Between a Rock and a Hard Place | Agg

How UK aggregates and construction supply businesses can strengthen cybersecurity in 2026

While cyber-attacks on household brands like Harrods and M&S are now in the past, all businesses – especially in the construction supply sector – should not assume lower exposure in 2026.

Quarrying operators, construction OEMs, plant hire firms, and materials suppliers are increasingly reliant on digital systems to manage production, logistics, maintenance, payroll, and customer relationships. As operational technology, cloud platforms, and remote access tools become more embedded across worksites, depots, and offices, cybersecurity has become a board-level issue, a regulatory concern, and, increasingly, a matter of business continuity.

A 2022 survey (conducted by the Cyber Resilience Centre for the West Midlands) found that 75% of construction businesses had experienced cyberattacks, highlighting the growing frequency and sophistication of breaches. This trend is being driven by advances in artificial intelligence, the rise of remote and mobile working, and increasingly digital supply chains underpinning modern construction operations.

The most resilient businesses in the sector treat cyber security as an ongoing operational discipline, not just an IT problem.

Treat cyber-attack attempts as inevitable

One of the most important mindset shifts for construction supply businesses in 2026 is accepting that cyber incidents are not a question of ‘if’ but ‘when’. Phishing emails, credential theft, and ransomware attacks are now largely automated and routinely target organizations of all sizes, including SMEs operating quarries, depots, or hire fleets.

Many attacks no longer focus solely on data theft. Increasingly, attackers aim to disrupt operations – locking access to production systems, maintenance schedules, weighbridge software, or transport management platforms. For businesses operating on tight margins and using just-in-time delivery models, even brief periods of downtime can have serious commercial consequences.

This makes detection, response and recovery just as important as prevention. Construction supply businesses should have a clear, tested incident response plan that covers not only IT recovery but also how sites continue to operate safely, how customers are informed, and how contractual obligations are managed during a disruption.

Strengthen identity and access management

Compromised credentials remain one of the most common ways attackers gain access to systems. In 2026, basic password protection is no longer sufficient, particularly for businesses with dispersed workforces, multiple sites and frequent use of contractors.

Aggregates and construction supply businesses should ensure that:

Multi-factor authentication (MFA) is enabled across all critical systems, including email, cloud platforms, financial systems, and remote access to site or plant systems

Access is granted on the principle of least privilege, so engineers, operators and office staff have access only to the systems they genuinely need

User access is reviewed regularly, especially when staff move between sites, change roles or leave the organization.

As reliance on cloud-based ERP, asset management, and logistics platforms grows, controlling who can access what and from where is one of the most effective security controls available.

Address human risk through training and culture

Despite advances in technology, people remain a key vulnerability. AI-generated phishing emails and voice scams are now highly convincing and often tailored to the construction environment, referencing real suppliers, plant orders, contract variations, or payment requests.

Regular, practical cyber awareness training is essential and should reflect the sector’s real-world risks, including:

Phishing emails that appear to come from known suppliers, OEMs, or customers

Requests to change bank details for materials, plant hire, or fuel suppliers

Fake invoices or urgent payment requests linked to ongoing projects.

Equally important, businesses need a culture in which staff, whether based in the head office or on site, feel confident reporting suspicious activity quickly and without fear of blame. Early reporting can often prevent a minor incident from escalating into a major operational shutdown.

Secure the supply chain

The construction supply chain is complex and highly interconnected, making it an attractive target for attackers. Cyber criminals increasingly target smaller or less well-secured businesses, such as regional suppliers or subcontractors, as a route into larger organizations.

In 2026, aggregates producers and construction suppliers should ensure they clearly understand which suppliers, OEMs and service providers can access their systems or data. Proportionate cyber due diligence should be conducted on critical third parties, particularly those supporting finance, IT and operational systems, with appropriate cybersecurity requirements embedded in contracts where necessary.

Supply chain risk is especially important for businesses handling sensitive commercial information or operating under strict health, safety and environmental regulations, as a breach by a third party can still lead to reputational damage, contractual disputes and regulatory scrutiny.

Keep systems updated and legacy risk under control

Unpatched systems remain a major cause of cyber incidents. This is particularly challenging in construction-related industries, where legacy systems may still control plant, weighbridges, batching systems or maintenance platforms.

Businesses should take a pragmatic approach:

Maintain an accurate inventory of IT and operational technology (OT) systems across sites

Prioritize patching for internet-facing and business-critical systems

Develop a plan to replace, upgrade, or isolate systems that cannot be properly supported.

Ignoring legacy risk does not make it go away. In many cases, outdated systems make operational-critical businesses more attractive targets.

Use the AI revolution to your advantage

AI is rapidly reshaping cybercrime, but it is also becoming a powerful defensive tool. Construction supply businesses should consider AI-powered Endpoint Detection and Response (EDR) solutions to protect against emerging threats.

Traditional antivirus solutions rely on recognizing known malware. Modern attacks increasingly use social engineering, zero-day exploits, and ‘living off the land’ techniques that bypass traditional defences.

EDR goes further by continuously monitoring endpoint behaviour across laptops, desktops, and servers, including those used at depots, sites, and offices. AI-driven behavioural analysis can detect unusual activity, automatically isolate affected systems, and alert security teams before disruption spreads across the business.

As 2026 progresses, cybersecurity will continue to evolve alongside technology, regulation and working practices across the aggregates and construction supply sector. The most successful businesses will be those that embed cybersecurity across everyday operations, leadership decision-making and site-level culture.

By acting now – strengthening identity controls, addressing human risk, managing suppliers and planning for incidents – construction supply businesses cannot only reduce their exposure to cyber threats but also protect operational resilience, customer confidence and long-term commercial performance in an increasingly digital industry.