Why emailing your cost report feels perfectly safe, why a locked-down dashboard triggers a security meeting, and how to tell which one is actually protecting your numbers.
Most of us in the construction industry are very familiar with this scenario. It’s Thursday afternoon in the office and your project manager is finishing the monthly cost report.
They’re a good PM. The numbers are right, the schedule narrative is honest, and of course the contingency line is a little thinner than anybody would like. The report gets exported to PDF, named something like Cost_Report_Sept_FINAL_v3, attached to an email, and sent to the owner’s rep.
Then the PDF goes on a trip.
The owner’s rep forwards it to his boss. His boss forwards it to the lender. The lender’s analyst saves it to her desktop and sends it to an outside consultant “for awareness.” Somebody prints it for a meeting and leaves it on the conference table. Several months from now, a copy of September numbers will still be sitting in four inboxes the PM has never heard of, on a laptop they’ve never seen, and in a coffee shop they’ve never been to.
Not surprisingly, no security meeting is called about any of that.
Here’s the funny part. The PM got tired of rebuilding that report every month, so last week they spent a lunch hour building a live cost and schedule dashboard with an AI app builder. They told it to only let in people with a company login. A teammate tried it and was in with two clicks. Anyone outside the company hit a locked door.
They showed it to leadership, everybody loved it, and somebody asked the question that ended the fun: “Wait, we’re going to send the client a link to the dashboard?”
Security meeting.
A peer of mine in preconstruction at a large national GC went through almost exactly this a few weeks ago. His summary was perfect. Emailing the client a PDF of cost and schedule? Totally fine. Sending a link to a locked-down dashboard of the same information? Everybody stop what you’re doing.
“The PDF feels safe because you stop seeing it the moment you hit send. That isn’t security. That’s a blindfold.”
Where the PDF Actually Goes
I’m not here to pick on the PDF. I’ve sent thousands of them and so have you. But it’s worth being honest about what happens after you hit send.
You can’t take it back. Once it leaves your outbox, it belongs to whoever has it. There’s no button that pulls September’s numbers out of the lender’s consultant’s inbox.
You can’t see where it went. You know who you sent it to. You have no idea who they sent it to, and neither do they after the second forward.
It’s wrong by Tuesday. A PDF is a photograph. The job keeps moving. Somebody, somewhere, will make a decision next month based on numbers you’ve already revised twice, and they’ll be holding a document with your logo on it.
Unless you’re actually using what you already pay for. A lot of builders already own a tool that fixes this. If your team runs Bluebeam, Studio Sessions lets everyone mark up the same drawing at the same time, and Studio Projects keeps files in the cloud with check-in, check-out, and a full version history. If you’re using those well, good for you. You’re ahead of most of the industry. In my experience, though, it’s rare. The more common picture is that one or two people use Studio, everybody else downloads a copy “just to be safe,” and the sub’s foreman is marking up a PDF he saved to his desktop in March. A collaboration tool only works when the whole team, and the people you share with, actually work in it.
It outlives everyone involved. Last week we talked about client relationships walking out the door on a superintendent’s personal phone. Attachments do the same thing. Every PDF you’ve ever sent is still sitting in the inbox of every person who ever received it, including the ones who have since moved to your competitor.
None of that is anybody’s fault. That’s just what an attachment is. It’s a copy, and copies don’t come with a leash.
What the Breach Reports Say
Verizon’s 2024 report broke down the mistakes specifically. More than half of the errors that led to breaches were misdelivery, which is the polite term for sending something to the wrong person. (When I first read the report, I thought it said “misdevilry.” Honestly, that might be more accurate.) End users, not IT staff, made 87 percent of those errors. That’s the autocomplete in your email picking the wrong Mike. We have all picked the wrong Mike, and it’s usually the worst possible Mike.
In the 2026 report, the human element was involved in 62 percent of breaches, and 48 percent of breaches involved a third party in some way, up sharply from the year before. Owner’s reps, lenders, architects, consultants, and subs are all third parties. Every one of them is on the forward chain of your PDF.
Verizon’s 2024 report broke down the mistakes specifically. More than half of the errors that led to breaches were misdelivery, which is the polite term for sending something to the wrong person. End users, not IT staff, made 87 percent of those errors. That’s the autocomplete in your email picking the wrong Mike. We have all picked the wrong Mike.
Here’s what that means for a builder. The risk that keeps you up at night is probably a sophisticated attack. The risk that’s actually most likely is a well-meaning person with a Send button and a slightly wrong recipient list.
To Be Fair to the Security Team
I want to stick up for the people in that security meeting, because they aren’t wrong to ask questions. They’re just asking them about the wrong document.
The PDF is familiar. Everybody has been emailing PDFs for twenty-five years, and familiar feels safe. The dashboard is new, it’s a link, and links are what phishing emails use. Of course it gets a second look.
But the question security is really asking is a good one: who can get in, and how would we know? With a PDF, the honest answer is “anyone who has it, and we wouldn’t.” With a properly locked dashboard, the answer is “only people we’ve approved, and we can check the log.” That’s a better answer. It just needs to be proven, not promised.
So here’s my consulting advice for the PM with the shiny new dashboard. Don’t walk into that meeting with enthusiasm. Walk in with answers. Security teams say no to excitement. They say yes to evidence.
One Sentence to Lock It. Five Minutes to Check It.
My friend put the big shift in one line, and I’ll paraphrase it: locking down a website used to take weeks, and now it takes a sentence.
He’s right, and it’s genuinely exciting. Your PMs, estimators, and project engineers can now build real tools over a lunch break. Trackers, dashboards, training hubs, punch list viewers. I’ve been building with these tools myself, and the speed is a little ridiculous.
But the sentence and the setup aren’t always the same thing. On at least one popular AI app builder, the default way of adding Microsoft sign-in lets any Microsoft account log in, not just people at your company. Restricting it to your own organization requires a different setup, either a single sign-on connection to your company’s identity system or your own app registration in Microsoft. Ask for “company login only” and you might get exactly that. You might also get a login page that any personal Outlook account can walk right through, and it will look identical.
That’s not a knock on the tools. It’s a reminder that “locked” is a claim and a test is the proof. My friend’s team tested it, which is why his story ends well. The test takes about five minutes.
BEFORE YOU SEND THE LINK: THE 5 MINUTE LOCK TEST
- Open the link in a private browser window while signed in to a personal email account. You should hit a wall, not a dashboard.
- Try it on your phone over cellular, off the company Wi-Fi. If it only works on the office network, it isn’t ready for the field.
- Have a teammate sign in cold. If it takes more than two clicks, people will quietly go back to emailing the PDF.
- Remove someone’s access and confirm it’s gone within minutes, not “after the next sync.”
- Turn off a test user the way you would for an employee who leaves. Their access to this tool should disappear with their company account.
The Sharing Ladder
Not every document needs a custom dashboard. A one-page meeting agenda can ride along as an attachment and the world will keep spinning. The trick is matching the method to two questions: what happens if this ends up in the wrong hands, and how often does it change?
Here’s the ladder I walk builders through, from least control to most.
- Rung 1: The email attachment. Fine for low-stakes, one-time documents. Meeting minutes, a product data sheet, a lunch order. Once it’s sent, it’s gone.
- Rung 2: A cloud file link with limits. If you’re on Microsoft 365, a SharePoint or OneDrive link can be shared with specific people instead of “anyone with the link,” set to view-only, and given an expiration date. Same file, same click for the recipient, and you can revoke it next week. This one rung would cover most of what builders email today.
- Rung 3: Guest access to a shared project space. For a design team or key subs on a long job, inviting them as guests into a Teams or SharePoint project site keeps everything in one place you control. When the job closes out, you remove the guests and the access ends.
- Rung 4: The client portal in your project management platform. Most construction PM platforms have external access built in for owners and partners. It’s already paid for, and in my experience it’s wildly underused.
- Rung 5: A custom dashboard behind your company login. This is the PM’s dashboard. Live numbers, the right view for the right person, single sign-on, and an access log. It’s the most control you can have, and it’s finally cheap enough to build that a mid-size Arizona GC can actually do it.
One honest note. A lot of builders I meet are on Rung 1 for everything, including the stuff that belongs on Rung 4. The fastest win usually isn’t building something new. It’s checking a few settings on tools you already own.
Knock on the Door
Pick the one report your team emails most often. For most builders, it’s the monthly cost report or the three-week look-ahead. Then ask two questions about it:
“Who has a copy right now?” and “If we needed it back, could we get it?”
If the answers are “no idea” and “no,” you’ve found this month’s candidate for Rung 2 or Rung 3. Move that one report up the ladder and see how the client reacts. In my experience, they don’t notice anything except that the numbers are current.
While you’re at it, ask whoever manages your Microsoft 365 one more question: are “anyone with the link” shares turned on for our company? It takes about five minutes to check, and the answer is surprising more often than it should be.
And if someone on your team already built a dashboard over lunch, good. Don’t shut it down. Run the lock test with them. That’s the kind of thing we help builders with every week, from tightening sharing settings to building the custom dashboards themselves. No judgment. Honestly, a little envy.
Next month, on a Thursday afternoon, your PM won’t export anything. They will send the owner’s rep a link.
He’ll open it and see this morning’s numbers. When the lender’s analyst asks for a copy, he’ll forward the link, and the analyst will hit a locked door until someone decides she should have access.
For the first time, a locked door is exactly what everybody wanted.
Enjoy the dashboard.
For over 20 years, Dimensions has been the trusted IT partner for Arizona’s architecture, engineering, and construction industry. We help AEC firms communicate better, collaborate smarter, and actually use the technology they’ve invested in. Because in construction, the tools only work if your team does.
IT Built For Builders.
