For years, construction sat near the bottom of the cyber-risk conversation. Contractors poured concrete and moved steel; data was somebody else’s problem. That assumption has aged badly. Ransomware activity against the construction sector rose 41 percent year over year in the period ending September 2024, measured by the number of firms appearing on criminal data-leak sites, and the sector now ranks among the most-targeted in the country. The attackers are not confused about where the money is — they have simply followed the industry that runs on wire transfers, tight schedules, and email.
The exposure divides into two threats that behave differently and, critically, are covered differently. The first is disruption. A ransomware event that locks a contractor’s project-management platform, accounting system, or design files does not merely inconvenience the office — it halts the field. Crews stand idle, subcontractors miss their windows, and liquidated-damages clocks keep running while the servers sit dark. The loss is rarely the ransom itself; it is the business interruption that follows, and on a schedule-driven project that interruption can dwarf the extortion demand.
The second threat is fraud, and it is the one draining accounts right now. Business email compromise — an attacker impersonating a vendor, an owner, or a company officer to redirect a payment — accounted for $3.04 billion in reported losses in 2025, according to the FBI’s Internet Crime Complaint Center, part of a record $20.9 billion in total cybercrime losses that year. Eighty-six percent of those business-email-compromise losses moved by wire transfer or ACH. Construction is a near-perfect target: large, routine payments between parties who have often never met in person, released under deadline pressure, frequently to a new bank account nobody thinks to question.
Here is where the coverage gap opens, and where contractors get hurt after the fact. Many owners assume a cyber policy answers for the fraudulent wire. Often it does not. Funds-transfer and social-engineering fraud sit at the seam between two separate policies — cyber and commercial crime — and neither reliably covers it by default. A crime policy may exclude losses where an employee was tricked into authorizing the transfer, on the theory that the payment was voluntary. A cyber policy may treat impersonation fraud as a sublimited add-on, with a limit far below the policy’s headline number. The contractor who bought both and still assumed the wire was covered can discover, mid-claim, that a fraudulent $400,000 payment falls into the space between them.
Closing that seam is a matter of deliberate structure, not more premium. A social-engineering fraud endorsement — added to either the cyber or the crime policy — is the mechanism, but the terms deserve scrutiny. Insurers frequently attach a sublimit, sometimes $100,000 or $250,000 against a loss that could run higher, and frequently condition payment on a call-back verification protocol the insured must actually follow. The endorsement protects the contractor who verifies payment changes by phone to a known number; it can leave exposed the one who does not. The control and the coverage are two halves of one safeguard.
The market, for once, is cooperating. While casualty lines climb under the weight of nuclear verdicts and social inflation, cyber is softening — 2026 renewals are landing flat to down modestly, and a small contractor can secure a $1 million cyber limit in the range of $1,200 to $1,800 a year. That contrast is worth naming plainly: the coverage that answers the fastest-growing exposure in the industry is also one of the more competitively priced lines a contractor will place this year. Underwriter appetite has expanded, and carriers are competing rather than retreating. The window to structure this coverage intentionally, rather than reactively after a loss, is open now.
What that structuring requires is the discipline to treat cyber as an operational risk rather than an IT afterthought. The exposure lives in the payment process, the vendor-onboarding process, and the project-data infrastructure — not in a server closet. That is precisely the ground our four-step Strategic Process is built to cover. Strategic Discovery surfaces where the firm actually moves money and stores project data. Risk Assessment models the business-interruption cost of a locked jobsite and the plausible size of a redirected wire. Solution Design places the ransomware, funds-transfer, and social-engineering pieces across the cyber and crime policies so the seam is closed and the sublimits are adequate. Ongoing Optimization revisits the verification controls and the limits as revenue, systems, and the vendor list evolve. The contractors who will weather this decade are not the ones who bought a policy — they are the ones who understood which loss it was built to answer.
— Ryan Mefford, President & Risk Advisor
Sources
- FBI Internet Crime Complaint Center — 2025 Internet Crime Report
- ReliaQuest — Ransomware Has Grown 41% for the Construction Industry
- Amwins — How Cyber and Crime Insurance Policies Respond to Social Engineering
- Grit Insurance — 2026 Construction Insurance Market Outlook
- Arthur J. Gallagher — 2026 Cyber Insurance Market Outlook
- Insurance Journal — Cyber-Enabled Fraud and How Insurance Can Help