Don't Make It Easy for Them: What Cybersecurity Awareness Month Means for A&E Firms

Most cyber attacks don't succeed because attackers are brilliant. They succeed because they're easy, such as a rushed click, an unverified request, and a file left open to more people than it should be. This October, Cybersecurity Awareness Month's theme, "Don't Make It Easy for Them," is a call to close that gap: to build the everyday habits that make an organization a harder target.

For architecture and engineering (A&E) firms, this isn't a new concept. It's the foundation of the work you've always done. For generations, A&E firms have helped shape communities by designing bridges, hospitals, schools and infrastructure people rely on every day. That work has always depended on trust. Today, that trust extends beyond the physical world to the digital designs, project files and data that keep projects moving forward.

Why This Theme Matters To A&E Firms

Architecture and engineering firms sit at an interesting intersection: you're responsible for physical infrastructure, but nearly everything that goes into designing and delivering it now lives digitally. BIM models, CAD files, structural calculations, client specifications and all of it moves between firms, consultants, and subcontractors long before a single beam goes up. Protecting that legacy means protecting both what gets built and the information that makes building possible.

What's Actually At Stake

For A&E firms, the risk isn't hypothetical or generic. It's already showing up globally. According to Deltek's Clarity Research, one in five North American A&E firms reported a successful cyber attack resulting in financial or reputational damage in the past three years, while 45% of firms across the UK, Germany, and Australia reported financial losses. The pattern in how those attempts arrive is just as telling as the number itself: phishing emails were cited by 93% of affected North American firms, spear-phishing or whaling by 75%, and social engineering calls by 47%. The most common attack vectors target people, not systems, so deception is aimed at whoever happens to be closest to the data.

That data lines up with what's most valuable to protect: proprietary designs and structural data represent years of expertise and client trust, and losing control of them has consequences that outlast a single project. Client information, from site details to contract terms, carries obligations that don't disappear once a project wraps. And because most projects involve multiple firms working from shared files and platforms, a single weak link anywhere in that chain can expose everyone connected to it.

What's Changing Right Now

A few shifts are worth paying attention to. Clients and firms are asking more detailed security questions before work even begins, such as what platforms you use, how access is controlled, and who else touches the data. Data and cybersecurity now rank among A&E firms' top three IT operations challenges, cited by 52% of North American firms in this year's Clarity research. This shift is also apparent in the UK, where cybersecurity has overtaken technology investment as firms' single biggest priority for 2026. Firms that have already been hit by an attack are far more likely to treat cybersecurity as a top 3 priority going forward (29%) than firms that haven't (17%), suggesting the smartest firms aren't waiting to be targeted before they act. To address these challenges, 48% of North American firms are writing updated security policies and procedures, nearly matching the 50% re-engineering business processes.

Looking ahead, the Clarity Study shows that North American firms are most concerned about ransomware or malware reaching internal systems (68%), fraud and theft such as invoice scams (48%), and client data breaches (47%). These concerns are echoed internationally, with 64% of UK firms being extremely concerned about cybersecurity risks and breaches, compared with 42% in Australia and 36% in Germany. This serves as a reminder that the threat A&E firms are bracing for isn't necessarily the one that's hit them yet.

There's also a useful distinction worth borrowing from how security leaders think about this problem: compliance is a baseline, not the finish line. Meeting a standard at a single point in time doesn't tell you how security holds up in the middle of a live project, when teams and access requirements are shifting week to week. And as deception tactics get more convincing, some now shaped with the help of AI, the traditional tells of a scam, awkward phrasing, an obviously fake number, are getting harder to spot. None of this means the sky is falling. It means the baseline for what "secure enough" looks like is moving, and firms that get ahead of it protect both their projects and their reputation.

What Resilience Looks Like In Practice

Resilience for an A&E firm doesn't require a security team the size of a Fortune 500 company. It requires a few consistent habits:

Verify access to shared project files rather than assuming everyone on the distribution list should still be there. Vet outside consultants and subcontractors before they touch project data, the same way you'd vet them for the quality of their work. And build basic security awareness into project teams, not just IT, since most risk enters through a person, not a firewall. According to the 2026 Verizon Data Breach Investigations Report, 62% of breaches involved the human element. There's a line worth keeping in mind here: the five most dangerous words in security are "I thought security did that." The firms that get ahead of that mindset treat security as everyone's job, not a department.

These aren't one-time fixes. They're habits, the same way quality control or client communication are habits built into how a firm delivers every project.

The Next Decade Starts With The Next Project

Hundreds of years of building didn't happen because of one breakthrough, it happened because firms showed up, project after project, and did the work of earning trust. Securing the next decade works the same way. It's not a single audit or a checklist you complete once. It's a habit built into how every project gets delivered, one file, one client relationship, and one project team at a time.

The firms that treat security as part of the craft and not an afterthought, are the ones best positioned to keep building what comes next.