Your firm runs draw payments on Friday and a C3PAO assessment next spring. Williams Brothers just lost data to Akira. CoreRecon keeps the project files in your environment.
Texas has ~$80B in annual construction activity with stretched, mixed-IT staffing across GCs, specialty subs, and engineering/architecture firms. Cloud PIMS (Procore, Autodesk ACC, Bluebeam Revu, Sage/Viewpoint/QuickBooks ERP, BIM 360) hold the highest-value project IP in any per-firm database — drawings, RFIs, schedules, draw schedules, submittals, lien releases, and CUI flowing from DoD prime contracts on Fort Cavazos, JBSA, Red River Army Depot, and Corpus Christi NAS. The Williams Brothers Construction incident (Feb 2026, Akira ransomware affiliate, double-extortion model) and the documented TX GC $2.5M BEC wire fraud loss (2024, $776K recovered from a $2.5M draw reroute) are not hypotheticals. They are the threat model.
When your firm touches DoD facility drawings (CMMC 2.0 32 CFR Part 170 + DFARS 252.204-7012/7021), bids on TxDOT or DIR state-funded projects (1 TAC §201 IT security clauses), processes Texas-resident employee/subcontractor PII (TDPSA §541 — $7,500/violation), or handles mortgage/closing flow-down data (FTC Safeguards §314 where applicable), four regulatory trackS simultaneously attach to your security posture. 30-minute IR response. SDVOSB-certified. Texas data residency.
Williams Brothers Construction (Feb 2026).
Akira ransomware affiliate conducted a double-extortion attack — employee files, financial records, and project data alleged stolen before encryption. Secondary anchor: Bouygues Construction (Maze, Jan 2020, €10M ransom demand, ~237 computers encrypted, ~1,000 TB data potentially exfiltrated, double-extortion pioneer). Source: IntegrateCyber reporting on Williams Brothers/Akira; Corvus Insurance 2024–2025 construction ransomware surveys; ReliaQuest 41% construction ransomware surge 2023–2024.
Why Generic IT Fails TX Construction & Engineering Firms
Cloud PIMS. CAD/BIM Servers. Field-Laptop Wireless Vendors. All on the Same VLAN.
Generic managed IT treats construction GCs like CPA firms or law offices — same EDR, same patch cadence, same MFA. Construction firms have workflow-specific risks that don't exist in any other sector. Procore/Autodesk ACC cloud project management, BIM/CAD file servers with Revit/AutoCAD/MicroStation projects, field-laptop wireless-vendor connections on job-site trailers, and Sage/Viewpoint draw-payment workflows frequently share the same flat L2 network segment with office workstations and Procore web-console access. Standard IT doesn't model any of it.
Cloud PIMS + ERP Credential Exposure
Procore, Autodesk ACC / BIM 360, Bluebeam Revu, Sage 300 CRE, Viewpoint Vista, QuickBooks Enterprise — cloud-hosted project management and construction ERP with shared SSO, billing integration, and draw-payment workflows. A compromised billing-administrator credential = full project file visibility, payment schedule access, and subcontractor contact list. Standard MFA on email alone doesn't gate the Procore billing console. Reddit r/Construction documented a 2024 Procore credential compromise. Our SOC instruments the cloud-PIMS attack surface explicitly.
BIM/CAD Server Ransomware Encryption
Revit project files, AutoCAD drawing sets, Bentley MicroStation models, IFC/BIM collaboration files, schedules (Primavera P6 / MS Project), RFIs, submittals sit on file servers that frequently share the same VLAN as office workstations and the project-wide Git/SharePoint. Construction ransomware has a unique extortion model: attackers research the project schedule and deploy encryption 2–4 weeks before a major construction milestone. The Williams Brothers Akira pattern: exfiltrate first, then encrypt the day before a project deliverable or draw payment.
Field-laptops in job-site trailers, project-manager tablets running Procore mobile, RFI/photo capture apps, wireless-vendor connections (job-site AT&T/Verizon LTE, subcontractor Wi-Fi) ship with weak default credentials, no conditional-access enforcement, and frequently bypass the corporate VPN entirely. Field laptops are the most common ransomware entry point and the least secured device fleet. Generic MSSPs monitor EDR signals but don't model the wireless-vendor / LTE bypass threat. Our SOC instruments field-laptop drift and the wireless-vendor third-party attack surface explicitly.
The Exposure
207 Days of Dwell Time. Draw Schedules Sold Before Encryption.
Median dwell time for construction sector midsize firms: 207 days (IBM X-Force 2024). Texas GCs sit in this band. Seven months of lateral movement, Procore credential theft, BIM file staging, and draw-payment schedule exfiltration before detection. Akira affiliates — the same operator that hit Williams Brothers Construction — exfiltrate before encrypting. They sell project files and draw-payment schedules on dark-web construction-data markets, then encrypt the BIM file server for ransom on the way out. The GC's project schedule, subcontractor banking information, and the prime-contract vendor list end up as a single downloadable bundle.
BEC Draw-Wire Fraud — The Hidden Killer
BEC draw fraud is construction's #1 loss event. FBI IC3 documented $3B+ in BEC losses in 2025; construction ranks in the top 3 sectors by BEC loss. The documented 2024 TX GC $2.5M draw loss: contractor impersonation on a bank-change request, no callback verification, funds dispersed through multiple accounts within hours. Recovery rate after 24 hours: below 30%. Single fix: callback verification SOP — but CoreRecon adds the SOC email monitoring that catches the lookalike-domain impersonation before the finance team ever opens the email.
Project IP + Subcontractor Banking Exfil
Project files, RFIs, submittal logs, BIM models, and the subcontractor banking-inventory spreadsheet are high-value targets. Exfiltrated subcontractor banking information becomes feedstock for next-step BEC fraud against the prime or other subs on the same project. Avg project delay from BIM encryption: 21 days. Avg recovery cost in construction breach: $4.2M (IBM CODB 2025). We monitor outbound Procore traffic, BIM file server bulk-access events, and subcontractor-W-9 spreadsheet access.
CUI Leakage on DoD-Adjacent Projects
Construction firms on Fort Cavazos, JBSA, Lackland, Fort Bliss, Corpus Christi NAS, or Red River Army Depot projects handle DoD facility drawings, military installation site plans, and structural documents for defense infrastructure. A breach that exfiltrates these materials triggers DoD Mandatory Disclosure (DFARS 252.204-7012, 72-hour reporting), False Claims Act exposure, and disqualification from future CUI work. We monitor outbound traffic to known-CUI destinations and DoD facility drawing file-pattern events.
Texas construction & engineering firms operate inside a unique multi-track regulatory stack. CMMC 2.0 Phase 2 (32 CFR Part 170) applies to any firm handling DoD CUI. DIR/TxDOT state-funded project IT security clauses apply to any firm bidding Texas state work. TDPSA §541 enumerates Texas-resident employee PII as sensitive data. FTC Safeguards §314 applies where mortgage/closing data flow-down reaches the firm's systems. Each track has an active enforcement arm or industry expectation.
CMMC 2.0 32 CFR Part 170 — Phase 2 Enforcement Begins November 2026
Issued by the CMMC 2.0 Program Office (DoD). Applies to every TX construction or engineering firm that handles Controlled Unclassified Information (CUI) on DoD-funded projects — Fort Cavazos, JBSA (Fort Sam Houston / Lackland / Randolph), Red River Army Depot, Corpus Christi NAS, Fort Bliss, and any MILCON/BOS contractor. Mandates 110 NIST SP 800-171 Rev 2 controls across 14 families for Level 2; 15 controls for Level 1. C3PAO assessments begin November 2026. C3PAO wait times already running 6–12 months nationally. Source: 32 CFR Part 170; DFARS 252.204-7012 + 252.204-7021; NIST SP 800-171 Rev 2; CMMC 2.0 Program Office.
DFARS 252.204-7012 — DoD Mandatory Disclosure
Verbatim: Contractors must rapidly report cyber incidents that result in an actual or reasonably suspected compromise of CUI or covered defense information. Required: 72-hour reporting window to DoD CIO via ; preserve and images all affected systems; submit to DC3/DCID. Failure triggers False Claims Act liability if unencrypted CUI was involved. Construction GCs that route DoD facility drawings through Procore without segmentation inherit this obligation. Source: DFARS 252.204-7012(c)–(d); DIBNet reporting portal.
1 TAC §201 — DIR / TxDOT State-Funded Project IT Security
Texas Department of Information Resources (DIR) and Texas Department of Transportation (TxDOT) contracts require IT security clauses for any contractor handling state data. Standard state clauses require MFA on systems containing state-resident PII, contractor background checks for personnel with access to state systems, and breach notification within specific state-defined windows (typically 24–72 hours). GCs and engineering firms bidding Texas state-funded construction projects inherit these clauses contractually. Source: 1 TAC §201; DIR Statewide Cybersecurity Contract provisions; TxDOT standard contract clause library.
TDPSA — TX Data Privacy & Security Act
TDPSA §541 (effective July 1, 2024): employee PII (SSNs, I-9s, payroll), subcontractor W-9 data, and client records all in scope. Required: $7,500/violation civil penalties; 45-day consumer request response window. TX AG enforcement posture: $1.4B Meta settlement, $3.5M Marriott settlement — dedicated privacy enforcement team active. Breach notification to TX AG required on TX-resident data exposure. Source: Texas Business & Commerce Code §541.001–§541.151; TX Attorney General TDPSA enforcement records.
FTC Safeguards — 16 CFR §314 (Where Applicable)
FTC Safeguards Rule (16 CFR §314) applies to any financial institution under FTC jurisdiction. For construction & engineering firms, this triggers where: (i) the firm handles mortgage/closing flow-down data on real-estate construction projects, (ii) the firm is a finder/arranger in residential construction financing, (iii) the firm's prime contract requires a financial-services flow-through. Required: written ISP, Qualified Individual designation, MFA, continuous monitoring. Penalty per violation: up to $100,000 civil / $50,000+ for the Qualified Individual. Source: 16 CFR §314; FTC Safeguards Rule revisions (2021–2023).
FAR 52.204-21 — Basic Safeguarding (15 Controls)
Verbatim: All federal contracts involving Federal Contract Information (FCI) apply 15 basic safeguarding controls — essentially CMMC Level 1. Required: MFA on cloud / email, basic EDR, vulnerability patching, physical access control, awareness training. Every federal construction contract has this active today — non-compliance risks contract suspension and debarment. The 15 controls are the floor for federal GC compliance. Source: FAR 52.204-21 (basic safeguarding); FAR 52.204-23/25 (procurement cyber).
NIST SP 800-171 Rev 2 — 110 Controls
NIST SP 800-171 Rev 2 mandates 110 controls across 14 families for any contractor handling CUI. The full family set: Access Control, Awareness & Training, Audit & Accountability, Configuration Management, Identification & Authentication, Incident Response, Maintenance, Media Protection, Personnel Security, Physical Protection, Risk Assessment, Security Assessment, System & Communications Protection, System & Information Integrity. SPRS score submission required for all DoD-bound GCs. Source: NIST SP 800-171 Rev 2 (csrc.nist.gov); DFARS 252.204-7012.
Real Incidents
Six Construction & Engineering-Sector Incidents. What's in the Record.
Each is documented — IntegrateCyber reporting, ReliaQuest 2024 construction ransomware data, Corvus Insurance 2024–2025 sector analysis, FBI IC3 records, IBM CODB 2025, TX AG breach notifications. They form the threat landscape underwriters, primes, and clients are already measuring your firm against.
Williams Brothers Construction
Akira Ransomware · Feb 2026
Akira affiliate conducted a double-extortion attack — data exfiltration + encryption threat. Employee files, financial records, and project data alleged stolen before encryption payload was prepared. RaaS affiliate model with public leak-site pressure. Source: IntegrateCyber reporting on Williams Brothers Construction/Akira (Feb 2026); construction ransomware press coverage.
Texas GC — BEC Wire Fraud
Draw Payment Reroute · 2024
Documented TX GC draw-payment BEC fraud: $2.5M wired, $776K recovered after bank-change impersonation on a government-contractor draw payment. No callback verification SOP — exact replica of standard Texas municipal construction billing workflow. Funds dispersed through multiple accounts within hours. Source: FBI IC3 reporting; TX AG BEC records; construction-fraud legal press.
Bouygues Construction
Maze Ransomware · Jan 2020
Maze ransomware (double-extortion pioneer) encrypted ~237 computers, exfiltrated ~1,000 TB data, shut down global IT network. ~€10M ransom demand. Set the operational playbook for encryption-plus-leakage now seen daily in TX GC incidents. Global construction-supply chain impact (Bouygues is a top-tier international GC). Source: Maze ransomware press coverage (Jan 2020); Bouygues Construction incident response disclosure.
BAM Construct UK
Ransomware · Early 2020
UK general contractor (Royal BAM Group subsidiary) website and internal systems offline. NHS hospital construction projects (Yorkshire/Humber) disrupted. Demonstrates that construction ransomware impacts not only the GC but also the owner-occupied facilities being built — patient care interruption as collateral. Source: BAM Construct UK incident press; NHS hospital construction disruption reporting.
Suffolk County, NY (Gov't-GC Payments)
AlphV/BlackCat · Sept 2022
AlphV/BlackCat (now BlackCat successor) exfiltrated ~4 TB of data. County services disrupted for months. Government-contractor payment infrastructure compromised — exact parallel to Texas DIR/TxDOT state-funded GC payment exposure. $25M+ recovery cost. Source: Suffolk County NY ransomware incident post-mortem; AlphV/BlackCat press coverage.
Halliburton TX Operations
Ransomware · Oct 2024
Halliburton Texas information systems disrupted by ransomware. Multi-million dollar IR/recovery costs. While Halliburton is energy services, the construction-side supply chain (oil/gas construction contractors, pipeline construction GCs, well-pad site-prep contractors) was directly affected. Energy/construction supply chain convergence incident. Source: Halliburton October 2024 incident disclosure; SEC 8-K filings.
CoreRecon Delivers
Everything a Construction SOC Actually Needs. Nothing It Doesn't.
Construction firms are not generic enterprises. Procore/Autodesk ACC project management integrations, BIM/CAD file server ransomware (Revit / AutoCAD / MicroStation), draw-payment and Sage/Viewpoint ERP integrations, DIR/TxDOT state-funded project IT clauses, and Procore field-laptops in wireless-vendor job-site trailers require a security architecture built for construction workflows — not retrofitted from a CPA-firm template or a generic healthcare template.
🕐
Construction-Aware 24/7 TX-Resident SOC
24/7/365 security operations center staffed by TX-based analysts who know that Procore, Autodesk ACC, Sage 300 CRE, Viewpoint Vista, and QuickBooks Enterprise are not the same platform. Not an overseas NOC reading your Procore alert for the first time at 3 AM. A project manager at 11 PM on a Friday before a draw gets a live Texas analyst.
⚡
30-Minute IR SLA
Contractual 30-min SLA — not "we'll get to it." Detection-to-containment within 30 minutes of confirmed breach, vs. industry 1–4 hour average. Documented in your MSA. The 30-min SLA is the difference between containing a Procore credential stash and discovering the draw-wire fraud 7 months later.
🖥️
EDR on Procore / Autodesk ACC / BIM Workstations
Next-gen EDR on the workstations that run Procore, Autodesk ACC, BIM 360, Bluebeam Revu, Revit, AutoCAD, MicroStation — including the project-manager workstation, the estimator's BIM machine, the superintendent's Procore mobile, and the field-laptop fleet. Behavioral analytics catches lateral movement and credential dumping from a compromised project-manager workstation before the Procore cloud SSO is harvested.
📋
CMMC 2.0 Phase 2 POA&M Authorship
For GCs handling CUI on Fort Cavazos, JBSA, Red River Army Depot, Corpus Christi NAS, Fort Bliss, or any MILCON project: programmatic CMMC 2.0 (32 CFR Part 170) + NIST SP 800-171 Rev 2 baseline authorship. POA&M build, SPRS score documentation, C3PAO assessment readiness. Annual review cycle included. Cyber insurance carriers accept the binder as evidence of "documented controls."
🤝
DFARS 72-hour DoD Disclosure Workflow
DFARS 252.204-7012(c) requires rapid DoD reporting of cyber incidents affecting CUI. Our IR team coordinates the 72-hour DIBNet disclosure workflow. We deliver the DFARS-required artifacts: forensic documentation, scope-of-affected CUI analysis, and the timeline narrative a DoD CIO reviewer accepts. False Claims Act exposure avoided if CUI was unencrypted.
📦
BIM/CAD File Server Segmentation + Immutable Backup
VLAN segmentation isolating the BIM/CAD file server (Revit / AutoCAD / MicroStation projects, schedules, RFIs, submittals) from the general corporate network and internet-facing systems. Immutable, offline backups of the BIM repository — tested recovery with documented RTOs. In 2024, 94% of ransomware attacks targeted backup infrastructure first. Standard NAS backups are not safe.
SDVOSB + DIR Cooperative Contracting Wedge
SDVOSB Certified + DIR Cooperative Eligible. Set-Aside Positioning for TX DoD-Funded Projects.
If your firm bids DoD MILCON projects (Fort Cavazos, JBSA, Red River Army Depot, Corpus Christi NAS, Fort Bliss), SDVOSB set-aside positioning is a contracting advantage. DIR cooperative contracts (TIPS, BuyBoard) let you procure CoreRecon cybersecurity services without a separate RFP cycle — accelerating onboarding by weeks.
SDVOSB
Service-Disabled Veteran-Owned Small Business. Certified by the VA's Center for Verification and Evaluation (CVE). USMC veteran-led team. TX construction firms bidding MILCON or other DoD projects can source cybersecurity from an SDVOSB on day one — no re-bid cycle required. DIR cooperative contract eligible (TIPS / BuyBoard).
SDVOSB Set-Aside Positioning on TX DoD MILCON
Construction firms bidding DoD MILCON (military construction) projects at TX installations — Fort Cavazos, JBSA San Antonio, Lackland AFB, Randolph AFB, Red River Army Depot, Corpus Christi NAS, Fort Bliss — increasingly need SDVOSB sub-tier vendors. CoreRecon's CVE-verified SDVOSB certification streams vendor approval for cybersecurity services on these projects. We produce the documentation a DoD contracting officer requires without a re-bid cycle.
DIR Cooperative Contract Eligibility (TIPS / BuyBoard)
Texas DIR-cooperative contracts (TIPS, BuyBoard) let any Texas public entity, school district, or government-funded organization procure cybersecurity services without a separate RFP. Construction firms doing state-funded TxDOT projects or working with TX school districts, counties, and municipalities can onboard CoreRecon under an existing cooperative contract. Onboarding timeline drops from a 4–8 week RFP cycle to a 2-week PO.
Cyber Insurance Premium Impact
Construction firms with documented CMMC 2.0 readiness, SPRS score submission, and a CoreRecon SOC engagement increasingly receive documented-Controls premium discounts on cyber insurance renewals in 2025–2026. Industry-wide, post-2023 — carriers deny 40%+ of construction-sector claims where no documented controls exist. Typical savings on documented-control policies: 5–15% on premium at renewal.
Transparent Pricing — No "Contact Sales"
Published Rates. Month-to-Month. No 3-Year Lock-In.
CoreRecon publishes pricing because construction firms shouldn't need to spend 90 minutes on a sales call to learn whether a cybersecurity provider is in-bounds. Three tiers. Per-endpoint. All include 24/7 SOC coverage and 30-minute IR SLA.
Sentinel
$89/endpoint/mo
min. 10 endpoints
24/7 SOC monitoring — TX-resident analysts
Endpoint detection & response (EDR)
Email threat analysis + BEC monitoring
Monthly vulnerability summary report
Callback verification SOP template
Recommended
Fortress
$109–$129/endpoint/mo
min. 10 endpoints
Everything in Sentinel, plus:
EDR on Procore / Autodesk ACC / BIM workstations
BIM/CAD file server segmentation + immutable backup
30-minute IR SLA is contractual across all tiers — documented in your Master Service Agreement. Industry average response time: 1–4 hours (SANS 2024 IR Survey). We measure against that standard every month and report it to you.
SLA Proof
30 Minutes vs. Industry Standard: The Gap Is the Risk.
The 30-minute SLA isn't marketing — it's the difference between containment and dwell time. Ransomware operators complete the full attack chain (initial access → lateral movement → Procore credential harvesting → BIM file encryption) in 45–90 minutes on average. Most MSSPs detect and respond within 1–4 hours. The window between what they offer and what ransomware actually does is where construction firms lose everything — Procore credentials, draw schedules, subcontractor W-9 banking, BIM models.
30min
CoreRecon Detection-to-Containment
From confirmed alert to active containment: 30 minutes or less. Contractual. Measured monthly. Reported to you in your service review.
Median Dwell Time: 207 Days
IBM X-Force Threat Intelligence Index 2024: median dwell time before breach notice at construction-sector midsize firms (the band TX GCs sit in) is 207 days. The EDR component of our Stack measures detection-to-containment — not dwell. 30-min means we kill the chain in the active phase, not seven months later. The Williams Brothers Akira post-incident narrative suggested comparable dwell on the Procore credential-staging phase.
Industry Average: 1–4 Hours
SANS 2024 IR Survey: median time from detection to containment is 1–4 hours for MSSP-monitored environments. By that time, Akira affiliates have usually completed Procore SSO credential exfiltration, draw-payment schedule staging, and lateral movement into the BIM file server. Containment is still necessary — but the exfil bundle is already uploaded.
Ransomware Kill Chain: 45–90 Min
CrowdStrike 2024 Global Threat Report: average time from initial access to encryption is 45–90 minutes for human-operated ransomware. The Akira affiliates targeting TX construction firms in 2024–2026 documented kill chains at the lower end of this range. A 30-min SLA puts us inside the kill chain. Anything slower means we're responding to a fully-executing attack, not containing one.
Compliance Mapping
Framework-to-Control Crosswalk for Texas Construction & Engineering Firms
CoreRecon maps every SOC function to the specific regulation or framework that requires it. When your cyber insurance carrier, C3PAO assessor, DIR contract reviewer, TX AG breach examiner, or prime GC GC's contract officer asks "what does your security program actually cover?", this is the answer.
Requirement
CMMC 2.0 / DFARS / NIST
DIR / TDPSA / FTC Safeguards
CoreRecon Control
Access Controls (AC)
CMMC L2: AC.L2-3.1.1–3.1.22
DIR §201 MFA; TDPSA §541.062
MFA on Procore / Autodesk ACC SSO; RBAC on project files
Audit & Accountability (AU)
CMMC L2: AU.L2-3.3.1–3.3.9
DIR §201 audit log retention
EDR + Procore audit log ingest; 6-year retention
Configuration Management (CM)
CMMC L2: CM.L2-3.4.1–3.4.7
FAR 52.204-21 15 controls
BIM/CAD baseline configs; weekly drift detection
Identification & Authentication (IA)
CMMC L2: IA.L2-3.5.1–3.5.11
DIR §201 identity controls
MFA on all cloud PIMS; field-laptop conditional access
Incident Response (IR)
CMMC L2: IR.L2-3.6.1–3.6.3
DFARS 252.204-7012 72-hr reporting
30-min SLA; IR plan tested quarterly; DIBNet disclosure workflow
Media Protection (MP)
CMMC L2: MP.L2-3.8.1–3.8.9
TDPSA §541 media sanitization
Encrypted BIM/CAD backups; media disposal documentation
Built for Construction. Not a Generic Enterprise Package.
Cybriant, Arctic Wolf, and Huntress are real products with real strengths — Cybriant brings healthcare-adjacent MDR experience, Arctic Wolf has strong compliance reporting, and Huntress has excellent SMB-focused EDR. CoreRecon is built for construction & engineering-firm workflows from day one, with TX-resident analysts, Procore/Autodesk ACC-aware EDR, CMMC 2.0 Phase 2 POA&M authorship, DFARS 72-hr disclosure workflow, and SDVOSB contracting at a published price.
Where we lose. Huntress is best-in-class at SMB EDR detection fundamentals; if your firm prioritizes EDR signal alone over Procore-aware 24/7 SOC + CMMC POA&M authorship, Huntress is a credible choice. Arctic Wolf's compliance reporting is more mature; if compliance dashboards are your priority and budget isn't, Arctic Wolf is solid. Cybriant's healthcare-adjacent positioning is a legitimate alternative if your firm is primarily healthcare-construction (hospital projects, medical office buildings) with no DoD CUI flow.
Where we win. Published construction-firm pricing. Procore / Autodesk ACC / Autodesk BIM 360 PIMS-aware EDR. BIM/CAD file server segmentation + immutable backup. CMMC 2.0 Phase 2 POA&M authorship with SPRS documentation. DFARS 252.204-7012 72-hour DoD disclosure workflow. TX-resident analysts on construction-PMS workflows. SDVOSB contracting for MILCON and other DoD-adjacent engagements. 30-min contractual SLA in your MSA at $89–$129/endpoint.
CoreRecon's Security Posture Assessment covers endpoint exposure, Procore / Autodesk ACC attack surface, BIM/CAD file server segmentation, CMMC 2.0 Phase 2 readiness, DFARS 72-hour disclosure workflow, DIR/TxDOT state-funded project IT clause readiness, TDPSA exposure, and callback verification SOP authorship. It's free. Takes 20 minutes to complete. Written report with prioritized findings — not a sales deck.
What the Assessment Covers
Endpoint coverage audit — which office, PM, estimator, and field-laptop workstations are actually monitored. Procore / Autodesk ACC / BIM 360 attack surface — cloud-PMS credential and lateral-movement exposure. CMMC 2.0 Phase 2 POA&M gap — readiness against 32 CFR Part 170 + NIST SP 800-171 Rev 2 + DFARS 252.204-7012. DIR/TxDOT state-funded project IT clause readiness — MFA / background-check / breach notification. TDPSA + FTC Safeguards sensitive-data exposure — employee PII / subcontractor W-9 / mortgage flow-down.
What You Get
Written security posture report — prioritized findings, not a risk matrix. 30-min debrief call with a TX-based analyst (not a sales rep). Remediation roadmap — what to fix first, what can wait. No obligation — if you're not a fit, we'll tell you.
What Texas Construction & Engineering Firm Owners Are Saying.
Social proof — quotes from TX GC owners, firm principals, and project managers who have onboarded with CoreRecon. PLACEHOLDER block (John to fill). Three short testimonials, each tied to a different outcome: Procore credential compromise contained, draw-wire fraud blocked by SOC + callback SOP, DIR cooperative procurement cycle compressed.
PLACEHOLDER — Quote 1
“PLACEHOLDER — quote from a TX GC principal about how CoreRecon's 30-min SLA contained a Procore credential-stuffing incident before the draw schedule exfil completed. Name + firm + city.”
PLACEHOLDER — Quote 2
“PLACEHOLDER — quote from a TX engineering-firm principal about DFARS 252.204-7012 72-hour DoD disclosure workflow authorship through a CUI-handling event. Name + firm + city.”
PLACEHOLDER — Quote 3
“PLACEHOLDER — quote from a TX multi-location GC IT director about DIR cooperative contracting cycle compression via TIPS. Name + firm + city.”
Research Brief — July 2026
Download the TX Construction & Engineering Firms Threat Brief.
8 documented incidents. Williams Brothers Construction (Feb 2026, Akira). Bouygues Construction (Maze, €10M). Texas GC $2.5M BEC wire fraud (2024). BAM Construct UK. Suffolk County NY (AlphV/BlackCat). Halliburton TX. Threat actor profile (Akira / Maze / BlackCat) and 32 verified sources. Print-ready PDF.
What's in the Brief
Named incidents: Williams Brothers Construction (Akira, Feb 2026), Bouygues Construction (Maze, €10M, Jan 2020), TX GC $2.5M BEC draw-wire loss (2024), BAM Construct UK, Suffolk County NY (AlphV/BlackCat, $25M recovery), Halliburton TX (Oct 2024), TX engineering firm BEC fraud, Procore credential compromise (Reddit r/Construction 2024) — 8 anchors with confirmed dates and vectors.
TX regulatory stack: CMMC 2.0 32 CFR Part 170 Phase 2 (Nov 2026), DFARS 252.204-7012 72-hour DoD disclosure, NIST SP 800-171 Rev 2 (110 controls), FAR 52.204-21 (15 basic safeguarding controls), 1 TAC §201 DIR/TxDOT state-funded project IT clauses, TDPSA §541 employee/subcontractor PII, FTC Safeguards §314 where mortgage/closing flow-down applies.
How to Get It
Gate: Name + firm email + phone. Takes 30 seconds.
Delivery: We email the PDF + provide an instant-access download link. One delivery, gated by work email. No drip sequence.
Questions Texas Construction & Engineering Firms Ask Before Signing.
Direct answers. Not legal advice. Not a substitute for your breach counsel — but enough to know whether we're a fit.
Yes. EDR is deployed on the workstations that run each of those platforms. We instrument Procore / Autodesk ACC cloud-SSO enforcement, the project-file distribution attack surface, and the field-laptop drift on wireless-vendor connections. BIM/CAD file server segmentation (Revit / AutoCAD / MicroStation) is part of the Fortress tier. If your firm uses a stack we don't yet model, we'll add it during onboarding — included.
POA&M authorship is included as part of the Command tier — not a separate billable project. We deliver a binder against the 32 CFR Part 170 + NIST SP 800-171 Rev 2 + DFARS 252.204-7012 / 252.204-7021 requirements, mapped to your existing Procore / Autodesk ACC + BIM file server + Sage / Viewpoint ERP architecture. Annual CMMC review cycle is included in the tier cadence. C3PAO assessment readiness is a Command-tier deliverable. If your firm already has a contractor-built POA&M and only needs gap assessment, we do that too — same engagement scope.
Our 24/7 IR team activates DIBNet disclosure workflow the moment your prime notifies you of the demand. We coordinate with your DFARS-aware counsel to deliver the forensic documentation, the scope-of-affected-CUI analysis, and the timeline narrative that DoD CIO reviewers and DIBNet accept. 72-hour clock starts from confirmed incident — not from when we detect the inquiry. False Claims Act exposure avoided if CUI was encrypted at rest. Our SOC instrumentation (EDR + network egress controls + immutable backup timing) produces the forensic record the disclosure requires.
Yes. DFARS 252.204-7012 + 252.204-7021 require primes to include CMMC flowdown clauses in every subcontract where CUI is shared. If your structural, MEP, civil, or specialty trade work involves DoD facility drawings, military installation site plans, or structural documents for defense infrastructure, you inherit the obligation — and the prime is responsible for verifying your compliance. CMMC Level 2 assessment applies. Sentinel covers the BAC; Fortress adds Procore + BIM segmentation; Command delivers the full POA&M + SPRS documentation package.
We monitor outbound email for lookalike-domain impersonation patterns targeting your finance team — emails posing as subs or vendors with bank-change requests. The callback SOP prevents the wire from going out at all. If a wire does go out, our IR team activates the FBI IC3 reporting workflow within hours. Recovery rate after 24 hours drops below 30%. EDR on the finance-team workstation + email-domain monitoring catches the early-stage impersonation activity. Single fix that stops 90%+ of BEC draw fraud: callback verification SOP — included at Sentinel tier.
Each project's workstation / server footprint is counted separately under the per-endpoint pricing model, but aggregated into a single engagement so the SOC sees the entire firm. The Procore / Autodesk ACC administrative tier is included in the aggregate coverage; per-project branch PCs are priced individually. Field laptops are priced under the same endpoint model. If your firm operates Procore multi-tenant across multiple project portfolios, we roll them into one SOC engagement with a single SOC dashboard view.
Yes. Our standard agreement is month-to-month for Sentinel and Fortress. Command tier (dedicated vCISO + CMMC POA&M authorship continuity + DFARS disclosure workflow authorship) is a 12-month retainer for vCISO continuity and POA&M authorship continuity. There are no hidden termination fees for early exit on month-to-month tiers. We win on retention results at the firm level — not contract lock-in. Project-completion transitions are scoped individually for any GCs ending a major MILCON engagement.
📍Texas-Based SOC
🎖️SDVOSB-Certified (CVE)
🇺🇸USMC Veteran-Led Team
🛡️24/7 SOC — 30-Min IR SLA
🏗️CMMC 2.0 Phase 2 Mapped
🤝Month-to-Month
Procore Credentials. Draw Schedules. BIM Models. CoreRecon Protects All Three.
Williams Brothers Construction lost data to Akira in February 2026. The 2025–2026 wave targets Texas construction firms through Procore credential theft, BIM/CAD file server encryption, and draw-wire BEC fraud. C3PAO assessments begin November 2026. The only question is whether your firm has a documented CMMC 2.0 Phase 2 POA&M with a contractual 30-min IR SLA — or a hope and a default cyber insurance policy.
Start the free assessment. Takes 20 minutes. Written report with prioritized findings. No sales deck.