The IT Disruptions That Actually Stop AEC Firms
Most lists of “common business disruptions” open with hurricanes and end with ransomware. Useful if you run a chain of retail stores. Less useful if you run a fifteen person architecture practice in Leduc, where the thing most likely to cost you a week is none of the above.
This post is in two halves. First, five signs your firm is reacting rather than preparing, which is a diagnostic you can run in about ten minutes. Second, the disruptions that actually happen to AEC firms, ranked by how often we see them rather than by how dramatic they sound.
Part one: five signs your firm is reacting
Being reactive is almost never a decision. It is what happens when everyone is busy delivering projects and preparedness never makes it to the top of anyone’s list. The problem is that the gaps stay invisible until something exposes them.
1. You cannot name the last time a project file was restored from backup
Not the last time a backup ran. The last time someone pulled a file out of backup, opened it, and confirmed it was intact.
These are different things and only the second one is evidence. Backup software reports success on jobs that produce unusable restores more often than most firm owners expect. A 4 GB workshared Revit model is also a meaningfully harder restore than a spreadsheet, and a backup design that handles one may not handle the other.
If nobody can answer this, you do not have a backup strategy. You have backup software.
2. When something breaks, people ask “who do I call?”
If a staff member finds themselves at 8:00 in the morning asking whether to call the IT provider, the software reseller, the internet company, or the principal, the answer should already be on a piece of paper.
Firms that have this sorted lose minutes. Firms that do not lose the morning, because the first three people involved each independently start investigating and none of them tells the client.
3. Your recovery plan predates your current file setup
Plenty of firms have a plan. Fewer have a plan that matches how they work now.
Did you move project files to SharePoint in the last two years? Did you start using Autodesk cloud worksharing? Did the person named as the emergency contact leave in 2024? Did you take on a public sector client whose contract has data handling requirements you have not read since signing?
A plan describing a server you decommissioned is worse than no plan, because it produces confident wrong actions.
4. One person is the single point of failure
Every AEC firm has one. It is the person who set up the CAD standards, or the one who knows how the sheet numbering works, or the one who manages the Autodesk licences, or the one who understands the folder structure well enough to find last year’s addenda.
Ask yourself what happens to an active project if that person is unreachable for two weeks. Not gone. Just unreachable, which is a far more likely scenario and one you have probably already survived once by luck.
5. Every problem feels like an emergency
Prepared firms still have outages. The difference is what the outage feels like.
If every technical problem in your office produces the same improvised scramble, the problem is not the frequency of technical problems. It is that each one is being solved from scratch.
Part two: what actually goes wrong
Reweighted for how AEC firms operate. The generic version of this list overweights natural disasters and underweights the things that fill our ticket queue.
Project file corruption and version confusion
The most common serious disruption in this industry, and the one that generic IT advice handles worst.
Workshared Revit models, linked models, AutoCAD external references and shared parameter files all have dependencies that ordinary office software does not. Move a folder and xrefs break. Put a workshared central model somewhere it was not designed to live and you can get corruption that no amount of general IT competence will resolve. Sync a folder that is being actively written to and you can produce conflicted copies of files that were supposed to be a single source of truth.
What preparation looks like
- Confirm that your project file storage matches what your design software actually supports for the way your team works, particularly for workshared models. Check this against current Autodesk documentation and with your reseller. The correct answer changes as the products change, and getting it wrong is expensive.
- Set a folder structure and a naming convention, then protect the structure so it cannot be casually reorganized by someone tidying up.
- Restrict who can move or delete top level project folders.
- Test restores of your largest and most complex files, not your smallest.
Microsoft 365 sync and permission problems
SharePoint, OneDrive and Teams solve real collaboration problems and create new ones when they are configured casually.
The failure modes we see most: a team member syncing an entire project library to a laptop with insufficient disk space, permissions inherited in a way that gives a departing contractor continued access to live projects, duplicate files created by conflicted sync, and staff who cannot tell which of three similarly named folders is the live one.
What preparation looks like
- Decide which content is synced locally and which is accessed online, and set that centrally rather than leaving it to each person
- Review external sharing permissions on a schedule, especially after a project closes out or a sub consultant relationship ends
- Have an offboarding checklist that includes revoking access, not just collecting a laptop
Account compromise and ransomware
CIRA’s 2025 Cybersecurity Survey, which polled 500 Canadian cybersecurity decision makers in August 2025, found that 43 percent of surveyed organizations had been targeted by an attempted or successful cyber attack in the previous twelve months, and 24 percent had been hit by ransomware. Of those hit by ransomware, 74 percent paid.
AEC firms are attractive targets for a specific and unglamorous reason: you move money and documents between many parties. Invoices go to clients, progress payments go to subs, and drawing sets go to contractors. That is a rich environment for business email compromise, where an attacker who has quietly read your mailbox for two weeks sends a payment redirect that looks entirely normal.
What preparation looks like
- Multi factor authentication on every account without exception, including the principal’s
- A written rule that payment detail changes are verified by phone to a known number, never by replying to the email
- Backups that an attacker who compromises an administrator account cannot reach or delete
- A restore path that does not depend on the environment that was compromised
Losing access to the office or the network
Fibre cuts, power failures, building issues, and Alberta winters that make a Tuesday commute optional.
This one is genuinely easier than it used to be, provided you have set it up before you need it. It is very hard to set up during an outage.
What preparation looks like
- Confirm your team can actually do their real work remotely, including opening large models at acceptable speed, not just reading email
- Know which tasks can proceed without the network and which cannot
- Have a secondary connection path for the office, whether a second line or a business grade LTE failover
- Make sure field staff can receive instructions when the office is dark
The person who knows how everything works
Cross training gets deprioritized in every busy firm and it is the cheapest resilience you can buy.
What preparation looks like
- Write down the processes that live in one person’s head. Licence renewals, CAD standards, the archive structure, the plotting setup, the way sheet sets get assembled for issue.
- Store credentials in a proper password manager owned by the firm, not in a browser profile on one laptop or a spreadsheet called passwords
- Make sure at least two people can perform every deadline critical task
Regulatory and contractual obligations you have not read
Less dramatic than ransomware and more likely to cost you.
Under Alberta’s Personal Information Protection Act, organizations must notify the Office of the Information and Privacy Commissioner of a breach involving personal information where there is a real risk of significant harm. Client details, employee records and homeowner information on residential work all qualify as personal information.
Separately, your client agreements and your prime consultant agreements may contain their own data handling, confidentiality and record retention terms, and your professional obligations as an architect or engineer in Alberta include project record requirements. These vary and they are worth confirming with counsel and with your association rather than assuming.
What preparation looks like
- Know, before an incident, whether you have a reporting obligation and who makes that determination
- Keep the Commissioner’s contact information on your incident contact list
- Read the data clauses in your standard client agreement once, deliberately, when nothing is on fire
The honest summary
Preparation is not about predicting which of these happens to you. It is about reducing the number of decisions your team has to make under pressure, with a deadline running and a client waiting.
Most of what is described above is a few hours of deliberate work, not a project. The reason it does not get done is not cost. It is that it never becomes this week’s priority until the week it becomes the only priority.
Where MatrixCore fits
We support architecture, engineering, construction and design firms across the Edmonton corridor, including Edmonton, Leduc, Beaumont, Nisku and Devon. We spend our time on the specific problems this industry has: large project files, workshared models, Microsoft 365 collaboration that has to work for people in the office and on site, and backups that can actually bring a project back.
If any of the five signs in part one landed, book a 15 minute discovery call. We will go through your current setup and tell you plainly which gaps are worth closing first and which can wait.
Related reading: Data Backup and Disaster Recovery Services | Microsoft 365 Services | SharePoint Support | IT Services for Construction Firms
Sources: Statistics Canada, “Impact of cybercrime on Canadian businesses, 2023,” The Daily, October 2024. CIRA 2025 Cybersecurity Survey, conducted by The Strategic Counsel, August 2025.
This article is general information, not legal advice. Confirm your obligations under Alberta’s Personal Information Protection Act and under your client and professional agreements with qualified counsel.