Why This Report Exists
If you run technology, operations, or projects at an AEC firm, you already know the obvious IT risks: ransomware, downtime, lost laptops. This guide is about the non-obvious ones — the quiet failures that don't trip alarms but show up later as rework, change orders, claims, and missing payments.
Construction industry research consistently puts rework at 2–20% of contract value, and a widely cited PlanGrid/FMI survey found professionals spend roughly 35% of their time on non-productive activities like searching for information and fixing mistakes. Even small improvements here move the needle.
---
1. Revit Over a VPN Is Silently Corrupting Your Models
Your BIM team complains that Revit is "slow today." Sync-with-central takes 20 minutes instead of 2. Occasionally a central file goes corrupt and someone restores from backup, losing a half-day of work for the whole team.
Autodesk designed Revit's file-based worksharing for local office networks. Stretching it across a VPN or — worst of all — a OneDrive/Dropbox/SharePoint sync folder operates outside its supported design and can cause crashes, corruption, and data loss.
What it costs: 25 BIM staff losing 2–6 hours/week to sync issues can mean $200,000 to $1,200,000 per year in lost productivity. A single corruption event can freeze production for 2–5 days at $30,000 to $750,000.
Fix it:
- Inventory every Revit central model — flag any in OneDrive, Dropbox, or SharePoint sync
- Block central models in consumer sync folders at the endpoint level
- Move multi-office teams to a supported cloud worksharing service like Autodesk Docs
- Track average sync time per project and count failed syncs monthly
---
2. Field Crews Are Building from Unapproved Drawings
Procurement orders steel based on a model marked "Shared." The field installs ductwork from a PDF someone exported last Tuesday. Two weeks later the design changed and nobody updated the field. Cue the change order, the RFI war, and the delay claim.
ISO 19650 defines distinct states for information: Work In Progress, Shared, Published, and Archived. Items in "review and comment" status must not be used to procure materials or build from. Most firms know this; very few enforce it in their tools.
What it costs: On a $50M project, 0.25–1.5% of contract value wasted on rework from wrong-revision builds = $125,000 to $750,000 per project.
Fix it:
- Define what "Published" means in writing for every project
- Configure your CDE so documents can't reach Published without required metadata and approval
- Lock field apps to pull only from Published folders
- Run a weekly exception report on WIP downloads
---
3. External Collaborators Have More Access Than You Think
A subcontractor's engineer left six months ago but their account is still active with download rights to the model and bid documents. A consultant accidentally got "internal" permissions and can see the cost folder.
What it costs: Bid leakage and IP exposure can shift win rates — a 0.1–0.5% revenue impact on a $250M-revenue firm is $250,000 to $1,250,000 per year.
Fix it:
- Classify information into Public, Project-Shareable, Controlled, and Restricted buckets
- Require SSO and MFA for every external user — no exceptions
- Auto-deprovision based on contract end dates
- Alert on bulk downloads and mass-export events
---
4. Your BIM and Your Survey Don't Agree on Where the Building Is
Steel arrives from the fabricator and doesn't fit. Underground utilities are 18 inches off. The site model and the architectural model line up until you overlay GIS data and discover a 3-meter offset nobody can explain.
BIM models live in a local Cartesian grid. The earth is curved. Without a single "coordinate authority," errors compound silently and show up late — in field layout and prefabrication, when fixes are most expensive.
What it costs: On a $50M project, 0.5–3% of contract value in rework and claims = $250,000 to $1,500,000.
Fix it:
- Appoint a Coordinate Authority at project kickoff (survey lead + BIM lead)
- Mandate coordinate metadata on every model exchange
- Build automated checks that flag missing CRS data and impossible coordinates
- Run a monthly tie-out comparing model control points against surveyed as-built control
---
5. Point Cloud and Drone Data Is Eating Your Network Alive
Your VDC team waits 40 minutes for a 200 GB scan to open. Three offices have copies of the same point cloud taking up 1.5 TB. Reality capture data has data gravity — it pulls storage, network, and workstations into failure modes that don't show up until mid-project.
What it costs: $135,000 to $650,000 per year in productivity drag, plus $50,000 to $500,000 in reactive infrastructure spend and potential schedule risk of $45,000 to $1,500,000.
Fix it:
- Define a data lifecycle: raw → registered → segmented → published
- Force local SSD scratch for processing (5-minute open vs. 50-minute open)
- Tier storage: hot (NVMe) for active work, warm for reference, cold for archive
- Add a "reality capture readiness" checklist at project kickoff
---
6. Your Dashboards and Your Accounting System Don't Agree
The BI dashboard shows $42M committed. The ERP shows $43.2M. Nobody can say which is right. Three weeks later you discover a sync job has been silently failing because the API was throttling it.
AEC platforms like Procore enforce API rate limits — 3,600 requests per hour on many endpoints. When your integration hits the limit and doesn't handle it properly, it just loses data quietly.
What it costs: On a $50M project, if cost controls are off by 0.2–1%, exposure is $100,000 to $500,000 per project.
Fix it:
- Build a "data completeness dashboard" comparing records expected vs. received
- Handle HTTP 429 responses with exponential backoff
- Switch to incremental syncs using last-updated timestamps
- Run daily reconciliation jobs between source and target systems
---
7. Your Projects Are Outlasting Your Software
You're three years into a five-year hospital project. Autodesk drops support for the version you started in. Your custom Dynamo scripts break on the new release. Autodesk supports the current Revit version plus the previous three — anything older is unsupported.
What it costs: A 1–3 week milestone disruption can cost $75,000 to $3,150,000. Recurring compatibility churn burns $100,000 to $500,000 per year.
Fix it:
- Set a version baseline per project at kickoff and put it in the contract
- Build a test matrix for templates, add-ins, and exports before adopting new versions
- Maintain a deprecation calendar for custom automations
- Standardize workstation images per version line
---
8. Power Users Are Running a Shadow Software Supply Chain
A senior modeler built an amazing Dynamo script. Three years later it's on every workstation. Nobody knows who maintains it, whether it's safe, or what happens when the modeler leaves. Same story with Excel macros and Revit add-ins downloaded from forums.
What it costs: $117,000 to $585,000 per year in chronic waste from broken scripts, plus acute risk from malicious macros or Trojan add-ins.
Fix it:
- Inventory every add-in, script, and macro — owner, purpose, risk class, status
- Require code signing for internal Revit add-ins
- Allowlist execution — only approved publishers and verified hashes can run
- Provide an internal "automation app store" with versioning and audit logs
---
9. Your Jobsite Is the Soft Underbelly of Your Network
A site superintendent buys a $79 consumer router. Default password. Site cameras share the same network as field tablets and trailer office computers. A vendor's USB drive introduces malware. A week later your corporate file shares are encrypted.
What it costs: A site-level cyber incident halting operations for 2–10 days runs $30,000 to $1,500,000, plus regulatory and relationship damage.
Fix it:
- Standardize a jobsite network reference architecture with separate zones for corporate, OT/IoT, and guest access
- Use centrally managed network gear — not consumer routers
- Enforce per-user identity and Mobile Device Management on every field tablet
- Discover unknown devices automatically and test backups quarterly
---
10. Your AP Team Is One Fake Email from a $500,000 Wire Fraud
An email arrives that looks exactly like one from a regular subcontractor: "We changed banks — please update our ACH info." AP updates the vendor master and releases the next pay app. Two weeks later the actual subcontractor calls asking where the money is.
The FBI reported $3.046 billion in BEC losses in 2024. AEC firms are particularly vulnerable because pay applications are large, frequent, and time-pressured.
What it costs: $25,000 to $2,000,000+ per incident, plus payment delays, legal recovery, and reputation damage with trade partners.
Fix it:
- Freeze bank changes unless verified by an out-of-band callback to a number already on file
- Require dual approval on vendor bank changes and the first payment after a change
- Deploy DMARC at "reject" — not "monitor only"
- Separate duties: the person who requests a change cannot verify or release payment
- Run quarterly BEC tabletop exercises with AP
---
Where to Start: A 90-Day Plan
First 30 days — Stop the bleeding:
- Audit DMARC and freeze vendor bank-change workflows
- Inventory Revit models in cloud sync folders
- Run a permissions audit on external CDE users
Days 31–60 — Build controls:
- Implement CDE workflow gates (Published-only for field consumption)
- Migrate high-risk Revit collaboration to supported topology
- Stand up integration monitoring with reconciliation
Days 61–90 — Make it durable:
- Roll out a jobsite network reference architecture
- Establish coordinate authority and geospatial QA
- Inventory and begin signing internal add-ins
The Pattern
Most of these problems aren't "IT problems" in the traditional sense. They live at the seam between IT, BIM/VDC, project controls, and finance. They require an IT partner who actually understands how AEC firms work — not a generic MSP who treats your Revit environment like Microsoft Office.
If your current provider hasn't raised any of these ten problems with you proactively, that tells you something worth knowing.
Want a second opinion? We work exclusively with AEC firms and we'd be glad to walk through this checklist against your environment — at no cost and with no obligation. Book a free IT assessment and in about 60 minutes we can tell you which of these problems you actually have, what they're costing you, and what it would take to fix the top three.