For most businesses, ransomware is a serious disruption. For an engineering firm, it is closer to a full stop.
The reason is structural. A retailer that loses access to its systems can still sell, awkwardly, with a notepad. A consultancy can still advise. An engineering firm without its project files cannot design, cannot check, cannot issue, and cannot respond to a contractor’s RFI — because the work itself lives entirely in the files that are now encrypted.
And it doesn’t affect one project. It affects all of them, on the same morning.
That’s the question worth sitting with. Not whether your firm might be attacked, but what actually happens on the day after.
The morning it starts
The sequence is more ordinary than most people imagine, and understanding it explains why prevention and recovery are different conversations.
It rarely begins with anything dramatic. Someone opens an attachment or enters credentials on a page that looked exactly like the Microsoft 365 login. Nothing visible happens, which is the entire point. For the next few weeks the attacker is simply present — reading email, mapping which server holds the project files, identifying where backups live, and quietly expanding access.
That period is called dwell time, and it matters enormously for a reason most firms never consider. If an attacker has been inside for three weeks before triggering encryption, a backup taken last night may already contain their tools. Firms with a single recovery point sometimes restore successfully, resume work, and find themselves encrypted again ten days later from the same infection they carefully restored.
The trigger itself usually comes on a Friday evening or over a holiday weekend. Encryption spreads across mapped drives, shared folders, and any connected backup storage it can reach. By Monday morning, staff arrive to find nothing opens.
What follows is the part firms are least prepared for. Somebody has to decide, quickly, whether to shut everything down, whether the attacker is still inside, who needs to be told, whether clients should be notified, and whether the firm can meet the deliverables due that week. Most practices are making these decisions for the first time, without a plan, while the phone rings.
What it costs an engineering firm specifically
The ransom demand, when there is one, is rarely the largest number.
Project deadlines are the first casualty. Engineering work sits inside construction programmes, and a firm that goes dark for two weeks doesn’t simply resume where it left off — it returns to a schedule that moved without it, with contractors waiting and a backlog that takes longer to clear than the outage itself.
Consultant and client relationships absorb damage that outlasts the technical recovery. Explaining to a client that their project has stalled indefinitely is a conversation that changes how that client thinks about the firm, regardless of how well the recovery goes.
There’s also a category specific to this profession. Engineering firms hold calculations, designs, and technical work that carry professional liability. A breach raising questions about whether project data was altered, rather than merely stolen, opens a difficult line of enquiry. Being able to demonstrate that data was recovered from a verified clean backup is a materially different position from being unable to say what happened to it.
And insurance has tightened considerably. Cyber coverage now typically requires evidence of specific controls, and claims have been reduced where a firm attested to protections it didn’t actually have in place.
What separates firms that recover from firms that pay
In practice, the difference comes down to decisions made months earlier — usually about backups, and usually about one specific detail.
A backup sitting on the network is not protection. Modern ransomware hunts for connected backup storage precisely because attackers know a firm that can restore doesn’t negotiate. If your backup drive is reachable from an infected workstation, it will be encrypted alongside everything else, and you will discover this at the worst possible moment.
The firms that recover have copies replicated somewhere an attacker on the office network cannot reach, with enough recovery points to go back past the date an infection began. They have tested a restore recently enough to know how long it takes and that it works. And they know, roughly, in what order systems need to come back — because restoring data is not the same as restoring a working firm.
Our backup and disaster recovery service is built around exactly these points: monitored, verified daily, replicated off-site, tested quarterly, and documented so the plan exists before it’s needed rather than being improvised during.
The controls that stop it reaching that stage
Recovery matters, but the better outcome is never needing it. The majority of successful attacks exploit a small number of gaps, and closing them is neither complicated nor especially expensive.
Multi-Factor Authentication is the single highest-value control available. Because stolen credentials remain the most common entry point, requiring a second factor stops the large majority of attempts before they start. It needs to apply to every account without exception — principals included, since those hold the broadest access.
Email threat filtering removes a substantial proportion of malicious messages before anyone has to make a judgment call about them. Endpoint detection and response addresses what antivirus cannot: it watches for suspicious behaviour rather than recognising known threats, which is how ransomware gets caught during the mapping phase, in that window between an attacker being inside and encryption beginning.
Continuous monitoring is what makes that window visible at all. Without it, the weeks an attacker spends inside a network pass entirely unnoticed — which is why reactive support, however capable, cannot catch this class of attack. Our managed IT services and cybersecurity services operate these as one coordinated layer rather than separate products.
There’s also a low-technology control worth naming. Any change to payment or banking instructions should be verified by phone, using a number already on file rather than one supplied in the email requesting the change. It costs nothing and prevents the attack that takes the most money from firms of this size.
The questions worth asking this week
You don’t need a technical background to establish where your firm stands. Ask whoever manages your IT:
● When did we last perform an actual restore — not a backup, a restore? A date, not a reassurance.
● Could ransomware on our network reach our backups? If the answer involves the server room, that’s a finding.
● How far back can we recover? Given typical dwell times, last night alone may not be enough.
● Is MFA enforced on every account, including principals? Partial coverage is what attackers look for.
● Who would we call, in what order, if this happened tonight? If nobody can answer, the first hour will be improvisation.
Vague answers to any of these are themselves the result. They’re also, fortunately, straightforward to resolve.
A note on how firms end up exposed
None of this reflects poorly on the practices involved.
Engineering firms in Stockton and across San Joaquin County typically grew steadily without ever building an IT function. Technology was handled by whoever was most comfortable with it, supported by a vendor called in when something broke. That arrangement handles printers and password resets perfectly well.
What it cannot do is watch a network during the weeks an attacker spends inside it, or maintain controls that need continuous attention, or notice that a backup has been silently failing since March. Not because anyone was careless — because it was never that arrangement’s job.
What the first forty-eight hours actually involve
Firms tend to picture recovery as a single technical task — restore the files, resume work. In practice it’s a sequence, and knowing the shape of it is useful even if you never need it.
The first few hours go to containment rather than recovery. Before anything can be restored, someone has to establish whether the attacker still has access, because restoring into a compromised environment simply hands them the fresh copy. This usually means isolating systems and taking the network down deliberately, which feels counterproductive to everyone watching but is the only sensible order.
The next stage is assessment. Which systems are affected, which data is recoverable, from what date, and whether the backups themselves are clean. This is where firms discover whether the decisions made months earlier were adequate — and it is not a good moment to find out that nothing was ever tested.
Restoration follows, and it takes longer than people expect. Data has to come back in a workable order, servers before workstations, core systems before peripheral ones, with verification at each step. A firm that has practised this knows roughly how long it takes. A firm that hasn’t is estimating while clients ask for updates.
Running alongside all of it is the communication problem. Clients notice quickly when a project stalls. Consultants need to know whether to expect the coordination model on Thursday. Staff need instruction about what they can and cannot do. Decisions about what to say, and to whom, are considerably better made in advance than at seven in the morning on the worst day of the year.
The cost of the days in between
It’s worth putting rough numbers to this, because the abstraction hides the scale.
A twenty-person engineering firm losing a full week of productive work isn’t only losing a week of fee income. It’s paying a week of salaries for work that couldn’t happen, then paying overtime to clear the backlog, then absorbing the schedule pressure that follows on every affected project.
Add the emergency response costs — incident response specialists and forensic work are expensive precisely because they’re urgent — and the figure moves well past what most firms would have spent on prevention over several years.
That asymmetry is the entire argument, and it’s the reason this conversation belongs on a quiet Tuesday rather than during an incident.
Where to start
The firms that survive ransomware aren’t luckier. They made specific decisions months earlier, when there was time to think clearly. By the time the screen goes red, every option available has already been determined by choices made long before.
Start with the two that matter most: enforce MFA everywhere, and confirm your backups can genuinely be restored from somewhere ransomware cannot reach. Those two steps close the largest share of the exposure. Monitoring, response planning, and the rest follow far more easily once they’re settled.
RJ PRO Tech Group works with Stockton engineering firms to protect project data and make recovery something that can be demonstrated rather than hoped for — with a Help Desk that answers in minutes when something needs attention.
