Construction has gone cloud-first, and mostly for good reasons. Plans, RFIs, daily logs, change orders, and submittals now live in platforms like Procore, Autodesk Construction Cloud, and Bluebeam, reachable from a superintendent’s phone in a half-built stairwell as easily as from the trailer. The productivity gain is real. So is a new kind of exposure that has nothing to do with the platforms being insecure.
We’ll say the quiet part plainly: the cloud is not the risk. The major construction platforms are built by serious security teams and are almost certainly more hardened than the file server they replaced. The risk is moving to the cloud without a plan for who can see what, from which device, for how long. Nearly every cloud incident we’ve helped a contractor recover from traces back to configuration and discipline — not to the software.
The shift to cloud project platforms
A modern project generates an enormous amount of sensitive material: bid numbers and margins, signed contracts, architectural and structural drawings, subcontractor pricing, lien waivers, and the personal information of everyone on the crew. In the on-prem era, all of that sat behind one office door. Now it’s shared — deliberately — with owners, architects, dozens of subs, inspectors, and the occasional one-off vendor, across the life of a job that might run two years.
That sharing is the whole value of the platform. It’s also the whole problem. Every external party you grant access to is a key you’ve cut, and on a busy project those keys get cut fast, by people focused on hitting a deadline, not on tidy permissions.
Where the real risk lives
When we audit a contractor’s cloud setup, the findings are remarkably consistent. The platform is fine. The configuration around it tells a different story:
- “Anyone with the link” sharing. A drawing set or a financial export shared by public link “just to make it easy” is now reachable by anyone that link reaches — forwarded, screenshotted, or pasted into a group text.
- Everyone is an admin. Role-based access exists in every one of these platforms, but it takes a few minutes to set up, so accounts get created with far more access than the person’s job needs. A field foreman rarely needs to see project margins.
- Subs and vendors never get removed. Access granted for a three-week scope is still live a year later. The drywall sub from last spring can still open this project’s files.
- Personal devices, no guardrails. The job runs on personal phones with no screen lock, no way to wipe a lost device, and the same login reused on a dozen consumer apps.
How a jobsite leak actually happens
Picture a competitive bid. A project engineer exports the cost breakdown and shares it by open link with an estimator so they can review it over the weekend. The estimator forwards it to a colleague. Months later that colleague’s email is compromised in an unrelated phishing attack, and the attacker, sifting the mailbox, finds a still-live link to your margins. Nobody broke into your platform. A door was left propped open, and someone eventually wandered through it.
The same pattern produces the ransomware calls we get: a reused password from a personal breach unlocks a cloud account, the attacker finds a trove of drawings and financials, and now you’re weighing a payment demand against the contractual and legal fallout of leaked owner data. The entry point was never sophisticated. It was a configuration nobody owned.
The controls that matter on a jobsite
You don’t need a security team to close most of this gap. You need a handful of controls applied consistently:
- Configure roles on purpose. Map the access levels your platform offers to the actual jobs people do, and make the lowest-access role the default. Office staff, field crew, subs, and owners should each see only what their role requires.
- Turn off public links — or expire them. Default to named-person sharing. Where a link is genuinely necessary, set it to expire and require a login. A share that dies in seven days can’t leak in seven months.
- Multi-factor authentication for everyone. Including subs and the field. It’s the single highest-value control for accounts that live on personal phones and reused passwords.
- Offboard on a cadence. When a sub’s scope ends, their access ends. Build a recurring review — monthly is plenty — to sweep out everyone who no longer needs to be there.
- Manage the devices, lightly. Require a screen lock and the ability to remotely remove company data from a lost or stolen phone. This can be nearly invisible to the user and saves you on the day a device goes missing on site.
Designing for the field, not the office
Here is where construction is genuinely different, and where generic IT advice falls apart. Security that assumes a desk, a managed laptop, and steady wifi will be ignored on a jobsite — and ignored security is no security at all. The win is making the secure path the easy path: single sign-on so there’s one login to remember, MFA via an app the crew already has, and connectivity (bonded LTE or 5G at the trailer) good enough that nobody resorts to texting drawings around because the platform was too slow to load.
Train the field supervisors specifically — they’re the ones making sharing decisions under deadline pressure, and a ten-minute walkthrough of “share to a person, not a link” prevents more leaks than any policy document nobody reads.
Getting it right without slowing the crew
The goal isn’t to lock the platform down until it’s useless. It’s to get the same productivity you moved to the cloud for, without leaving the bid file readable by half the internet. That’s a configuration-and-habits project, and it pays for itself the first time it prevents a leak — or the first time an owner’s security questionnaire shows up and you can answer it in an afternoon instead of a panicked week.
We do this work for construction firms regularly: audit the current sharing and access state, configure roles and link policies to match how the project actually runs, wire up MFA and lightweight device management for the field, and put a recurring offboarding review in place so it stays clean. If you’d like a read on where your project data is currently exposed, we’ll walk your setup with you and hand you a one-page gap list. No platform migration required — usually it’s the settings you already have, set correctly.