Foundations under fire. What construction firms look like from the outside.
An anonymised cross-organisation intelligence report on external attack surface exposure, supply chain risk, and the critical findings that construction companies share — whether they know it or not.
What construction firms share — beyond concrete and steel
This report draws on agentless external scanning of five construction and engineering organisations across Europe and the UK. No agents installed, no credentials shared, no questionnaires completed — every finding was discovered from public data alone, the same view an attacker has before they move.
The results are striking not because any individual finding is unique, but because the same patterns repeat across every organisation in the sector. Construction firms face a common set of digital risks that are structurally linked to how the industry operates: project-based delivery, multi-party subcontractor networks, legacy web infrastructure, and a supply chain that has grown beyond what any vendor register captures.
Supplier and technology data is factual, drawn from live scans. This is what your sector looks like from the outside.
Five construction organisations — one shared risk profile
Every organisation in this benchmark was scanned independently, from public data only, using the same agentless methodology. The convergence on a C resilience grade — across firms of wildly different sizes, geographies, and technical maturity — is not coincidence. It reflects the structural security debt of an industry that has digitalised rapidly without investing proportionally in the discipline to manage what it has built.
No two organisations share a domain, a network, or a technology team. Yet every one of them received the same overall cyber resilience grade. A sector signal. The C grade reflects a consistent pattern: well-configured core infrastructure coexisting with critical gaps in header security, software currency, and supply chain visibility — the exact areas where construction firms invest least.
What every construction firm in this benchmark has in common
When five independent organisations show the same risk categories, you stop asking "is this firm exposed?" and start asking "why is the sector exposed?" The following patterns appeared across every organisation benchmarked.
Why discovery, prioritisation, and monitoring are non-negotiable in construction
The construction sector combines two properties that make it uniquely exposed: a large, constantly changing digital footprint — driven by project lifecycles, joint ventures, and acquisitions — and a culture of operational urgency that has historically deprioritised security hygiene.
Discovery
Construction firms operate multiple project websites, tendering portals, BIM collaboration platforms, and subcontractor-facing systems — many spun up quickly and never formally decommissioned. ThingsRecon discovered an average of 1,848 internet-facing assets per organisation — far in excess of what any CMDB typically captures.
Prioritisation
With 622 total findings across five organisations and 54 requiring immediate action, the challenge is knowing which represent a live risk versus a theoretical one. ThingsRecon's Fix Now / Fix Soon / Monitor / Track framework cuts through the noise so stretched teams act on what matters today.
Monitoring
Construction's project-based operating model means the digital surface changes constantly — new joint ventures, abandoned portals, subcontractor collaboration environments that become permanent connections. Continuous monitoring ensures your risk picture expands with the surface, not months later.
Why construction has a supply chain problem that TPRM cannot solve
Construction is one of the most supply-chain-intensive industries on earth. A single major project involves dozens of specialist subcontractors, design consultancies, equipment suppliers, and platform vendors — each of whom gains some level of digital access to the prime contractor's systems. TPRM programmes ask vendors to fill in questionnaires. ThingsRecon discovers them from the outside — whether they're on a vendor list or not.
829 supplier connection vectors. Discovered without asking a single question.
Across the five organisations benchmarked, ThingsRecon identified 829 active technical connection vectors linking their attack surfaces to third-party suppliers — via script chains, certificate sharing, DNS delegation, header signatures, and ASN proximity, not a vendor register. The average TPRM programme covers fewer than 50 vendors; the external surface connects to ten times that number.
The sector's risk is compounded by three factors: subcontractors are digitally immature — smaller firms sharing credentials and repositories with prime contractors; shared platforms proliferate across competing organisations; and project relationships are informal, rarely offboarded, leaving connection vectors active long after the project closes.
Proximity is not the supplier's security score — it is how short the path is from a compromised supplier to your sensitive data. A supplier rated B for cyber hygiene can still sit at 41% proximity to your crown-jewel systems if it serves JavaScript onto your most-visited project portal. In construction, the crown jewels are BIM models, site survey data, tendering intelligence, and subcontractor personal data.
The top 5 suppliers found across the construction sector — none of them construction-specific. That is the point: the sector's shared digital risk is largely invisible to the sector itself, embedded in generic technology infrastructure connecting firms to the same handful of third parties.
When the same supplier appears in multiple competing organisations in the same sector, the risk is no longer confined to one organisation's attack surface. A targeted compromise of a shared supplier — a JavaScript library, a certificate authority, a CDN node — can simultaneously affect multiple construction firms. Nation-state actors and sophisticated ransomware groups understand this. Sector-level supply chain intelligence is the only lens that makes this visible.
Public (NASDAQ)Known breach historySOC 2 certified
CVE-2022-1388 (KEV listed)CVSS 9.8 — unauth. RCEActive exploitation confirmed
Proximity up to 26%Undeclared in TPRM registers
Rarely in vendor registers
Why this supplier: F5 BIG-IP appliances are legacy infrastructure — deployed years ago, maintained by network teams, invisible to the TPRM programme. CVE-2022-1388 allows unauthenticated RCE on the management interface, was added to CISA's KEV catalogue, and was actively weaponised within days.
One attack path — built from sector findings
Individual findings are just a list. The value is understanding the connection between them — the route an attacker takes from entry point to sensitive data. Below is a representative attack path assembled from findings observed across this benchmark; every node is grounded in a real pattern.
Exposures that legacy tools cannot see
Unminified source maps with embedded internal path references and dependency tree data detected in publicly accessible JavaScript build artefacts. The maps revealed server directory structures, CI/CD naming conventions, and the full npm dependency list — a detailed map of the application's internal architecture without any codebase access. Severity: high. Confidence: 94%.
API endpoint paths and parameter names embedded in production JavaScript bundles — including undocumented internal API routes used by the project management portal — discoverable by any attacker who reads the public-facing bundle. These routes, combined with weak authentication headers identified by the classic scan, create an enumeration-to-exploitation path a conventional rule-based scanner would not connect. Severity: high. Confidence: 91%.
The full picture: 622 findings, 54 requiring immediate action
The numbers below represent the aggregated finding landscape across all five organisations. The Fix Now count (54) represents findings where a live, exploitable exposure exists today — not a theoretical risk, but a current, verifiable gap that an attacker could use this week.
- Fix Now5/5 orgs — Missing HTTP security headers on external web assets. Referrer-Policy, Content-Security-Policy, X-Frame-Options, and HSTS absent across all five organisations' project portals and marketing sites. These headers prevent cross-site leakage, clickjacking, and session theft at zero remediation cost.
- Fix Now4/5 orgs — End-of-life and unpatched JavaScript libraries serving production web assets, including jQuery versions with documented CVEs. In one organisation, jQuery 3.5.1 was flagged as Fix Now. Exploit code for these versions is publicly available and automated in common attack toolkits.
- Fix Now3/5 orgs — Weak or misconfigured SSL/TLS services on externally reachable endpoints — legacy cipher suites, missing HSTS, and expired or near-expiry certificate chains on project subdomains. Tender portals and client login systems are the most commonly affected assets.
- Fix Soon3/5 orgs — Cookie security misconfigurations on project portal and CMS sessions — session cookies without the Secure, HttpOnly, or SameSite flags, served over HTTPS-capable but improperly configured endpoints. Cross-site scripting and session hijacking are the direct consequence.
- Fix Soon2/5 orgs — DNS security gaps — absent or misconfigured DMARC, SPF and DNSSEC — leaving two organisations' primary domains vulnerable to spoofing. Where payment diversion and BEC fraud via spoofed tender communications cause millions in losses annually, DMARC enforcement is a first-line defence, not an optional hygiene item.
- Monitor5/5 orgs — Undeclared supplier connections detected via technical vectors — not questionnaires. Analytics providers, marketing automation platforms, CDN nodes, and JavaScript framework publishers are embedded in every estate without appearing on any formal vendor register.
Everything above was found without internal access. Imagine what a full scan reveals.
This report is based on limited-scope agentless scanning — a surface-level read of public data. A full ThingsRecon engagement maps every internet-facing asset, profiles every supplier across 77 BI + 63 cyber-hygiene attributes, models every attack path, and provides a prioritised remediation programme. No agents. No questionnaires. No internal access. We start from a domain name.