October 2026 | Civil Engineering IT Support Salt Lake City | Security Culture | Employee Awareness
It's 4:17 on a Friday afternoon at a Salt Lake City engineering firm.
Someone in accounting receives an email that appears to be from one of the principals: "Can you update the payment details for our geotechnical subconsultant before you leave? They switched banks and their invoice is due Monday."
The name is right. The tone sounds familiar. The subconsultant is real and actually is on the current project. With everyone trying to wrap up the week before a submittal deadline, the easiest thing to do is simply make the change. There's only one problem: the principal never sent it.
Your IT security tools can put strong protections in place, but they can't stop every bad click, rushed reply or split-second call. Some decisions still come down to whether the person at the keyboard knows what to do when something feels off — and whether your firm has a documented procedure for them to follow.
The Assumption That Leaves Firms Exposed
Most engineering firm principals believe cybersecurity lives somewhere behind the scenes. IT has tools. The workstations have protection. Someone schedules the updates between project deadlines. Cybersecurity is "handled."
In reality, your defenses are tested every time someone decides whether to trust an email, link or request — an invitation to a client's Newforma workspace, a transmittal from a prime consultant, a login prompt from what looks like a DOT project portal. Those decisions happen every day, across every project team and every discipline. To truly strengthen your firm's security, your engineering team must know exactly what to do when something doesn't look right.
Technology Can't Make Every Call
Good security tools block a lot of attack attempts before your staff ever sees them. But no technology can eliminate every questionable request or make every decision on an engineer's behalf.
Today's phishing attacks aren't obvious. They're built to mimic familiar writing styles, reference subconsultants and agencies you actually work with and mirror the rhythm of normal project correspondence. When an unusual payment request comes from a principal, a subconsultant legitimately changes banking details mid-project, or a team member needs access to a shared model they've never opened before — someone must decide what happens next. The person at the keyboard has to determine in an instant whether they're looking at a scam or an authentic request.
"Be Careful" Isn't a Cybersecurity Plan
Engineers don't accept "be careful" as a QA/QC procedure, and it shouldn't pass as a security procedure either. Vague guidance without a defined process puts the full weight of a high-stakes decision on the person least equipped to handle it in the moment. Every person in your firm should know:
- Who to contact when something looks suspicious
- How to verify a request is legitimate — including a call-back step for any payment or banking change
- Not to click links or download attachments from suspicious messages, even ones dressed as transmittals or RFIs
- What to do if they already clicked a link or downloaded an attachment
- How to report the issue, and to whom
Assuming people know what to do is a liability. An employee who isn't sure whether they're bothering someone may stay quiet. Someone who fears getting blamed for clicking the wrong thing may wait before reporting it. Hesitation is costly — the time lost while someone decides whether to speak up can turn a manageable incident into one that puts project files and engineering documents, client trust and contract compliance at risk.
Leadership Sets the Tone
Responsibility starts at the top, because your engineering team takes its cues from leadership. If a principal routinely skips verification steps because a deadline is close, staff learn that speed matters more than process. If project managers make it uncomfortable to flag suspicious activity, people stay quiet. If someone clicks something they shouldn't and gets publicly reprimanded, everyone learns to hide their mistakes.
Fortunately, the opposite is also true. When leadership treats verification the way it treats an independent design check — non-negotiable, documented and free of blame — employees take it seriously. When the person who questions an unusual request is backed up rather than brushed off, the whole firm operates more carefully. When your team trusts leadership, they speak up before a situation becomes a crisis.
This discipline also carries contractual weight. Firms serving government clients increasingly face documented security requirements — CMMC for defense-related work chief among them — where written procedures, training records and defined reporting channels are audited, not assumed.
Cybersecurity Works Better When Everyone Knows Their Role
Back to that accounting inbox at 4:17 on a Friday afternoon.
The goal isn't to make your staff paranoid about every email they receive. It's to make sure that when something feels off, they know exactly what to do, who to ask and how to verify — and that the verification step is a documented procedure, not an improvisation. Speaking up should always feel like the right move.
Your engineers don't need to become cybersecurity experts to help protect the firm. They need clear expectations, documented processes and the confidence to flag when something doesn't look right — the same habits that already make your QA/QC program work.
Creating that kind of security culture takes more than an annual training session. It requires the right safeguards, practical written procedures and ongoing guidance to keep your firm prepared as threats change.
Frequently Asked Questions
What is employee security awareness training for an engineering firm?
It's structured, ongoing education that teaches your engineering team to recognize phishing, social engineering and impersonation attempts — including fake project portal notices and fraudulent subconsultant payment changes — and gives them a documented process for verifying and reporting suspicious activity. Done well, it turns your team into an active layer of defense.
Do you offer IT support for engineering firms and technical consultancies in Salt Lake City?
Yes. Qual IT delivers IT support for engineering firms in Salt Lake City and along the Wasatch Front, including email security, phishing protection, secure collaboration with subconsultants, support for platforms like Deltek Vantagepoint and Newforma, employee training and incident response planning.
How does an IT security partner help build a security culture?
A partner like Qual IT identifies your gaps, implements the right safeguards, sets up practical verification and reporting procedures in writing, and provides the ongoing training and guidance that keeps security habits current as threats evolve — with documentation that stands up to client and CMMC scrutiny.
You Don't Have to Manage It Alone
That's where the right IT partner comes in. We work with Salt Lake City engineering firms to protect project data and support technical workflows — identifying gaps, strengthening protections and helping every member of the firm understand the role they play in keeping projects and clients secure.
Cybersecurity is everyone's responsibility — but you don't have to manage it alone. Schedule a 10-minute discovery call with Qual IT to find the gaps in your current approach and how to address them. Book your discovery call here.
