IT security for engineering firms: a practical guide
IT security for an engineering firm comes down to eight things: multi-factor sign-in, filtered email, protection on every computer, quick security updates, a managed firewall, trained staff, backups ransomware can't reach, and a plan for the day something gets through. Each one closes a common way in.
I'm Igor Dobrovolskiy, founder of As-Built IT in Raleigh. Before starting the company, I helped lead the technical recovery after a cyberattack across about 90 locations, and I've helped a firm of about 75 people recover from ransomware in the middle of active projects.
Engineers are excellent at load paths and terrible at passwords, and I say that with love. Gary's password, for instance, is the project number, and he changes it when the project changes. That's not security, that's a filing system.
On this page: The threats · Why you're a target · 8 steps · Multi-factor sign-in · Payment fraud · Sharing drawings · Updates · A real attack · If you're hit · Questions
The threats that actually hit engineering firms
The threats that hit engineering firms are mostly ordinary ones aimed at people, not movie-style hacking. Here they are, with what each looks like on a Tuesday and the defence that stops it.
Why engineering firms are a target
Engineering firms are a target because they hold valuable drawings and client data, and because money moves through them in large, regular payments. Criminals don't care that you're small; they care that you pay invoices.
Business email compromise, where someone poses as a vendor or colleague to redirect a payment, cost US victims about $3 billion in 2025, according to the FBI's Internet Crime Report. It needs no clever hacking at all, just one convincing email and one busy Friday.
8 IT security steps for an engineering firm
These eight steps cover the common ways in. None of them is exotic, which is the good news, and none of them works if it's only done halfway, which is the other news.
- Multi-factor sign-in on email and every key system
- Email filtering that catches phishing before staff see it
- Threat protection on every computer, including field laptops
- Security updates installed quickly, and weaknesses tracked
- A firewall that's managed and watched, not just installed
- Staff training, with harmless test emails to practise on
- Backups that ransomware can't change or delete
- A plan for the first hour if something gets through
Most of that list is what our cybersecurity services cover, and the backups are part of our backup and disaster recovery services. Gary's password strategy is, sadly, on neither.
Multi-factor sign-in: the single best step
CISA puts it plainly: strong passwords are no longer enough on their own, and multi-factor sign-in can block many common attacks. It asks for a second proof, like a tap on your phone, so a stolen password alone isn't enough to get in.
CISA also recommends phishing-resistant methods where you can, such as a small hardware security key. Yes, it's one more thing on the keyring. Your keyring will survive.
Left: a security key, the sturdiest kind of second step. Right: a field laptop that still needs a strong sign-in.
Payment fraud: the email that costs the most
The most expensive email an engineering firm can receive is a polite one asking you to update a vendor's bank details. The fix is a rule, not software: any change to payment details gets a phone call to a number you already had, never one from the email.
Multi-factor sign-in helps too, because many of these scams start with a real mailbox that's been broken into. Gary, if a vendor emails new bank details, the answer is a phone call, not a reply-all.
Sharing drawings safely with clients and reviewers
Engineering firms share drawings all day with clients, contractors and reviewers, so sharing is a big part of security. Use proper secure file sharing with access per project, links that expire, and nothing sent as an “anyone with the link” free-for-all.
Secure sharing with clients, contractors and reviewers is part of our IT services for engineering firms, along with file sync between offices.
Security updates: how fast is fast enough?
Fast. The UK's National Cyber Security Centre recommends installing updates for critical or high-risk weaknesses within 14 days of release.
Engineering firms sometimes delay updates because a CAD plug-in might break. That's a fair worry, so test them on one machine first, then roll them out, rather than leaving the whole office open for months.
A real ransomware attack, mid-project
Before As-Built IT, I helped a construction company of about 75 people that was hit by ransomware while several projects were active. We isolated the affected systems, rebuilt the infrastructure, restored files from clean backups and hardened security.
We brought the most urgent systems back first. All of that depends on clean backups existing before the attack, which is exactly why step seven is on the list.
Security isn't one product. It's eight boring habits, done every day, so the exciting day never comes.
If you're hit: the first hour
If you think you've been hit, disconnect the affected computers from the network and call your IT support straight away. Don't wait to be sure; a false alarm costs a phone call, a real one gets worse by the minute.
Then tell staff what not to touch, and keep notes of what happened and when. If you'd like that written down in advance, our free disaster recovery plan template has a first-hour checklist.
Security mistakes we see most often
- Multi-factor sign-in on email, but not on everything else
- Paying a changed invoice without a phone call
- Putting off updates because of one plug-in
- Backups on the same network ransomware can reach
And the classic: a password that's the project number. Gary has promised to stop. We'll check in March.
IT security questions from engineering firms
What is the biggest cyber threat to engineering firms?
For most small engineering firms it's email: phishing to steal passwords, and payment fraud that redirects invoices. Ransomware is less frequent but far more disruptive.
Do small engineering firms need cybersecurity?
Yes. Small firms hold valuable drawings and client data and make regular payments, which is what attackers look for, and they often have fewer defences than large firms.
What is business email compromise?
A scam where someone poses as a vendor, client or colleague, usually by email, to redirect a payment. The FBI reports it cost US victims about $3 billion in 2025.
How should engineering firms share drawings securely?
Use a secure file-sharing platform with access per project and links that expire, and avoid open “anyone with the link” sharing and email attachments for sensitive drawings.
What should we do first if we're hit by ransomware?
Disconnect the affected computers from the network, call your IT support immediately, tell staff what not to touch, and keep notes. Recovery then comes from clean backups.
Where to go from here
If your firm is in Raleigh or the Triangle, see what's in our cybersecurity services and IT services for engineering firms, or book a free 30-minute call.
Bring your worries and your password policy. Gary can bring the project number.
About the author
Igor Dobrovolskiy founded As-Built IT in Raleigh in 2026 after 15 years in IT, including helping lead the technical recovery after a major cyberattack at a global enterprise. He would like every firm to have a boring security story.