Why you
The invoice values are enormous
A retailer's average invoice is a few hundred dollars. A progress claim can be six figures. One successful redirection pays for a lot of effort, so the effort gets made.
Industries
Construction & building
Your office moves every few months. Your IT has to move with it.
Residential building is where we cut our teeth, and most of what we learned there travels straight across to commercial, civil and fit-out. Different jobs, same three headaches: getting a new site online, keeping everyone on the current drawing, and making sure the money goes where it's meant to.
Why builders ring us
Nobody in construction buys IT for compliance reasons.
We'll get to security further down, and it matters more than you'd think. But let's not pretend. Nobody has ever rung us because they woke up worrying about their patching cadence.
Builders ring for one of three reasons, and they're always urgent when they land.
- "A head contractor sent us a security questionnaire and we can't answer it." Forty questions about controls, due Friday, and the tender depends on it.
- "We nearly paid a fake invoice." Or worse, the past tense. Progress claim, right amount, wrong account.
- "We're opening a site next month and it has to work from day one." Usually said about three weeks later than it should have been.
Payment redirection fraud
Construction is the ideal target, and the industry habits make it worse.
Business email compromise and payment redirection are among the top categories the Australian Signals Directorate reports for business. It isn't clever hacking. Someone reads an email thread, waits for a progress claim, and sends a polite note saying the bank details have changed.
Why you
You deal with hundreds of parties
Subbies, suppliers, certifiers, engineers, the client. New email addresses appear on a project constantly. A slightly-wrong domain in a long thread does not stand out.
Why you
Emailing bank details is normal here
In construction, sending account details in a PDF attachment is just how it's done. That norm is exactly the thing being exploited, and it's the one thing you can change this week.
What we put in place
- Impersonation and look-alike domain protection. Mail filtering that flags a display name pretending to be your quantity surveyor, and domains one character off your suppliers'.
- External sender warnings that people actually read. Not the banner everyone learned to ignore in 2021 — a clear one, on first contact from a new address.
- MFA everywhere, including the accounts nobody remembers. Most compromises start with one mailbox that was excluded from a conditional access policy for convenience.
- Mailbox rule alerting. The first thing an attacker does is create a rule that hides replies from the real supplier. That's detectable, and most setups aren't watching for it.
- A bank detail change procedure on paper. Any change to account details gets verified by phone, on a number you already had, by someone who isn't the person who received the email. Boring. Works.
Being honest about this
No control stops every attempt. The technical side gets you most of the way, and the last bit is a phone call your accounts payable person is allowed to make without feeling awkward about it.
If you've already been hit, ring your bank first and us second. Recovery depends on hours, not days. Then we work out how they got in, because they usually still have access when people start cleaning up.
New site mobilisation
Getting a site working on the first morning, not the third week.
Every new project is a new office, usually on a block of dirt with no fixed line and no prospect of one. NBN provisioning at a new address can take longer than the slab does. So we stop treating it as the plan.
-
Four to six weeks out: we ask about the site, not the office
Where is it, what carrier coverage is there, how many people will be in the shed, and what do they need to open — full drawing sets or just a job app. Coverage varies enormously between carriers on the same street, and it's cheap to check before you commit.
-
Connectivity that doesn't depend on a provisioning queue
A 4G or 5G router in the shed, sized for the crew, with a data plan that suits how you actually work. If the project runs long enough to justify a fixed service, we order it in parallel and cut over when it lands — with the mobile service kept as failover rather than thrown out.
-
The shed kit, pre-built before it leaves
Router, Wi-Fi that reaches the far end of the shed, printer if you still need one, and whatever screens the foreman wants. Configured and tested here, so on site it's a power lead and a photo of the signal bars, not a two-hour phone call.
-
Day one: the foreman opens the current drawings and it just works
Devices already enrolled, files already synced before they leave the depot, project platform already logged in. If the first morning involves someone reading out a password over the phone, we've done it wrong.
-
Handover: the kit comes back and the access goes away
Site closes, hardware gets collected, wiped and reissued instead of living in someone's shed forever. Project-specific accounts and guest access get revoked on the same day. This is the step everyone skips.
Drawings and file sync
The expensive mistake is someone building to a superseded plan.
Rectification work doesn't come out of the IT budget, which is probably why this rarely gets treated as an IT problem. It is one.
The usual causes are dull: a set of PDFs emailed to a subbie in March and never revisited. A sync client quietly failing on a laptop with two bars of signal. Files parked in someone's personal OneDrive because it was quicker. A folder structure only one person understands, and she's on leave.
SharePoint and OneDrive are perfectly capable of handling large drawing sets across dozens of people on ordinary connections. But at scale they need setting up deliberately, not accumulating.
What we change
- One source of truth per project. Drawings live in the project platform or in SharePoint — not both, not sometimes.
- Files On-Demand, configured properly. Devices don't try to pull sixty gigabytes of revisions down a 4G link. They fetch what's opened.
- Sync health monitoring. We see a device that's stopped syncing before the person using it does.
- Links, not attachments. A link always resolves to the current revision. A PDF attachment is frozen at the moment it was sent.
- Retention and archive that suit your warranty period. When a defect claim arrives in four years, the file history is still there.
External and subcontractor access
Guest access that expires. Because nobody remembers to turn it off.
A mid-size builder can have a hundred external people holding access to project data at once. The access gets granted quickly, because the job needs it. It almost never gets removed.
| Who | What they need | What usually happens | What we do instead |
|---|---|---|---|
| Subcontractors | Current drawings, variations, RFIs for one project | Added as a guest to the whole project site, still there two years after practical completion | Access scoped to one project, with an expiry date set when it's granted |
| Consultants and engineers | A specific document set, often two-way | Files emailed back and forth until nobody knows which version is live | A shared library with version history and an access review each quarter |
| Clients | Progress photos, selections, schedules | A personal Dropbox somebody set up in a hurry | A client area in your own tenancy, so it leaves with the project, not with the staff member |
| Former staff | Nothing | Mailbox still active, still synced to a phone, still in the project platform | One offboarding checklist covering Microsoft 365, the project platform and the phone |
Identity is the whole game
When a project manager leaves, the question isn't whether you disabled their email. It's whether they still have Procore, the Autodesk account, the shared site Wi-Fi password and the supplier portal login. If those were all set up separately by whoever needed them at the time, nobody has a list.
Single sign-on through Microsoft 365, wherever the platform supports it, turns that from an archaeology project into one switch.
Devices that live in utes
iPads on site get dropped, drowned, left on a tailgate and occasionally stolen. Phones are usually personal. Neither is a reason to panic, but both are a reason to have enrolment and remote wipe sorted before it happens rather than after.
For personal phones we separate work data from the rest of the device, so wiping the company side doesn't take somebody's family photos with it. That distinction matters a lot to the person holding the phone.
If the questionnaire has already landed
Send it to us and we'll fill it in. Head contractors and government buyers increasingly import the ACSC Essential Eight into their prequalification, whether they name it or not. We answer honestly, flag what you can't claim yet, and tell you what it costs to turn a "no" into a "yes" before the next one arrives.
Work we've done
Builders have been our home ground for years.
Residential, mostly. The problems turned out to travel — site-based staff, external parties needing access, and systems that stop the business when they stop.
Opening a site soon? Start the conversation early.
Four weeks of notice makes a new site boring. Four days makes it a scramble. Book a free review and we'll tell you what your current setup would do on day one — in writing, whether or not you use us.
Where to next
Cyber security & Essential Eight
The questionnaire answers, and the controls behind them.
Read moreCloud & infrastructure
Site networks, connectivity and migrations that finish on schedule.
Read moreMicrosoft 365
SharePoint that holds drawings properly, and sharing you can audit.
Read moreOther industries we work in: Manufacturing & trades and Healthcare & allied health.