Construction Cyber Insurance UK (Protecting Modern Construction Projects)
Why Construction Is the Sector Most Exposed to Cyber Attack
UK construction has, over the past three years, moved quietly to the top of the ransomware target list. Control Risks data shows that building, construction, and property was the number one targeted sector for ransomware incidents in 2025, and the average ransomware incident in the sector now results in 24 days of operational downtime — almost five working weeks where access to drawings, project data, BIM models, programme schedules, and digital collaboration platforms is degraded or lost entirely. For an industry that runs on tight margins, fixed completion dates, and contractually liquidated damages for delay, that is not an IT inconvenience. It is a project-killing event.
The reasons construction has become the most attacked sector are structural, not accidental. Projects depend on shared digital environments — BIM models, common data environments, cloud project management platforms — accessed by tens or hundreds of parties of widely varying cyber maturity. Sites have filled with connected technology — smart cranes, telematics, IoT sensors, drones, automated machinery — that was rarely designed with cybersecurity as a priority. Payment flows between main contractors, subcontractors, and suppliers are large, frequent, and routinely changed, creating the perfect conditions for invoice fraud. And the sector has historically underinvested in cybersecurity: a UK government study found only 21% of construction businesses have a board member responsible for cyber security — one of the lowest figures of any sector — and 26% lack adequate patch management. That gap between attack surface and defensive maturity is what insurers have spent the last 18 months recalibrating their construction cyber underwriting around.
This guide addresses every meaningful cyber exposure facing UK construction businesses in 2026 — from ransomware and BIM-targeted attacks to CEO fraud, deepfake-driven payment diversion, IoT site vulnerabilities, and the new regulatory regime arriving via the Cyber Security and Resilience Bill — alongside interactive tools to help you identify exactly what your business needs.
1. The Specific Cyber Risk Profile of Construction Businesses
Why Standard Cyber Insurance Often Misses the Construction Exposure
Most off-the-shelf SME cyber policies are designed around the office-based services business: a defined IT estate, a finite number of users, sensitive personal data as the primary insured asset, and business interruption tied to that IT estate going down. Construction is structurally different. The insured asset is not just the office network — it is the project. Project documentation lives across multiple parties' systems, on cloud platforms, on BIM hosts, on a CDE that may be owned by the client. Operational downtime is measured in delayed completion dates and LADs, not just lost office productivity. And the attack surface extends across every subcontractor, supplier, consultant, and connected device touching the programme.
Cyber insurance for construction needs to specifically address:
- Ransomware-driven project delay and the resulting contractors all risks programme implications
- Loss, encryption, or corruption of BIM and project data hosted by you, your client, or a third party
- Cyber-facilitated fraud — particularly invoice diversion, CEO impersonation, and deepfake-enabled wire fraud
- Business interruption where revenue is tied to project milestones, not just office operation
- Third-party liability where a cyber incident on your systems propagates to clients, subcontractors, or the project
- Operational technology and IoT site equipment compromise
- Regulatory and notification costs under GDPR, the incoming UK Cyber Security and Resilience Bill, and NIS2 pass-through obligations from CNI clients
The Three Loss Pathways That Define Construction Cyber Claims
Cyber losses in construction follow three repeatable patterns. Understanding which pathway is most likely for your business shapes how the policy needs to be structured.
Pathway 1 — Ransomware-driven project disruption. A ransomware actor encrypts your project management systems, drawing repositories, and accounting platforms. Site work continues for a few days on cached information, then progressively halts as the lack of access to specifications, RFIs, programme updates, and procurement systems bites. By day 10 you are paying staff and subcontractors to do reduced or zero productive work. By day 24 — the sector average — you have a substantial delay claim from the client, accumulated LADs, subcontractor extension-of-time claims working their way back to you, and a forensic IT bill running into six figures.
Pathway 2 — Cyber-facilitated fraud. A phishing email, a compromised supplier email account, or — increasingly in 2025 and 2026 — a deepfake video call convinces a member of your accounts team to redirect a legitimate payment to a fraudulent account. The money leaves the business. By the time the fraud is identified, the funds have been moved through three or four accounts and are unrecoverable. The standard cyber policy may not respond to the direct financial loss without a specific crime or social engineering extension.
Pathway 3 — Third-party data breach and client contractual liability. An attacker accesses your systems and exfiltrates a client's sensitive project data — architectural drawings of a high-profile or security-sensitive building, design documents for a CNI scheme, or personal data relating to the client's staff or end users. You face GDPR notification obligations, possible ICO investigation, third-party claims from affected parties, and contractual liability to the client whose data you held.
2. Core Cyber Covers Every Construction Business Needs
Cyber Insurance — First-Party and Third-Party
The primary cover. A construction-fit cyber insurance policy combines first-party cover (your own costs after an attack — incident response, forensics, data restoration, ransom payments where legally permitted, business interruption, system rebuild) with third-party cover (claims from clients, subcontractors, or affected individuals whose data was exposed). For construction, the BI element is the single most important variable. The waiting period must be short enough to capture the early stages of project disruption, and the indemnity period must be long enough to cover the full delay impact on programme — typically 6 to 12 months, sometimes longer for major projects.
Crime / Social Engineering Fraud Cover
Standard cyber insurance covers the cost of responding to an attack but does not always cover the money fraudulently transferred out of your account in a CEO fraud, invoice diversion, or deepfake scenario. That coverage usually sits within crime insurance or as a social engineering fraud extension to a cyber policy. Given that cyber-facilitated fraud is the single most common loss type in the construction sector — and the average construction company faces dozens of email fraud attempts per quarter — this extension is essential, not optional. Confirm both the sub-limit (often well below the main cyber limit) and the conditions for cover (verification protocols, multi-party authorisation requirements, training records).
Professional Indemnity — With Cyber Considerations
Construction professional indemnity insurance traditionally covers claims arising from negligent professional advice — design errors, specification mistakes, supervision failures. Where BIM and digital design platforms are involved, PI takes on a cyber-adjacent dimension: if BIM data is corrupted, manipulated, or lost while in your custody, the resulting design or construction error may trigger a PI claim rather than (or alongside) a cyber claim. Some PI wordings still contain electronic data exclusions that can leave the gap unfilled. Review your PI wording specifically for BIM, CDE, and digital design data scenarios, and confirm with your broker how the two policies interact.
Contractors All Risks and Plant — Cyber Trigger Implications
Traditional contractors all risks (CAR) insurance covers physical loss or damage to works and materials on site. Many wordings exclude or limit cover where the loss is caused by a cyber event — for example, where a ransomware attack on a tower crane's control system causes the crane to drop a load, or where IoT-controlled plant is taken offline causing physical damage. The cyber-physical interaction is one of the fastest-evolving areas of construction insurance, and the answer is rarely found in the CAR wording alone. Ensure your CAR insurer and your cyber insurer have a clear understanding between them of which policy responds to cyber-triggered physical damage.
Public and Employers' Liability — Standard Construction Cover
Cyber events can also create third-party injury exposure — for example, where compromised site safety systems contribute to an accident. Public liability and employers' liability respond to the injury claim, but the underlying cyber cause may be relevant to coverage allocation and recovery. Both remain core covers regardless of cyber exposure; the point is that cyber and traditional liability covers increasingly need to be considered together rather than in isolation.
Trade Credit — Where Cyber Causes Client Insolvency
A significant cyber attack on a main contractor can — in extreme cases — push the contractor into financial distress, leaving subcontractors and suppliers with unpaid invoices. Trade credit insurance covers bad debt where a customer fails to pay, regardless of the underlying cause. For subcontractors with significant exposure to a small number of main contractors, this is an indirect but real cyber-related risk worth considering as part of the broader risk programme.
3. Business Type Cover Checker
Select your primary business model for a tailored cyber cover checklist.
Construction Cyber Cover Checker
Select your business type to see the recommended cyber insurance programme
Main Contractor — Direct Client Contracts
- ESSENTIAL Cyber insurance — first-party and third-party combined; minimum £2m, £5m+ for any contractor with turnover above £20m or contracts in regulated/CNI sectors
- ESSENTIAL Cyber business interruption — indemnity period 12 months minimum; cover must respond to project-level revenue loss and LADs, not just office IT downtime
- ESSENTIAL Social engineering / crime fraud extension — for invoice diversion, CEO fraud, and deepfake-driven wire transfer fraud; sub-limit appropriate to your typical payment values
- ESSENTIAL Third-party liability for client data — main contractors hold significant client design and project data; confirm cover for breach notification, regulatory investigation, and third-party claims
- ESSENTIAL PI with explicit BIM and CDE cover — confirm no electronic data exclusion; PI must respond where loss arises from corrupted or compromised digital design data
- RECOMMENDED Contingent business interruption — where your operations depend on a critical third-party platform (cloud BIM host, project management SaaS) that suffers an outage
- RECOMMENDED Cyber-CAR coordination — written confirmation between cyber and CAR insurers on which policy responds to cyber-triggered physical damage
- CONSIDER Pre-incident response retainer — for contractors above £30m turnover; specialist IR firms on call before an attack significantly reduce recovery time and total claim cost
Subcontractor or Specialist Trade
- ESSENTIAL Cyber insurance — minimum £1m, £2m for larger specialists; subcontractors are increasingly required to evidence cyber cover as a condition of supply chain engagement
- ESSENTIAL Social engineering / crime fraud extension — subcontractors are the most common victims of payment redirection fraud where the criminal impersonates the main contractor's accounts team or a supplier
- ESSENTIAL Cyber BI tied to project work — your revenue depends on access to drawings, RFIs, and the CDE; cover must include loss of access to third-party systems your work depends on
- ESSENTIAL Contractual cyber liability — main contractors increasingly pass cyber breach obligations down through subcontract terms; PI and cyber must respond to those contractual provisions
- RECOMMENDED Cyber Essentials certification — increasingly a tender prequalification requirement, particularly for public sector, regulated, and CNI work; supports your insurance position and is sometimes a coverage condition
- RECOMMENDED Trade credit — covers bad debt where a main contractor suffers a cyber-driven financial event that affects payments to you
- CONSIDER Contractor combined or contractors combined insurance package with cyber bolted on — for SME specialists, a combined approach often delivers better value than separate policies
Architect / Engineering Consultancy
- ESSENTIAL PI insurance with full cyber-event scope — consultants are the custodians of design data; PI must respond where corrupted, lost, or compromised BIM/CAD data leads to a design failure claim; confirm no electronic data or cyber exclusion
- ESSENTIAL Cyber insurance — minimum £2m for established practices; consultancies hold client design IP, building security data, and personal data, all of which are targeted assets
- ESSENTIAL Social engineering / deepfake fraud cover — the Arup deepfake case is the bellwether event for the consulting sector; CFO impersonation and AI-enabled fraud are now a primary loss pathway
- ESSENTIAL Client data and IP protection — confirm cover for unauthorised disclosure of client design data, particularly for clients in defence, security-sensitive, CNI, or high-profile property sectors
- RECOMMENDED Cyber-PI interaction clause — written confirmation of how cyber and PI policies coordinate when a single event triggers both; gaps and double-deductibles are common
- RECOMMENDED Cyber Essentials Plus — many large client procurement frameworks now require it; underwriters view it favourably at renewal
- CONSIDER Reputation/PR cover within cyber — for consulting practices a public cyber incident has disproportionate reputational consequences; specialist PR response funding is valuable
Developer / Property Company
- ESSENTIAL Cyber insurance — minimum £2–5m depending on portfolio size; developers hold buyer personal and financial data, lease holder data, contractor payment data, and significant transaction value
- ESSENTIAL Social engineering / wire transfer fraud — developers make and authorise large project payments; this is the primary loss pathway and standard cyber limits are rarely adequate without specific extension
- ESSENTIAL Cyber BI tied to project delay — where a cyber event on your systems or a contractor's systems delays a project, BI must respond to delayed sale proceeds and financing cost increases
- ESSENTIAL Buyer/leaseholder data protection — for residential developers and BTR operators; GDPR notification, ICO investigation, and third-party claims cover
- RECOMMENDED Owner Controlled Insurance Programme (OCIP) cyber consideration — for developers arranging project insurance, cyber should be specifically considered alongside CAR, PI, and Public Liability rather than left to individual contractors
- RECOMMENDED Trade credit — covers bad debt where buyers, leaseholders, or commercial tenants default in the aftermath of a cyber-driven financial event affecting them
- CONSIDER Smart building OT cover — if developing buildings with significant smart/connected infrastructure (BMS, access control, energy systems), OT cyber risk extends post-completion and may need long-tail consideration
Small Builder / SME Contractor
- ESSENTIAL Cyber insurance — minimum £500k–£1m; SME builders are disproportionately targeted by cyber-facilitated fraud and ransomware because of perceived lower defences
- ESSENTIAL Social engineering / crime fraud — for SME builders, an invoice diversion fraud of £30,000–£100,000 can be existential; this extension is the most important practical cover
- ESSENTIAL Cyber-aware combined contractor package — see our contractors insurance for small builders checklist for the full programme; cyber should be integrated rather than bolted on as an afterthought
- RECOMMENDED Cyber Essentials certification — modest cost, significant insurance and tender benefit; reduces both premium and the likelihood of attack succeeding
- RECOMMENDED Multi-factor authentication (MFA) across all systems — increasingly a condition of cover rather than a recommendation; verify your policy's MFA requirement before claims, not after
- RECOMMENDED Backup and recovery documentation — insurers expect evidence of segregated, tested backups; this is often a recovery condition in the policy
- CONSIDER Staff phishing awareness training — modest cost, large risk reduction; most cyber policies now require evidence of training programmes at renewal
CNI / Regulated Infrastructure Contractor
- CRITICAL Specialist cyber insurance — standard SME and even mid-market cyber policies are inadequate for CNI exposure; placement typically requires Lloyd's market or specialist MGA capacity; minimum £5–10m
- ESSENTIAL NIS2 and Cyber Security and Resilience Bill compliance — even where not directly in scope, CNI client contracts will pass through equivalent obligations; cover must respond to these regulatory exposures
- ESSENTIAL State-aligned attack consideration — the UK recorded 15 state-aligned cyberattacks between 2022 and 2026; many cyber policies have war or hostile state exclusions that must be reviewed carefully; clarify the scope of any war/state actor exclusion
- ESSENTIAL OT and ICS cover — for contractors working on energy, water, transport, or other physical infrastructure; cover must address operational technology and industrial control system exposure
- ESSENTIAL Client contractual liability — CNI clients impose strict cyber obligations on contractors; PI and cyber must respond to those specific contractual exposures, including breach notification timelines
- RECOMMENDED Pre-incident response retainer — non-negotiable for CNI; specialist incident response capacity must be on retainer, not procured after the event
- RECOMMENDED Crisis management and PR — CNI cyber incidents attract regulatory, government, and media attention disproportionate to the financial loss
- CRITICAL Engage a specialist broker early — CNI cyber is a specialist market placement; standard combined commercial cyber wordings are usually inadequate or void at the worst time
4. Project Cyber Risk Assessor
Select the type of project work and your business size to get a specific risk rating and the cyber insurance implications for your business.
Construction Cyber Risk Assessor
Select your project type and business size to see your specific cyber risk profile
5. BIM, Common Data Environments, and Design Data Risk
Building Information Modelling and the Common Data Environment have transformed how UK construction projects are designed, delivered, and operated — and they have also created a concentrated, high-value, multi-party-accessed digital asset that sits at the centre of every project. From an attacker's perspective, the BIM model and CDE are the most valuable single target on a construction project: compromise the model, and you can encrypt it for ransom, exfiltrate it to extort, manipulate it to cause design errors, or use it as a pivot point into every party connected to the project.
How BIM Creates Cyber Exposure
BIM environments concentrate three things that, separately, are common but together are uncommon: highly valuable intellectual property (detailed designs, structural calculations, MEP specifications, security-sensitive plans), broad multi-party access (architects, engineers, contractors, subcontractors, suppliers, consultants, clients, all with login credentials), and ongoing change (the model is being updated daily, sometimes hourly, by parties of varying cyber maturity). That combination is what makes BIM platforms a high-value target. The IET's guidance on BIM cyber security identified years ago that some PI policies seek to exclude liability associated with electronic document loss — a position insurers are revisiting as cyber-driven BIM failures become more common.
The Liability Chain When BIM Goes Wrong
When a BIM model is corrupted, manipulated, or rendered inaccessible by a cyber event, the loss flows in several directions simultaneously:
- Immediate project delay while access is restored or the model is rebuilt
- Potential design errors arising from work undertaken on corrupted data before the issue is identified
- Contractual liability to the client for delay, with LADs accruing daily
- Knock-on extension of time claims from subcontractors
- Potential PI exposure where design errors emerge later from corrupted data — sometimes years after the event
- Regulatory exposure where the project is in scope of building safety, CNI, or data protection regulations
CDE Hosting — Whose Insurance Responds?
The CDE is often hosted by a third-party provider (Autodesk Construction Cloud, Bentley ProjectWise, Asite, Viewpoint, Aconex, and others) or by the client themselves. When the CDE is attacked, the question of whose insurance responds — yours, the hosting provider's, the client's, or some combination — is contractually and legally complex. Most contracts allocate cyber responsibility unclearly. Most cyber policies need to be specifically extended to cover loss arising from third-party platforms (contingent business interruption). For any contractor or consultant whose project work depends on access to a CDE you don't control, contingent BI is a significant gap to address with your broker.
6. CEO Fraud, Invoice Diversion, and Deepfake Attacks
The single most frequent — and now the single most damaging — cyber loss type in UK construction is cyber-facilitated fraud. The construction sector's combination of large, frequent, fast-moving payments to a wide network of suppliers and subcontractors creates near-perfect conditions for criminals. The 2025 ESET data showed construction firms in the UK face an average of 61 email fraud attempts every three months. Most are unsuccessful. The ones that succeed can be financially significant or, for an SME, existential.
The Three Fraud Patterns That Cost Construction Most
Invoice diversion fraud. A criminal compromises the email account of one of your suppliers or subcontractors (often through phishing), monitors their email for legitimate invoice activity, and then — at exactly the right moment — sends a message from the compromised account saying "we've changed our bank details, please update your records and remit to this new account from now on." The new account is the criminal's. Several payments may be processed before the legitimate supplier notices they haven't been paid. By that point, the money has been moved.
CEO / CFO impersonation (BEC — Business Email Compromise). A criminal impersonates a director or CFO and emails an accounts team member with an "urgent, confidential" instruction to pay a third party. The email is often timed for moments when the impersonated person is known to be travelling or otherwise unreachable. The classic version uses a spoofed or look-alike email address. The 2025-2026 version increasingly uses AI-cloned voicemails and — most dangerously — deepfake video calls.
Deepfake-driven authorisation fraud. The defining cyber fraud event of 2024 was the Arup deepfake fraud, in which scammers used AI-generated video and audio to impersonate the company's CFO and other senior staff on a video conference call, deceiving a Hong Kong-based finance employee into transferring $25 million across 15 wire transfers to attacker-controlled accounts. No internal Arup system was breached. No credentials were stolen. The attack was pure technology-enhanced social engineering, using publicly available video and audio of executives — webinars, conference talks, online interviews — to train deepfake models capable of running a live, interactive video meeting. This is the model future attacks will follow.
Why Standard Cyber Policies Often Don't Cover This
The classic cyber insurance distinction is between the cost of responding to an attack (which standard cyber covers) and the value of money fraudulently transferred (which historically sat outside cyber and within crime insurance). Many SME and mid-market cyber policies still draw this line. The practical effect: a £200,000 invoice diversion fraud generates a £200,000 loss; the cyber policy may pay the forensic investigation but not the £200,000. This is one of the most common coverage shocks in construction. The fix is either a crime policy alongside cyber, or — more commonly today — a specific social engineering fraud extension to the cyber policy with a meaningful sub-limit. Confirm with your broker exactly which option you have, the sub-limit, and the conditions for cover (typically including verification protocols, multi-party authorisation for changes to payment details, and staff training records).
7. IT/OT Convergence and IoT Site Vulnerabilities
The modern construction site is no longer an analogue environment. Connected tower cranes, telematics-fitted plant, IoT sensors monitoring concrete cure rates and ground movement, drones for survey and inspection, automated material handling, smart hoarding security systems, and increasingly autonomous or semi-autonomous machinery — all sit on networks, all communicate with cloud platforms, and all create operational technology (OT) exposure that traditional construction insurance was never designed for.
The IT/OT Convergence Problem
The cyber risk created by site connectivity isn't really about the devices themselves — it's about the connections between them and the corporate IT network. QBE's 2026 report found that inadequate segmentation between IT and OT systems was a contributing factor in 81% of OT incidents in 2025. The same year saw a 410% year-on-year increase in IoT malware activity targeting construction. Attackers don't need to compromise the crane directly; they need to compromise an office PC, then move laterally across an unsegmented network to reach the crane's control system. Once there, the consequences are no longer just data — they are physical.
Cyber-Physical Damage and the CAR Policy
The hardest question in 2026 construction insurance: when a cyber event causes physical damage on site — a crane drops a load because its control system was tampered with, plant is damaged because its monitoring systems failed, a building system causes water damage post-completion — which policy responds? Traditional CAR wordings often exclude or limit cyber-caused damage. Many cyber wordings exclude physical damage. The result is a gap that doesn't appear in clean modular policy diagrams but is unfortunately real when claims occur. The answer is rarely found in a single wording — it must be engineered between your cyber, CAR, and PI insurers, ideally with written confirmation of how each policy will respond.
8. Supply Chain and Subcontractor Attack Pathways
Construction supply chains are deep, fragmented, and digitally interconnected. A typical major contractor will work with hundreds or thousands of subcontractors and suppliers across the lifetime of a project, exchanging documents, drawings, payment information, and access credentials with each. From a cyber perspective, this means your effective attack surface is not just your own systems but the systems of every party you exchange data with. Rapid7's threat landscape analysis identifies vendor impersonation, supply chain compromise, and credential theft from subcontractors as primary attack vectors specifically because subcontractors are typically the weakest cyber-mature link in the chain.
How Supply Chain Attacks Reach You
The two patterns that account for most supply-chain-driven cyber losses in construction:
- Compromised supplier email. A small supplier's email is breached. The attacker observes the supplier's correspondence with you, learns your payment terms and invoice patterns, then sends a perfectly contextual message either redirecting a payment or attaching malware disguised as a legitimate document.
- Software supply chain. A piece of software used across the construction industry — a project management platform, a BIM viewer, a CAD plugin — is compromised at source. The malicious version is distributed to all users. The attacker now has access to your systems via legitimate software.
The Pass-Through Contractual Effect
Increasingly, main contractors are passing cyber obligations down through subcontract terms — requiring evidence of Cyber Essentials certification, minimum cyber insurance limits, MFA implementation, and specific breach notification timelines. CNI clients have been doing this with main contractors for several years; this pattern is now cascading down the supply chain. For subcontractors, this means cyber insurance is becoming a tender prequalification condition, not an optional risk transfer choice. The pass-through also works the other way: a cyber incident on your systems that affects the client may trigger contractual liability that your cyber policy must explicitly respond to.
9. Regulation — Cyber Security and Resilience Bill, NIS2, and GDPR
The UK Cyber Security and Resilience Bill
Introduced in November 2025, the proposed Cyber Security and Resilience Bill is set to expand the UK's cyber regulatory perimeter significantly. It builds on the existing Network and Information Systems Regulations and is expected to bring many construction firms — particularly those working in or adjacent to critical national infrastructure — into scope of mandatory cyber risk management, incident reporting, and supply chain obligations. For contractors working in energy, water, transport, telecoms, healthcare, and digital infrastructure, the practical effect is that the cyber regulatory requirements that applied to your CNI clients are now applying to you.
NIS2 — Pass-Through via Supply Chain
The EU's NIS2 Directive — even though it doesn't directly apply to UK businesses post-Brexit — has a substantial pass-through effect via supply chain contracting. Any UK construction firm working for a client whose operations fall within NIS2 (most major energy, transport, and digital infrastructure operators in Europe, and increasingly their UK counterparts via contractual harmonisation) will find themselves required to meet equivalent standards as a contractual term. NIS2 mandates incident reporting within 24 to 72 hours, with personal liability for management — a significant compliance burden that affects both operational practice and insurance scope.
GDPR Implications for Construction Cyber
Most construction businesses underestimate the personal data they hold. Employee and subcontractor personal data, client representative contact details for B2B clients, buyer and leaseholder data for residential and BTR developers, beneficial owner and KYC data for joint venture partners, and CCTV/biometric site access data all fall under GDPR. A cyber incident exposing any of this data triggers GDPR notification obligations to the ICO within 72 hours, and to affected individuals where the breach poses a risk to their rights and freedoms. Cyber insurance should specifically cover GDPR notification costs, ICO investigation defence, and the costs of any consequent third-party claims. Confirm the limit and any conditions.
10. What Drives the Cost
| Rating Factor | Impact on Premium | What You Can Do |
|---|---|---|
| Annual turnover and project values | Primary rating basis; larger contractors face larger payment values (and so larger fraud exposure) and larger project delay consequences | Declare turnover accurately; describe typical project values so the BI sub-limit and crime sub-limit can be sized appropriately |
| Sector exposure (CNI, regulated, public) | CNI and regulated infrastructure work attracts significant premium loading; public sector projects bring data protection exposure | Disclose all sectors worked in honestly; the insurer needs to understand the worst-case exposure, not just the average case |
| Cyber Essentials / Cyber Essentials Plus | Significant premium reduction and often a coverage condition; insurers increasingly require evidence of baseline controls | Obtain Cyber Essentials at minimum; Plus where tender qualifications require it; renew annually |
| MFA implementation | Now a coverage condition with most insurers; absence of MFA is increasingly grounds for declinature or significant loading | Implement MFA across email, finance, BIM/CDE access, remote access, and all administrative accounts; document the implementation |
| Backup architecture | Segregated, tested, offline-capable backups significantly reduce ransomware downtime and insurer exposure | Maintain segregated backups; test restoration annually; document the architecture for renewal submission |
| Staff training and phishing simulation | Modest but meaningful premium impact; demonstrable training programmes reduce social engineering loss probability | Implement regular phishing simulation and security awareness training; retain records for insurer review |
| Claims history | A prior ransomware or fraud claim will affect premium for 5+ years; the market is hardening on repeat-claim risks | Address root causes after any incident; document the remediation in detail for the next renewal submission |
| Specialist vs combined placement | Specialist cyber placement (Lloyd's, dedicated cyber MGAs) tends to provide better terms for larger or higher-risk businesses than cyber bolted onto a combined commercial policy | For mid-market and above, consider standalone specialist cyber rather than a combined add-on; the wording difference matters in claims |
11. Real Claims and How to Manage Them
Claim — Deepfake-Driven Wire Fraud, Engineering Consultancy 2024
The most significant cyber fraud claim in the construction and engineering sector in recent years was the Arup deepfake incident. In January 2024, a finance employee at Arup's Hong Kong office was deceived into authorising 15 wire transfers totaling approximately $25 million to attacker-controlled bank accounts after being invited to a video conference call featuring AI-generated deepfakes of the firm's CFO and several colleagues. The attackers had harvested publicly available video and audio of the executives from webinars, online conferences, and company videos to train the deepfake models. No Arup system was compromised. No credentials were stolen. The fraud was pure technology-enhanced social engineering, only discovered when the employee followed up with headquarters after the transfers had completed.
The lesson — and the reason this case is now used as a training and underwriting reference across the construction and engineering insurance market — is that traditional security controls and basic awareness training are insufficient against AI-enabled fraud. Effective defence requires verification through independent channels (a separate phone call to a known number), mandatory delay periods on large transfers, multi-party authorisation, and explicit policies that no large transfer can be authorised on the basis of a video or voice call alone. From an insurance perspective, social engineering fraud extensions to cyber policies have hardened substantially since this event, with insurers requiring evidence of verification protocols as a condition of cover.
Claim — Ransomware Causing Project Delay, UK Mid-Sized Main Contractor
A UK main contractor with £45 million annual turnover was hit by a ransomware attack in late 2025. The attackers gained initial access through a phishing email to a project manager, moved laterally across an inadequately segmented network, and encrypted the contractor's central document management system, accounting platform, and project scheduling tools. Site work continued for three days on cached information before progressively halting as RFIs, drawing revisions, and procurement requests could not be processed. Recovery — from segregated backups, with specialist incident response support — took 19 days.
The cyber policy responded to forensic investigation costs (£78,000), incident response and PR (£42,000), data restoration (£36,000), and business interruption (£620,000 against the 12-month indemnity period). The ransom was not paid. The total client delay was 22 days; the client's LADs at £15,000 per day generated an LAD claim of £330,000, which the cyber BI cover also responded to subject to policy terms. Subcontractor extension-of-time claims totalled a further £180,000.
The contractor's cyber programme had been sized to the recommended specification for their turnover band, including specific cyber BI cover responding to project delay. The lesson: the initial breach point — a single phishing email — is the same as every other attack. The difference between manageable and catastrophic is the network segmentation, backup architecture, and incident response capacity that determine recovery time, not the existence or absence of cover.
Claim — Invoice Diversion Fraud, Subcontractor 2025
A specialist mechanical subcontractor working on a London commercial scheme was the victim of an invoice diversion fraud. The main contractor's accounts team had received what appeared to be a routine email from the subcontractor's accounts manager confirming a change of bank account. The email came from the genuine email address — the subcontractor's account had been compromised some weeks earlier and the attackers had been monitoring correspondence. Two stage payments totalling £147,000 were paid to the fraudulent account before the genuine subcontractor noticed the payment hadn't arrived.
The funds were not recoverable. The question became which party bore the loss. The main contractor had paid in accordance with what they reasonably believed were the subcontractor's instructions; the subcontractor had not authorised any change. After commercial negotiation and reference to legal advice, the loss was split between the parties. The subcontractor's cyber policy social engineering extension responded to their share. The main contractor's crime insurance responded to their share. Both insurers required evidence of remediation — including independent verification protocols for any future change-of-bank-details request — as a condition of continued cover.
The lesson: the most important single control against invoice diversion fraud is a non-negotiable rule that any change of bank account details from a supplier must be verified by a phone call to a previously-known number, never to a number provided in the email or document making the change request. This costs nothing to implement and prevents the great majority of these frauds.
Claims Management Steps
- For a suspected or confirmed ransomware event: notify your cyber insurer immediately, even before you know the full scope. The first 24 hours are critical, and most policies provide access to specialist incident response, forensic, and legal capacity that must be engaged before decisions about ransom negotiation or system rebuild are made. Do not pay any ransom without insurer involvement — both regulatory and policy implications attach.
- For a suspected cyber-facilitated fraud (CEO fraud, invoice diversion, deepfake): contact your bank's fraud team immediately to attempt recall of the transfer — recovery is occasionally possible if action is taken within hours. Then notify your cyber and crime insurers. Retain all email correspondence, video/audio recordings, and meeting records. Do not contact suspected impersonators on any number they have provided.
- For a BIM or CDE data loss event: document the affected models, the parties whose data is on the platform, and the time of the last clean backup. Notify both your cyber insurer and your PI insurer — single events often trigger both. Do not undertake design or construction work on potentially-corrupted data until integrity has been independently verified.
- For a client data breach or personal data exposure: notify your cyber insurer first; the ICO 72-hour notification timeline starts running from when you become aware. Your cyber insurer's panel legal team will manage the regulatory notification alongside you. Do not contact the ICO before insurer involvement except where required by an inability to engage the insurer.
- For a client contractual cyber notification: CNI clients and increasingly major commercial clients require notification of any cyber incident within tight contractual timelines (often 24 or 48 hours). Your cyber insurer should be aware of these obligations at inception; do not assume you can defer contractual notification while assessing the loss.
Frequently Asked Questions
No — cyber insurance is not a statutory legal requirement for any UK business. However, it is increasingly required contractually: many main contractors, public sector clients, CNI operators, and large commercial clients require evidence of cyber insurance as a condition of tender qualification or contract award. The UK Cyber Security and Resilience Bill, introduced in November 2025, expands mandatory cyber risk management for businesses connected to critical national infrastructure, and is expected to bring many construction firms into scope. Cyber insurance also typically requires evidence of baseline controls (MFA, backups, training) that are good practice regardless of insurance.
The sector combines several risk factors that attackers find unusually attractive: tight project timelines that create pressure to pay ransoms, large and frequent payments between many parties that enable invoice fraud, complex digital supply chains with hundreds of touchpoints, historically lower investment in cyber security than other sectors, BIM and CDE platforms holding concentrated high-value data, IoT-enabled sites with limited segmentation between OT and IT, and increasingly the involvement of construction firms in critical national infrastructure projects that attract state-aligned attackers. QBE and Control Risks data confirmed construction was the number one ransomware target sector in 2025.
It depends on the wording. Standard cyber insurance covers the cost of responding to an attack — forensics, system restoration, breach notification, business interruption — but does not always cover the value of money fraudulently transferred out of your account in a social engineering attack. That coverage usually requires a specific social engineering or crime fraud extension, which has a sub-limit (often significantly below the main cyber limit) and conditions for cover including independent verification protocols and staff training records. For most construction businesses this is the single most important coverage to confirm with your broker, as cyber-facilitated fraud is now the most common loss type in the sector.
In January 2024, engineering firm Arup lost approximately $25 million to a fraud in which attackers used AI-generated deepfake video and audio to impersonate the company's CFO and other senior staff on a live video conference call, deceiving a finance employee into authorising 15 wire transfers to attacker-controlled accounts. The case is now used as the bellwether reference for AI-enabled fraud across the construction and engineering insurance market. The implications for your insurance are direct: insurers now require evidence of independent verification protocols (a separate phone call to a known number) before authorising large transfers, mandatory delay periods, and explicit policies that video or voice calls alone cannot authorise a transfer. Without these controls in place, social engineering cover may be declined or restricted.
It should, but the answer involves both your cyber and your PI policies. Cyber insurance covers the cost of restoring or rebuilding lost or corrupted data. PI covers the financial consequence of design errors. If a design error arises from corrupted BIM data — particularly if it only emerges after the cyber event has been closed — coverage allocation between the two policies can become contested. Review your PI wording for any electronic data, cyber, or BIM exclusion, and confirm in writing with both insurers how they will coordinate where a single event triggers both policies. This is one of the most common coverage failures in construction.
Often not, or with significant limitations. Traditional CAR wordings frequently exclude or limit damage caused by a cyber event — for example, where a ransomware attack on a tower crane's control system causes the crane to drop a load, or where IoT-controlled plant fails because of cyber tampering. Many cyber wordings, in turn, exclude physical damage. The cyber-physical interaction is one of the fastest-evolving areas of construction insurance, and the answer is rarely found in a single wording. Ensure your CAR insurer and your cyber insurer have a clear written understanding of which policy responds to cyber-triggered physical damage. See our contractors all risks insurance guide for the full CAR position.
The Cyber Security and Resilience Bill, introduced in November 2025, is expected to expand the UK's cyber regulatory perimeter significantly, particularly for businesses connected to critical national infrastructure. Contractors working in energy, water, transport, telecoms, healthcare, digital infrastructure, and defence are most likely to fall directly within scope. Even where you are not directly in scope, CNI clients and main contractors are likely to pass through equivalent obligations as contractual terms — so the practical effect of being in the construction supply chain for CNI work is to face equivalent compliance requirements. Engage with your broker early; the Bill's final scope and implementation timeline will materially affect cyber insurance terms and pricing for affected businesses.
A small builder or SME contractor with £500k–£2m turnover might pay £600–£1,800 per year for cyber cover at £500k–£1m limits with social engineering extension. A mid-sized main contractor (£5m–£25m) might pay £2,500–£8,000 for £2m of cover with full extensions and 12-month BI. A large contractor (£25m–£100m) might pay £8,000–£30,000+ for £5m of cover with project-aligned BI and a pre-incident response retainer. CNI-exposed and major contractors face specialist market pricing that ranges from £30,000 to £150,000+ annually. Key drivers beyond turnover: sector (CNI loads significantly), Cyber Essentials status, MFA implementation, backup architecture, claims history, and specialist vs combined placement.
The baseline expectations have hardened significantly since 2023. Most cyber insurers now require: multi-factor authentication on all email, remote access, finance system, and administrative accounts; segregated and tested backups (offline or immutable); patch management with critical patches applied within defined timeframes; staff security awareness training, with phishing simulation; documented incident response plan; and increasingly, Cyber Essentials certification at minimum. Without these, cover may be declined or significantly loaded. Cyber Essentials Plus and ISO 27001 alignment further improve terms and are often tender qualification requirements for public sector and CNI work.
Instagram
LinkedIn