With both cyber reliance and cyber security in the national news headlines this week, new research reveals that two-thirds of architects, engineers and consultants have been the target of a cyber attack in the past three years.
The survey, carried out by Deltek, features the views and experiences of nearly 400 professional services firms in the built environment, more than half from the UK.
The types of cyber attacks reported by the correspondents were:
- customer/client data breach (28% of firms had been targeted);
- ransomware/malware impacting internal systems (28%);
- intellectual property data breach (27%);
- fraud/theft (e.g. via invoice scams) (23%); and
- ransomware/malware impacting external customer/ client services (20%).
The UK is the most concerned of these markets about cybersecurity risks and breaches (64% extremely/very concerned in the UK compared to 42% in Australia and 36% in Germany). This heightened concern in the UK aligns with higher levels of AI adoption and digital maturity, the research notes. Indeed, cybersecurity is the joint-biggest challenge in the UK, alongside inflation.
Expanding attack surface
Deltek observes: “As firms integrate more systems and accelerate automation, their attack surface expands, making proactive cyber governance essential. Markets further behind on digital transformation may not yet feel the same urgency, but the risks will rise as their technology adoption increases.”
The impacts of cyber attacks are very real. Almost half (49%) of those firms that were compromised said they experienced moderate financial or operational losses, while 14% said their losses were significant. Nearly half (45%) of firms affected by a cyber attack experienced financial losses (rising to 50% in the UK), while 38% each experienced customer losses and operational impacts.
Furthermore, almost a third of organisations that experienced a successful cyber attack reported reputational damage among both clients/customers and industry peers (both at 31%).
Given these impacts, it’s no surprise that firms that have experienced an attack are placing even greater priority on improving cybersecurity in 2026 and beyond (29%), compared to those firms that have not experienced an attack (17%).
