hiring outside firms to deploy penetration tests of your system; considering a cybersecurity insurance policy; and implementing regular training for employees to help them recognize and avoid attacks.
“The best thing that you can do is at least be able to show your customer and the public that you took all the precautions you could possibly take,” Cotney said. “You still got breached, but you did everything you’re supposed to do.”
