Cyber Security
Cyber security for practices with something to protect
Design IP, project data, client information and payment processes all make AEC businesses worthwhile targets. WIT builds layered, proportionate security and has been certified to ISO 27001 (Information Security) since 2018, so our advice is grounded in practices we apply to ourselves.
The challenge
Sound familiar?
People are the first target
Phishing and payment fraud aimed at project invoicing and supplier changes remain the most common route into AEC businesses.
Unpatched estates
Busy practices defer updates; attackers rely on exactly that. Patch compliance is boring and fundamental.
Client security requirements
Frameworks, PQQs and larger clients increasingly expect demonstrable security: Cyber Essentials, policies and evidence.
No plan for the bad day
Without prepared incident response and resilient backups, a single compromise can stall every live project.
AI has sharpened the oldest attack
Convincing English, a plausible sender and a cloned voice are now cheap. The payment-redirection attempt that used to read as obviously wrong increasingly does not.
How WIT helps
Security governance, not just antivirus
All of our managed clients benefit from regular risk assessments, cyber security awareness training, proactive patch management and rapid incident response as standard. Security is not an optional extra bolted onto support, it is how we run systems.
We are ESET endpoint security partners, guide many of our clients through to Cyber Essentials certification and offer external auditing and penetration testing for practices that need deeper assurance.
WIT has been certified to ISO 27001 (Information Security) since 2018 and to ISO 9001 (Quality Management) since 2023. The same discipline, documented controls, continual review, honest risk assessment, informs the security programmes we build for clients.
What you gain
- Layered defences proportionate to real risk
- A workforce that recognises attacks
- Evidence for clients, insurers and frameworks
- Faster, calmer response when incidents occur
- Security practice informed by ISO 27001 discipline
Capabilities
What’s included
Risk assessments
Regular, plain-English assessments that prioritise the risks that actually apply to your business.
Cyber awareness training
Practical training that helps your team recognise phishing, fraud and social engineering.
Patch management
Proactive, monitored patching across operating systems and applications.
Endpoint protection
Managed endpoint security as ESET partners, covering workstations, laptops and servers.
Incident response
Rapid, rehearsed response when something does go wrong, containment, recovery and lessons learned.
Cyber Essentials guidance
Gap analysis and hands-on support through Cyber Essentials certification.
Auditing and penetration testing
External auditing and penetration testing to independently test your defences.
Identity and access management
MFA, conditional access and least-privilege design across Microsoft 365 and beyond.
AI usage governance
Finding out which AI tools your staff are already using, sanctioning the ones that are safe and closing the ones that are not. Shadow AI is an information security problem before it is anything else.
In practice
How this plays out in AEC work
Protecting design IP
Controls around models, drawings and competition work, the assets your reputation rests on.
Payment fraud prevention
Process and technical controls that counter invoice and bank-detail fraud on live projects.
Framework compliance
Meeting the security requirements of public frameworks and larger clients without drowning in paperwork.
FAQs
Common questions
Is Cyber Essentials worth it for a small practice?
Usually, yes. It establishes a sensible security baseline and it is increasingly a requirement for public-sector work and larger clients. We guide clients through the process end to end.
Do you run security training for staff?
Yes. Awareness training is part of our standard managed service, because people, not firewalls, are the most common target.
Can you test our existing security?
Yes. We offer external auditing and penetration testing to independently assess your defences and provide a prioritised remediation plan.
What does ISO 27001 mean for us as a client?
It means WIT’s own information security management is independently audited and has been since 2018, the processes we recommend are ones we operate ourselves.
How does AI change our security position?
In both directions. Attacks are better crafted: phishing in convincing English, plausible senders and cloned voices make payment fraud harder to spot on sight, so process controls matter more than instinct. At the same time, staff pasting project information into tools nobody approved creates a new exposure inside the practice. We address both: awareness training that reflects AI-assisted attacks, plus finding, sanctioning or closing the AI tools already in use.
Related services
Often paired with
Let’s make technology work better for your practice
Tell us about your current setup, challenges and future plans. We will help you identify the right next steps.