October 2026 | Architecture Firm IT Services Utah | Security Culture | Employee Awareness
It's 4:17 on a Friday afternoon at a Salt Lake City architectural firm. The studio is winding down after a week of design development pushes and consultant coordination calls.
The office manager receives an email that appears to be from the firm's principal: "Can you update the structural engineer's payment details before you leave? They switched banks — new info attached. Needs to go out with Monday's run."
The name is right. The tone sounds familiar. The consultant is real — they're on three active projects. And with everyone trying to wrap up the week, the easiest thing to do is simply make the change. There's only one problem: the principal never sent it.
Your IT security tools can put strong protections in place, but they can't stop every bad click, rushed reply or split-second call. Some decisions still come down to whether someone in your studio knows what to do when something feels off.
The Assumption That Leaves Firms Exposed
Most principals believe cybersecurity lives somewhere behind the scenes. The IT provider has tools. The workstations have protection. Someone schedules the updates. Cybersecurity is "handled" — and everyone can stay focused on design.
In reality, your defenses are tested every time someone in your firm decides whether to trust an email, link or request. Those decisions happen every day — in project management platforms like Newforma or BQE Core, in BIM 360 invitations, in the constant flow of transmittals, RFIs and invoices between your studio, consultants, contractors and clients. To truly strengthen your security, your designers and architects must know what to do when something doesn't look right.
Technology Can't Make Every Call
Good security tools block a lot of attack attempts before your team ever sees them. But no technology can eliminate every questionable request or make every decision on a designer's behalf.
Today's phishing attacks aren't obvious. They're built to mimic familiar writing styles, reference the consultants and contractors you actually work with, and mirror the rhythm of normal project coordination. When an unusual payment request comes from the principal, an engineering consultant legitimately changes banking details mid-project, or a team member needs access to a project folder they've never opened before — someone must decide what happens next. The person at the keyboard has to determine in an instant whether they're looking at a scam or an authentic request.
"Be Careful" Isn't a Cybersecurity Plan
Most firms tell their teams to watch out for suspicious emails. But what should a designer do when they find one? Everyone in your studio should know:
- Who to contact
- How to verify a request is legitimate — especially payment changes and file-share links
- Not to click links or download attachments from suspicious messages, even ones that look like drawing transmittals
- What to do if they already clicked a link or downloaded an attachment
- How to report the issue
Telling everyone to simply "be careful" without a clear next step puts the full weight of a high-stakes decision on the person least equipped to handle it in the moment — often while a deadline is bearing down.
Assuming your designers and architects know what to do is a liability. A junior designer who isn't sure whether they're bothering the project architect may stay quiet. Someone who fears getting blamed for clicking the wrong thing may wait before reporting it. Hesitation is costly — the time lost while someone decides whether to speak up can turn a manageable incident into locked project files and a missed submission.
Leadership Sets the Tone
Responsibility starts at the top, because your studio takes its cues from leadership. If the principal routinely skips verification steps because a deadline is looming, the team learns that speed matters more than process. If project managers make it uncomfortable to flag suspicious activity, people stay quiet. If someone clicks something they shouldn't and gets publicly reprimanded, everyone learns to hide their mistakes.
Fortunately, the opposite is also true. When leadership normalizes verification — even during a crunch — the team takes it seriously. When a designer who questions an unusual request is backed up rather than brushed off, the whole studio operates more carefully. When your team trusts leadership, they speak up before a situation becomes a crisis.
Cybersecurity Works Better When Everyone Knows Their Role
Back to that office manager at 4:17 on a Friday afternoon.
The goal isn't to make your team paranoid about every email they receive. It's to make sure that when something feels off, they know exactly what to do, who to ask and how to verify — a quick call to the principal's cell, a known number for the consultant, a clear reporting channel. Speaking up should always feel like the right move.
Your designers and architects don't need to become cybersecurity experts to help protect your firm. They need clear expectations, good habits and the confidence to flag when something doesn't look right.
Creating that kind of security culture takes more than an annual training session. It requires the right safeguards, practical processes and ongoing guidance to keep your firm prepared as threats change — the kind of foundation strong IT support for architectural firms in Salt Lake City is built on.
Frequently Asked Questions
What is employee security awareness training?
It's structured, ongoing education that teaches your designers and architects to recognize phishing, social engineering and other threats — and gives them a clear process for verifying and reporting suspicious activity. Done well, it turns your studio into an active layer of defense.
How does an IT partner help an architectural firm build a security culture?
A partner like Qual IT identifies your gaps, implements the right safeguards, sets up practical verification and reporting processes that fit real project workflows, and provides the ongoing training and guidance that keeps security habits current as threats evolve.
Do you offer IT support for architectural firms and design studios in Salt Lake City?
Yes. Qual IT delivers architecture firm IT services across Utah, including email security, phishing protection, protection for design files and BIM models, employee training and incident response planning.
You Don't Have to Manage It Alone
That's where the right IT partner comes in. Qual IT helps firms take the guesswork out of cybersecurity by identifying gaps, strengthening protections and helping every member of the studio understand the role they play in keeping projects — and clients — secure.
We work with Salt Lake City architectural firms to protect design files and keep project workflows running. Cybersecurity is everyone's responsibility — but you don't have to manage it alone. Schedule a 10-minute discovery call with Qual IT to find the gaps in your current approach and how to address them.
