Cyber risk is no longer an office-only problem. For construction contractors, it now sits inside the everyday workflow: BIM models, project portals, payment instructions, subcontractor records, email accounts and cloud-based document systems.
The headline figure is difficult to ignore. Around 42% of small businesses were reported as experiencing a cyber breach or attack in 2025, although the Government’s terminology is worth explaining. The official Cyber Security Breaches Survey 2025 recorded 42% of small businesses reporting phishing attacks and 50% identifying any breach or attack. Either way, the practical message is the same: contractors are not too small to be targeted.
The same survey found that only 62% of small businesses had some form of cyber insurance, meaning roughly 35% to 40% did not. Cost is one reason, but unclear advice is another. Many business owners are unsure whether their existing commercial policy covers a payment scam, ransomware, data breach or the cost of recovering a project system.
That uncertainty is the gap contractors need to close.
Why construction businesses are exposed
Construction firms may not think of themselves as technology businesses, but many now depend on digital systems to keep projects moving.
A typical contractor could be using:
- BIM and digital design files
- Cloud-based project portals and common data environments
- Email approval chains for variations and payments
- Accounting and CIS systems
- Subcontractor bank details and payroll records
- Mobile devices used by site managers and commercial teams
- Shared folders containing tenders, pricing and technical documents
Each system creates another route into the business. A compromised email account may allow a criminal to monitor payment discussions for several weeks before sending a convincing request to change a subcontractor’s bank details. A stolen project-portal login may expose drawings, specifications and commercial information. Ransomware affecting a document system can delay decisions, valuations and handovers even when no physical damage has occurred.
The National Cyber Security Centre’s small organisations guidance makes the sensible point that many protective measures can be completed in minutes. Contractors do not need to become cyber-security specialists, but they do need to know what they rely on and where the financial consequences would fall.
The five-minute cyber check
1. Can someone access your key accounts with a password alone?
Check email, finance systems, BIM platforms and project portals. If important accounts do not have multi-factor authentication, or MFA, enabled, that should be treated as a priority.
MFA is not perfect, but it makes a stolen password much less useful to an attacker. It should be applied to directors’ accounts, finance staff, commercial managers, administrators and anyone with access to project or payment systems.
Also check whether former employees, temporary staff and completed subcontractors still have access. In construction, access can remain in place long after a project role has ended.
2. Could you recover your project files tomorrow?
Backups are only useful if they are separate from the systems being attacked and have been tested. Ask:
- Are BIM files and project documents backed up?
- Are finance and CIS records included?
- Are backups protected from ordinary user accounts?
- When was the last successful restoration test?
- Could the business continue if the main portal was unavailable for several days?
The Government survey found that temporary loss of access to files or networks was one of the most common negative outcomes reported by businesses. For contractors, the resulting cost may include overtime, rework, delayed payment applications, contractual arguments and lost management time.
3. Would your team verify a bank-detail change by telephone?
Email instructions are not enough for payment changes. A criminal who has compromised an account may know the names of the project manager, quantity surveyor and subcontractor, and may understand exactly when a payment is due.
Set a simple rule: any change to bank details must be confirmed using a known telephone number already held on your records, not a number included in the email. Larger payments should also require a second approval and, where practical, separation between setting up a payee and releasing funds.
This is one of the most important controls for a contractor because a payment-fraud loss may not be treated in the same way as a direct hacking incident.
4. Do you know what your existing insurance actually covers?
Do not assume that a standard Construction Contractor Insurance policy automatically provides broad cyber protection.
Public liability, employers’ liability, contract works and professional indemnity each respond to different types of risk. Some commercial policies may include limited cyber-related extensions or legal expenses, but that is not the same as having a dedicated cyber policy designed around your systems and exposures.
A cyber policy may provide cover for areas such as:
- Incident response and forensic investigation
- Legal and regulatory advice
- Data breach notification and communication costs
- Cyber extortion and ransomware, subject to policy terms
- Business interruption following a covered cyber event
- Restoration of data and systems
- Certain forms of funds-transfer or social-engineering fraud
- Third-party claims arising from a data or network security failure
The wording matters. A policy may cover a direct funds-transfer fraud but exclude a loss caused by an employee approving a fraudulent request. It may cover network interruption but not a delay penalty under a construction contract. It may respond to data restoration but not the cost of correcting defective work after a project file has been altered.
The right question is not simply, “Do we have cyber insurance?” It is, “Which of our actual construction exposures are insured, and which are not?”
5. Is your incident plan written down?
If an account is compromised at 8.30am on a Monday, people need to know what happens next. The first steps may include contacting the bank, isolating devices, preserving evidence, notifying the insurer and engaging an approved incident-response provider.
Write down:
- Who makes the initial decision?
- Who contacts the bank and IT provider?
- Which insurer or broker must be notified?
- Who communicates with clients and subcontractors?
- Where are emergency contact details stored if systems are unavailable?
Insurers increasingly want evidence of sensible controls, including MFA, secure backups, patching and an incident-response process. Better controls can also improve the quality of the insurance submission and help avoid unnecessary premium increases.
What cyber insurance will not solve
Insurance is not a substitute for good security, and it cannot turn every construction loss into an insured claim.
Criminal fines remain uninsurable as a matter of public policy. A fine imposed following a breach of the Health and Safety at Work etc. Act 1974 is not something a policy should be expected to pay. Defence costs and legal assistance may be covered under some policies, but the penalty itself is not.
This distinction matters because the regulatory environment is becoming less forgiving. The courts are also taking a harder approach to building safety responsibilities. Under the Building Safety Act 2022, a Building Liability Order can extend certain liabilities to associated companies where the court considers it just and equitable. Remediation Contribution Orders can also create significant civil exposures in the right circumstances.
Those are not cyber risks, but they show why contractors should not view insurance as a replacement for records, controls or compliance. Courts and regulators are unlikely to accept that a contractor’s insurance position excuses poor conduct.
What about the softer professional indemnity market?
There is some better news elsewhere. London construction professional indemnity renewal rates are expected to soften by around 5% to 10% in 2026 for good risks, with stronger results possible for well-managed businesses with good claims records and well-presented submissions.
That is welcome, but it does not remove the need to review cyber cover. Professional indemnity may respond to certain design or advisory liabilities, while cyber insurance deals with a different set of first-party and network-related events. There can be overlap, but there can also be gaps, particularly where a cyber incident causes project delay, payment fraud or loss of access to digital information.
A practical next step for contractors
At Moyak, we see the same problem regularly: businesses have bought insurance, but nobody has tested whether the cover reflects how the business operates today.
Our approach is individual rather than transactional. We take time to understand the contractor, the projects, the supply chain, the systems being used and the budget available. As a Business Insurance Broker in Essex, Kent and London, we work with leading master brokers and insurers to compare suitable options rather than forcing every client into the same package.
If your business uses BIM, project portals, online payment approvals or stores sensitive subcontractor and client data, ask for a structured review of your general contractor insurance and cyber exposures. We can also look at how cyber insurance sits alongside professional indemnity, public liability, employers’ liability and commercial combined insurance.
The five-minute check is a starting point, not a complete risk assessment. But it should quickly show where the most urgent gaps are.
Check the accounts. Test the backups. Verify payment changes. Read the exclusions. Write down the response plan.
That is how contractors move from hoping their insurance will respond to understanding what protection they have before a breach does the testing for them.