The Jobsite You Can’t See: Why Construction Firms Need Cyber Insurance 

Building a stronger defense: Why construction companies need cyber insurance

Between worker injuries, equipment damage, project delays and subcontractor issues, construction companies are used to managing risk. However, one of the industry’s fastest-growing risks doesn’t necessarily happen on the jobsite. 

As construction companies increasingly rely on technology to manage projects, communicate with crews and subcontractors, process payments and store sensitive information, they’re also creating more opportunities for cybercriminals to get in. 

The problem is that consequences can reach far beyond an IT problem. A single cyberattack can affect clients and individuals by exposing data, disrupting payments, shutting down critical systems and stalling projects— and traditional insurance policies may not cover all the costs that follow.  

These reasons are why cyber insurance is becoming an essential part of a construction company’s risk management strategy. The right coverage can help protect a company’s finances, limit the impact of an attack and get a business and its projects back up and running. 

Why construction companies are a target for cyber threats

Construction companies may not seem like obvious targets for cybercriminals, but today’s contractors rely heavily on technology to keep projects moving. 

Employees, vendors and subcontractors may access company systems from different offices, jobsites and devices. Contractors also regularly exchange large payments and sensitive information with project owners, vendors and other partners. All those connections create potential entry points for cybercriminals. 

Not to mention, many contractors use legacy software and IT systems that aren’t regularly updated with protection software.  

These vulnerabilities expose contractors to common cyber threats, including: 

• Ransomware: Criminals lock a company out of its systems or data and demand payment to restore access. 
• Phishing: Fraudulent emails or messages trick employees into sharing credentials, opening malicious attachments or other actions that give attackers access. 
• Funds transfer and payment fraud: A criminal impersonates an executive, vendor or subcontractor to trick an employee into sending money to a fraudulent account. 
• Data breaches: Employee records, banking information, contracts and other confidential information are exposed or stolen. 
• Supply chain attacks: Criminals exploit vulnerabilities in subcontractors, suppliers, software providers or other third parties to gain access to a company’s systems. 

If systems go down, employees may not be able to send emails, sign contracts, transfer money or access project information, which can slow or even halt work. The disruption affects not only the contractor, but also project owners, employees, vendors and subcontractors. 

How cyber insurance protects construction companies

Most construction companies insure their physical operations against property damage, injuries and other liabilities. However, most traditional insurance policies aren’t designed to cover cyber and technology risks. 

Cyber insurance helps businesses manage the financial fallout from certain cyber incidents. Depending on the policy, coverage may include: 

• Cyber incident investigation and response: Forensic and other specialists can determine what happened, contain the attack and prevent further damage. 
• Data restoration and system recovery: Restore corrupted or encrypted data and repair systems needed to resume normal operations. 
• Business interruption and lost income: Replace lost income and cover certain extra expenses when a cyberattack disrupts operations or delays projects. 
• Ransomware and cyber extortion response: Cover the costs of responding to ransomware demands, including negotiation, investigation and recovery efforts. 
• Data breach notification and credit monitoring: Notify affected individuals and provide credit monitoring or identity protection services. 
• Legal and regulatory expenses: Cover legal counsel, regulatory response and certain fines or penalties, where insurable by law. 

Some policies also cover certain social engineering and funds transfer fraud losses, public relations and crisis management expenses, or liability arising from compromised information. 

Work with your broker to assess your risks and determine the appropriate coverage for your business. Cyber insurance should be tailored to your company’s size, project scope, technology and specific exposures. A GC managing multiple crews and jobsites has different exposures than an HVAC contractor running a small local team. 

Cyber insurance as part of your overall risk management strategy

Cyber insurance can help your construction company recover after an attack, but managing cyber risk starts before one happens.  

Your insurance broker, cyber carrier and IT provider can work together to identify vulnerabilities and strengthen your defenses. That might include: 

• Requiring unique passwords and multifactor authentication for email, financial accounts, remote access and other critical systems. 
• Installing security patches and software updates promptly. 
• Training employees regularly to recognize suspicious emails, links and attachments. 
• Maintaining secure, tested backups to restore critical data. 
• Regularly reviewing firewalls, access permissions and other cybersecurity controls. 

Regular assessments can uncover weaknesses and provide specific recommendations your IT team can address before a cybercriminal finds them. 

Oswald is helping clients through its Cyber RiskScript program. It takes a proactive approach to cyber risk by helping businesses better understand the threats they face, identify vulnerabilities and develop a customized plan to strengthen their defenses. 

Combined with the right cyber insurance coverage, these tools can help you build stronger protection against an evolving threat. So, if a cyberattack happens, you’ll have the right safeguards and coverage in place to get your systems — and your projects — back up and running.

Concerned about your organization’s cyber risk exposure? Complete the form below to connect with Oswald’s team and learn how cyber insurance and proactive risk management strategies can help protect your business, data and projects.