In construction, every day is a race against time as you try to complete projects on schedule. Now imagine getting hit by a ransomware attack that locks you out of your digital systems. You’re probably going to lose that race, and potentially a substantial amount of money.

Reviewing the concept

Ransomware is a type of malicious software (or “malware”) that typically infiltrates a computer network in various ways. These may include phishing emails or texts (phony messages that fool employees), downloads from fake websites, compromised login credentials, or removable devices (such as flash drives).

After malware encrypts its target’s data, cyberattackers demand a ransom payment in exchange for the decryption key. Sometimes they threaten to publicly release or destroy sensitive data if the ransom isn’t paid.

Following best practices

A good place to start preventing ransomware attacks is by conducting periodic assessments that evaluate your exposure and eliminate vulnerabilities. Maintain an inventory of your hardware, software, internet connections and data to identify potentially exploitable entry points.

Also, create secure backups to help you resume operations quickly if a ransomware attack encrypts or destroys your data. Your backup system should be encrypted and physically or digitally segregated from the systems it’s supporting.

Implement protective software, too. One example is an email filtering program that flags malicious messages and prevents them from reaching their targets. In addition, ensure every computer and mobile device used for business purposes has the latest updates and security patches.

Watch out for third-party risks as well. Do vendors or other stakeholders (such as architects, engineers or subcontractors) have access to your systems? If so, be sure they follow your protocols.

Last, train and regularly remind employees to spot and avoid phishing emails and other threats. Require staff to use strong passwords, multifactor authentication and other techniques to prevent unauthorized access. If possible, restrict the use of personal devices on your network.

Checking out cyber insurance

For added peace of mind, consider cyber insurance. The right coverage can help pay for data recovery and system restoration, legal expenses, and even business interruption losses.

Many insurers also provide resources, such as incident response teams or ransom negotiation support, to help covered businesses defend against ransomware and other threats. But these policies tend to be expensive, and underwriters may require certain internal controls to be in place, so shop carefully.

Maintaining your defenses

Ransomware is more than a technology issue. It’s an operational and financial threat that can stall projects, jeopardize sensitive data and create costly delays. Work with your leadership team and professional advisors to keep your defenses strong.

© 2026