For most contractors, data security comes down to a short list: require multi-factor authentication, verify every change to bank details by phone, give each person their own login, shut off access the day someone leaves, keep backups an attacker cannot reach, and hold software vendors to written security terms.
Plan reviews connect field conditions, drawings, and the next decisions on a job. AI-generated illustration.
Construction data security is mostly about protecting money, not secrets. Contractors move large payments to subs and suppliers on predictable schedules, handle bank details and Social Security numbers for payroll, and share drawings and pay apps with dozens of outside companies. That makes a mid-size GC or trade contractor an attractive target. The basics that stop most problems are not expensive: multi-factor authentication, a call-back rule for payment changes, one login per person, fast offboarding, reliable backups, and clear rules for vendors.
Why construction companies get targeted
The FBI's Internet Crime Complaint Center (IC3) 2024 report lists business email compromise (BEC) at 21,442 complaints and $2,770,151,146 in reported losses for the year. BEC is the scam where a criminal poses as a known vendor or executive by email and asks for a payment or a change in bank details. Construction fits the pattern almost perfectly:
Large, recurring payments to subs and suppliers, often by ACH or wire.
Many outside parties emailing invoices, lien waivers, and pay apps, so an unfamiliar sender does not look odd.
Office staff under pressure to pay before a deadline so a crew keeps working.
Field staff on shared tablets and personal phones.
Payroll files holding Social Security numbers and bank accounts for every worker.
The 8 security basics every contractor should have
Turn on multi-factor authentication (MFA) everywhere. Email first, then banking, accounting, payroll, and project software. CISA recommends requiring MFA wherever possible, starting with admin accounts and people who handle sensitive data, and using the strongest method available (security keys or authenticator apps over text-message codes).
Verify every bank change by phone. Any request to change where a sub, supplier, or employee gets paid is confirmed by calling a number you already have on file, never one in the email. The FTC recommends verification steps like calling to confirm wire transfers.
Give everyone their own login. No shared "jobsite" account on the tablet. Individual logins give you an audit trail and let you remove one person without changing everyone's password.
Offboard the same day. When a PM, super, or bookkeeper leaves, disable email, project software, accounting, shared drives, and bank access before they leave the building.
Use strong, unique passwords. The FTC suggests at least 12 characters or a passphrase of random words, and never reusing passwords. A password manager makes this realistic.
Back up and keep a copy offline. The FTC recommends regular backups kept disconnected from your network so ransomware cannot reach them. Test a restore at least once.
Patch and update. Phones, laptops, routers, and the office server. Unpatched systems are a common entry point.
Set role-based permissions. Subs see their own scope, foremen cannot approve payments, and only two or three people can change vendor bank details.
Worked example: stopping a fake bank change
Say your concrete supplier is owed $86,400 on the 15th. On the 12th, accounts payable gets an email from what looks like the supplier's credit manager: new bank, new account number, please update before this payment. The email signature is right and the invoice attached is real (the supplier's mailbox was compromised).
Example only
Step
Without a process
With a call-back rule
Email arrives
AP updates the vendor record and pays on the 15th
AP flags the request as a bank change and does not touch the vendor record
Verification
None
AP calls the supplier's office number from the vendor file, not the email
Result
$86,400 goes to a criminal; the supplier is still unpaid and may file a lien
Supplier confirms it never changed banks; payment goes to the right account
Follow-up
Discovered weeks later when the supplier calls
Supplier is warned its email is compromised; incident reported
Write the rule down, train AP on it, and require a second person to approve any change to vendor or employee bank details. If you discover a fraudulent transfer, contact your bank immediately and file a complaint with IC3; the IC3 report describes a Recovery Asset Team that works with banks to try to freeze funds.
Protecting project documents and field devices
Share drawings and documents through your project software or a controlled link with expiration, not through personal email attachments.
Lock phones and tablets with a PIN, turn on device location and remote wipe, and keep a list of which device is on which job.
Separate guest Wi-Fi in the job trailer from the network your office laptop uses.
Store payroll and personnel files with access limited to the people who process them.
Keep a document retention schedule so old files with Social Security numbers are destroyed when they are no longer needed.
Holding software vendors to a standard
Your project management, payroll, and accounting vendors hold your most sensitive data. The FTC advises putting security requirements in vendor contracts, verifying compliance instead of taking the vendor's word, limiting vendor access to what they need, and encrypting data sent to and stored by vendors. Before signing, ask whether the software supports MFA for every user, role-based permissions, an audit log, and a full data export. The cloud-based construction software explained guide lists more questions.
Write a one-page security policy
A 30-person contractor does not need a binder. It needs one page everyone signs at hire and reviews once a year. Keep it short enough that a foreman will actually read it:
Who can approve payments, and who can change vendor or employee bank details (two different people).
The call-back rule for any payment change, with the words "never use the number in the email."
MFA is required on email and every business app; no exceptions for the owner.
Company devices are locked with a PIN, and lost devices are reported the same day.
Who to call when something looks wrong, and that reporting a mistake quickly will never get anyone in trouble.
That last line matters. A bookkeeper who clicked a bad link and reports it within ten minutes is an asset. One who hides it out of fear turns a small problem into a large one.
Mistakes to avoid
Treating security as an IT project instead of an accounts payable process. Most losses start with an email and end with a payment.
Using text-message codes when an authenticator app is available.
Keeping a former employee's email active "to catch messages." Forward it to a manager instead and disable the login.
Having no plan for a ransomware day. The FTC recommends keeping a plan to run the business during an attack.
What is the biggest cybersecurity risk for contractors?+
For many contractors it is payment fraud through email, where a criminal poses as a sub, supplier, or executive and redirects a payment. A strict call-back rule for any bank change prevents most of it.
Do small contractors need cyber insurance?+
Many carriers now offer it and some require controls like MFA and backups before they will quote. Talk to your broker about what the policy covers, including funds transfer fraud, which is sometimes excluded or sublimited.
Is text-message MFA good enough?+
It is better than no MFA. CISA ranks text or email codes as the weakest option and recommends security keys or authenticator apps where available.
What should we do if we sent money to a fraudster?+
Call your bank right away and ask it to recall the transfer, then file a complaint with the FBI's IC3. Speed matters for any chance of recovery.
How often should we back up?+
Often enough that losing the data since the last backup would be tolerable. Keep at least one copy disconnected from the network and test that you can restore it.
Revenue can rise while cash, margin, and field control deteriorate. This Season 3 premiere builds a five-number Monday control room for construction decision-makers: 13-week projected cash coverage, margin fade, billing position, cost incurred on unapproved changes, and labor-hour variance.
The briefing maps the inputs, formulas, meeting cadence, red flags, human approvals, and automation workflow required to turn delayed reports into management alerts.
Starts muted when the player comes into view.
Read the full episode transcript
Published transcript from Scaling Legends. It may contain transcription errors. View the source transcript.
Welcome to this AI -assisted Scaling Legends decision briefing. We're bypassing the usual pleasantries today because, well, the financial data we're examining demands immediate attention. Yeah. On July 6, 2026, the Construction Financial Management Association documented a highly revealing operational scenario that, well, every executive needs to hear. Right. Consider a contractor holding a $2 million contract. They incurred $960 ,000 in costs. And they generate billings of $1 .3 million. Okay. So on the surface, that results, it looks like a pretty healthy $184 ,000 overbilling position. Right. Which, I mean, it feels like a comfortable place to be when you just look
at the cash in the bank, you see a positive position, and you assume the project is performing well. Yeah, it feels comfortable until you measure the consequence of what is actually happening in the field. So in this documented case, the revised cost to complete the project actually jumped to $1 .72 million. Oh, wow. Yeah, because of that hidden increase in cost, the project's margin faded by six full percentage points. And that structural blind spot is the core issue we are targeting today. So this briefing is produced by Smart Business Automator, a company that designs AI and automation systems for construction companies. We are directing this specifically to construction company owners, CEOs, COOs, CFOs, project executives, pre -construction leaders, and technology leaders. And please note, this session is for educational and informational purposes and does not constitute
professional, legal, or financial advice. Our mission today is to build a five -number Monday control room that turns delayed historical reports into forward -looking management alerts. And we need to assign that problem to the decision makers who actually own it. The responsibility for cash work in progress, project performance, and executive visibility, it rests squarely on the shoulders of the owners, the chief financial officers, and the chief operating officers. If those leaders are getting blindsided by a 6 % margin fade, well, we have to look at the manual process failure happening behind the scenes. In most operations, disconnected data creates the failure. Cash sits in the accounting software. Percent Complete lives in some static work -in -progress spreadsheet that gets updated maybe
once a month. If they're lucky. Yeah, right? Billings are locked in separate pay applications. Pending changes get lost in email threads or project management software. And the explanations for all of this are buried in text messages from the field. The information exists to prevent that margin fade, but it is entirely fragmented. And let us be honest about those text messages. They usually just say something vague like weather was bad or waiting on materials followed by a thumbs up emoji. That does not help a CFO figure out how to pay the bank. Think of it like trying to drive a heavy -duty truck, where the speedometer, the fuel gauge, and the check engine light are all located in different zip codes. By the time the owner learns about a margin fade or labor burn, the company has already funded the problem. The money is gone before the report is even generated.
Which brings us to the systematic exception management layer required to fix it. We aren't talking about replacing your accounting system or firing your controller. We're talking about connecting your existing data to isolate five specific numbers. So how do we fix the dashboard on this truck? We have to start with survival, which means securing the fuel tank. That is number one, your 13 -week projected cash coverage. Right. The U .S. Small Business Administration formally recommends disciplined cash flow projections as a fundamental part of managing a business. The calculation we use here is a specific formula. You take your lowest projected unrestricted cash during the next 13 weeks, and you divide that by your average weekly unavoidable cash outflow. So from a system's perspective, we map that into an automated workflow by connecting
specific inputs. The system needs to pull accounts' receivable aging expected payment dates, payroll calendars, recurring obligations, and purchase commitments. Okay. And then the rule engine updates this 13 -week view on a strict schedule. It flags any missing dates, identifies the specific week where cash dips to its lowest point, and compares that forecast to the prior week. And it is critical to define unavoidable cash outflow accurately here. This is not your operational wish list. It represents the absolute hard costs of keeping the doors open. We are talking about payroll and taxes because, well, you cannot skip paying your crews or the government. We are talking about debt service and equipment payments because the bank will repossess your fleet. And we must include committed materials because those purchase orders are already signed. I want to push back
on this calculation for a moment just to understand the logic. Why do we need the system to calculate a dynamic 13 -week ratio? Why not just set a universal safe cash threshold in the system, like trigger an alert when the bank account drops below $500 ,000? Because a static number provides zero context. A universal safe threshold simply does not exist in construction. Company -sized current credit facilities, the amount of retainage held by owners, your customer mix, and bonding requirements all change the answer. Oh, I see. Yeah. A million dollars in cash looks great on paper, but it is dangerously low if you have a $2 million payroll hitting in week three. The useful signals of the specific date of the lowest projected balance, whether the coverage ratio
is rising or falling over time, and identifying which specific delayed receipts or upcoming expenses are driving that low point. That makes total sense. Context is everything. So the automation route's an exception alert if a major customer payment slips by even a few days, or if a material commitment moves forward and unexpectedly compresses that ratio. The human action here is that the CFO or the owner must approve a specific response, whether that is a collections escalation, a billing correction, or a shift in expenditure timing. Spot on. Once survival is secured and your cash floor is established, the immediate next question for the leadership team is whether the jobs are actually generating the profit promised to the bank. Which brings us to the second number, projected margin fade. This is your financial GPS telling you if you are veering off course. Yeah, the
Construction Financial Management Association identifies the work -in -progress schedule as a vital view into projected job profitability. The formula for this second number is straightforward. Its original estimated gross margin percentage minus the current estimated gross margin percentage. From an automation standpoint, the system requires the original estimate, the current cost to complete forecast committed costs, actual costs, and approved changes. It recalculates the projected margin on a defined cadence and flags an exception if the margin falls beyond a company -defined tolerance. But let's break down the logic of how we view this. Why does the control room need to rank these jobs by gross profit dollars lost rather than just the percentage? Because percentages can be highly deceptive when comparing projects of different scales. Right. A CFO looking at
a spreadsheet might see a 1 % variance and think the company is safe completely ignoring the scale of the contract. A small percentage shift on a large contract creates far more financial risk than a large percentage shift on a tiny job. A 1 % fade on a $50 million project removes $500 ,000 in gross profit. A 10 % fade on a $100 ,000 project only removes $10 ,000. The control room must focus executive attention on the total dollars disappearing from the bottom line, not the ratios. So the system flags the largest dollar value, fades, and routes that exception directly to the project executive. The executive is then required to confirm the root cause within the system. They have to specify if it was reworked schedule compression, missed scope, or material
price escalation, and then document the recovery action. So if cash is clear and the projected margin is theoretically stable, we have to investigate how the cash is actually flowing in. The third number requires looking at the billing position. Under the cost -to -cost method, which aligns with the CFMA example we opened with, earned revenue equals the percent complete multiplied by the contract price. Hold on. Let's ground that math before we move forward. If my company is 50 % done with a $10 million job, I should have $5 million in earned revenue. If I have only billed $4 million to date, I am underbilled by $1 million. Is that the mechanism? That is correct. The billing position is simply the amount billed to date minus that earned revenue. A positive result is overbilling. A negative result is underbilling.
Automating this requires the contract value, the revised estimated costs incurred, and bill -to -date figures. The system calculates both the individual job and the overall portfolio positions, tracking the movement from the prior period. What is critical to understand here is that neither status is automatically healthy. Really? Yeah. Underbilling might reflect missed billing opportunities, slow pay application preparation, disputed quantities in the field, or changed work that is awaiting approval. Overbilling, while it improves working capital in the short term, might conceal margin fade or create severe future cash pressure if the management team treats that overbilled money. And we have to ask what typically causes those disputed quantities and delayed billings in the first place. That leads us directly to the fourth number cost incurred
on unapproved changes. The Associated General Contractors of America explicitly notes that delayed change orders significantly interrupt contractor cash flow. We must track changed work in three distinct buckets. Okay, what are the buckets? Priced and approved, priced and pending, and performed but not fully priced. The exposure number you review on Monday is the estimated cost already incurred in buckets two and three. The automation map for this is critical because it relies on highly time -sensitive data. We pull inputs from field instructions, requests for information, daily reports, cost entries, and the change log. The system creates the change record and begins calculating its age. More importantly, it watches the contractual notice deadlines. That is the pivotal function right there. Every pending item must contain the job identifier,
the amount incurred its age. the contractual notice deadline, the last documented communication, the decision owner, and the next action. You cannot count hoped -for markup as cash. You must track the actual cost your company is floating to finance the owner's design changes. If work starts without authorization in the system, or if a contractual notice date approaches without a formal submittal, the system generates an exception. The project executive or contract administrator receives an alert demanding a determination of the contractual response before the right to claim that cost expires. And if it's not an unapproved scope change draining the margin, the issue usually stems from the field execution itself. The fifth and final number is the labor hour variance. This is the check engine light flashing before the vehicle stalls. For self -performed work,
the formula is the budgeted hours for the completed quantity minus the actual paid hours for that completed quantity. A negative value means the actual hours exceeded the estimate for the amount of work put in place. Let's use a concrete example to translate that. Imagine a crew is pouring a foundation. The original estimate gave them 40 hours to complete that specific pour. They finished the pour, but the timesheets show it took 60 hours. From a financial perspective, it is vital to convert that 20 -hour variance using the company's burdened labor costs, not just the base wage. The financial impact must include taxes, benefits, and insurance to reflect the true cash burn. However, the purpose of tracking this variance is diagnosis. not automatic blame. That is a crucial distinction for the automation
workflow. If you just look at the timesheet, your first instinct might be to yell at the foreman. But if you dig into the why, the picture changes. If the variance exceeds a tolerance, or if the same constraint repeats across multiple days, the system flags it. The human action is for operations to investigate the root cause. Was there an estimating miss? Was the work area unavailable because a preceding trade was behind schedule? Was there a material delay, a supervision change, or an unrelated production target. Operations must actively identify and remove the constraint and then monitor the system to check if that intervention actually changes the variance in the following week. Now that we have detailed the five numbers, 13 -week cash coverage, margin fade billing position, unapproved change exposure, and labor variance, we have to implement a strict
meeting cadence to review them. This is the 30 -minute Monday control room meeting. We map this meeting schedule down to the minute to ensure it remains an exception management process rather than a generalized rambling status recital where everyone just says their projects are going fine. Minutes zero through five are dedicated solely to projected cash coverage and identifying the lowest cash week. Minutes 5 through 12 cover the three largest projected gross profit fades across the portfolio measured in dollars. Minutes 12 through 18 address the billing position and any assigned collection actions. Minutes 18 through 24 focus on unapproved change exposure and approaching contractual notice deadlines. Finally, minutes 24 through 28 review labor variance. And the final two minutes, minutes 28 through 30, are reserved for confirming an owner an action, a
due date, and a measurable success metric for every red item identified. This workflow requires three concrete actions to be completed after the meeting. First, the CFO or owner must approve a specific collections escalation or expenditure timing shift before cash coverage reaches a critical state. Second, the project executive must assign a specific contractual response for unapproved work before a notice deadline hits. Third, operations must actively remove one specific constraint causing labor variance and report back on whether it altered the data. The operating principle here is entirely based on exception management. Yeah. You show it changed, you demonstrate why it matters financially, you identify who owns it, and you dictate what happens next. Before a company can run this meeting, though, we have to address the reality of their data infrastructure.
There is one primary implementation risk that derails this entire process. It is the failure to normalize identifiers across different platforms. We frequently see companies where the timekeeping application, the product management software, and the accounting system all speak completely different languages. Oh, yeah. The job numbers do not match. The cost codes are structured differently, and the customer names are abbreviated in varying formats. If the timekeeping application says cost code 100, but the accounting software categorizes that exact same work as phase one concrete, the automation map breaks. The rules engine cannot compare the earned hours in the project software against the actual paid hours in their accounting ledger if the cost codes are misaligned. When the data fails to sync, the exceptions cannot
be routed to the responsible decision maker. Building this control room requires establishing a single source of truth for your data architecture first. Which brings us to the immediate action required from the leadership team. The move for the decision maker listening right now is to copy the companion scorecard provided with this briefing. Before your next leadership meeting, you must attempt to populate these five current values for your company. And if you find that a value is unavailable, or if it takes three days of emailing different departments to calculate it, I want you to physically mark that box not measured. then assign the name of the person responsible for producing it. The missing data is in itself a critical operating signal. It tells you exactly where your visibility is compromised. You cannot manage an exception if your reporting structure is incapable of identifying it in the
first place. Understanding your financial exposure on a delay of 30 days is simply documenting history. True control requires looking forward. We have a specific request for you regarding this material. Please send this briefing and the companion scorecard directly to the person who owns your company's Monday operating meeting. If you are the owner, COO, or CFO of a construction company and your team cannot assemble these five numbers without chasing spreadsheets and inboxes, Smart Business Automator can map the reporting and approval workflow with you. Request an executive reporting and workflow assessment at smartbusinessautomator .com. Again, that is smartbusinessautomator .com. The technical mechanics of building this dashboard are solvable, but the human element is what truly dictates success. Which leaves us with this final
thought to consider as AI and automation begin to calculate these five numbers flawlessly, the ultimate competitive advantage in construction will not be data collection anymore. It will be the psychological safety of your Monday meetings. If your project executives are still too afraid to report a margin fade in a room full of their peers, the best automated control room in the world will not save you. The system can only highlight the truth. Your culture has to be brave enough to act on it.
