Ask how long the practice could keep working without document access. For most firms it is days rather than weeks, and shorter than any live deadline allows for.
Most architecture firms have nobody in-house for this
75%
of US architecture firms have fewer than ten people, which is why almost none of them have an in-house IT lead.
59%
of architects, engineers and contractors had a cybersecurity threat in the previous two years.
5 days
is as long as 77% of them can go without document access before the schedule takes real damage.
$141K
average loss to funds transfer fraud, the most common cyber insurance claim of all.
Firm size from the AIA Firm Survey Report 2024. Threat and document access figures from Dodge Construction Network, Data Resilience in Design and Construction, 2023, which surveyed architects, engineers and contractors. Fraud loss from the Coalition 2026 Cyber Claims Report, which covers claims across all industries. Checked September 2026.
The software you run
How Revit and Bluebeam behave on a network
Every claim below is Autodesk's or Bluebeam's own published position, not our opinion. Check any of it.
Revit
Worksharing over a VPN is an unsupported workflow
Autodesk states it directly: unsupported workflows such as file-based worksharing through a VPN connection can cause data corruption when synchronizing local files with the central model. File-based worksharing was designed for everyone being on the same office network. A slow VPN is the lesser problem. A sync interrupted by latency can leave the central model damaged, and the damage usually surfaces days later, found by somebody who did not cause it.
A central model on a sync folder fails a different way
OneDrive, Dropbox, SharePoint sync, Google Drive and Egnyte all work by replicating a file after it changes. Revit worksharing works by several people holding parts of one model at once. Autodesk is plain that this will not behave like a file server, and lists central model corruption and lost work when two people sync at the same time. Egnyte handles the rest of a project well. The live central model is the exception.
What Autodesk actually supports for more than one office
Two paths. Revit Server, which is on your own hardware and is designed for worksharing multiple central models across a wide area network, and is still shipping with Revit 2027. Or Revit Cloud Worksharing, where Autodesk hosts the model. Which one suits you comes down to how many offices, how big the models are, and what your connectivity looks like at each end.
Cloud worksharing needs its own subscription, and the names changed
Revit Cloud Worksharing is not included in a Revit subscription. It requires Forma Design Collaboration, the subscription formerly called BIM Collaborate Pro, for every person who touches the model. Autodesk Docs, now Forma Data Management, does not include it. Firms find this out mid-project more often than they should, usually after budgeting for the wrong thing.
Bluebeam
Where Bluebeam Studio actually keeps your markups
On Bluebeam's infrastructure, running on Amazon Web Services. Bluebeam's own security overview says Studio Sessions and Projects are hosted on Amazon EC2, with documents stored on Amazon S3, encrypted at rest and in transit. That is worth knowing. Your client's security questionnaire will eventually ask you to state it, and the answer should not be a guess.
There is no self-hosted Bluebeam any more
Studio Enterprise, the version you ran on your own server, is end of life. Bluebeam has stopped development on it and committed to cloud. Studio Prime reached end of life on 31 December 2025, with user management moving to Org Admin. If a firm is still planning around hosting Studio internally, that plan expired.
Studio regions do not talk to each other
Bluebeam runs separate Studio environments in the United States, the United Kingdom, Germany, Sweden and Australia. Each region needs its own Bluebeam ID, and Projects, Sessions and data are not shared between them. If you are collaborating with a firm on another continent, the region each of you signed up in decides whether that Session is even possible.
Check the region before the Session, not during it
The most common Bluebeam surprise on a joint project is somebody being unable to join a Session because their account lives in a different Studio region. It takes two minutes to check in advance and a great deal longer to sort out while eight people sit waiting on a coordination call.
Sources: Autodesk, Options for Remote Access in Revit; Autodesk, How to use cloud-synced services with Revit files; Autodesk, Available methods for collaboration in Revit; Bluebeam Studio Security Overview and Studio region documentation. Checked September 2026.
The gap in the coverage
Your professional liability policy is not cyber coverage
The AIA Trust says it plainly: many firms do not realize their professional liability policy excludes cyber. Victor, the carrier behind that program, sells cyber cover to fill that exact gap.
What a cyber application asks
Multifactor on email and remote access, endpoint detection, immutable backups, a tested restore, email authentication. Cyber underwriters price on those answers, and an answer that is not true at renewal is a problem at claim time. Making those answers true is the work.
What a client contract asks
Owners and developers now attach security exhibits to owner and architect agreements, and the AIA digital practice exhibits set who may rely on a model and how digital data may be transmitted and licensed. Both need somebody who knows what is deployed.
AI is the next question
Seven in ten architecture and engineering firms now use AI tools, up from 53% a year earlier, and eight in ten of the insurers writing your professional liability treat that adoption as a potential disruptor of their market. Nobody is asking you to slow down. They are asking whether there is a written rule about what staff may put into a tool, and that rule costs almost nothing to have.
We are not insurance advisers and nothing here is advice on your policy. Read it with your broker. Sources: AIA Trust, Cyber Liability Insurance; Victor Insurance, Cyber Risk Kit for Architects and Engineers; 47th Annual Deltek Clarity Architecture and Engineering Industry Study, May 2026, which surveyed 896 firms; Ames and Gough 2026 Architects and Engineers Professional Liability Insurance Market Survey, which surveyed 15 insurers. Checked September 2026.
The work itself
What we run for architecture firms
The same managed service as every other client, with the model, the markups and the coordination given the attention they need.
Workstations sized for the work
and replaced on a schedule you can budget for, instead of when one dies in the middle of a deadline week.
A model home that Autodesk supports
chosen against your office count, your model sizes and what the connection at each end can carry.
Egnyte for everything else
drawings, references, photographs, consultant transmittals. This is where cloud file services earn their place on a project.
Yes, but not by putting the existing file-based worksharing setup behind a VPN. Autodesk classes that as an unsupported workflow that can corrupt the central model. The supported routes are Revit Server for your own wide area network, or Revit Cloud Worksharing, which needs a Forma Design Collaboration subscription for each person. We will tell you which fits your model sizes and your offices, and what it costs before you commit.
Can we keep the Revit central model in Egnyte or SharePoint?
No, and the tell that a firm is already doing it is a run of unexplained corruption everybody has learned to live with. Sync tools copy a file up after it changes. Revit worksharing has a team working inside one model simultaneously, and Autodesk documents what happens when those two meet. What we put in place instead depends on how many offices you have and how much of the team works from home. For a single office the honest answer is usually the least fashionable one, a proper file server on the local network. Egnyte keeps its place for drawings, references and photographs. It is the live central model that is the exception, not the project.
Where does Bluebeam Studio keep our project data?
On Bluebeam's own platform, which sits on Amazon's cloud, in whichever regional environment your Bluebeam ID was created in. It is encrypted both in storage and in transit. There is no longer a self-hosted option: Studio Enterprise is end of life and Studio Prime ended on 31 December 2025. When a client asks where project markups are stored, that is the honest answer, and it is usually a perfectly acceptable one.
Does our professional liability policy cover a cyber incident?
Almost certainly not. The two policies get bought from different people in different conversations, which is how a firm can hold one for years believing it covers the other. Finding out takes about ten minutes: search your policy for cyber, data, breach and ransomware, and if the only matches sit in the exclusions, you have your answer. The more useful step is asking your broker for a cyber quote even if you do not intend to buy, because the application itself is the prize. It is a security checklist written by people who have to pay when it goes wrong, and it tells you what a professional underwriter thinks a firm your size should have in place. We can make those answers true before you sign anything. Read the policy with your broker; we are not insurance advisers.
Which AIA digital data exhibit applies to our project?
That depends on who the model gets shared with and whether model versions count as contract documents, and that is a question for your counsel. The 2013 versions many firms still reference were permanently retired on 31 July 2024, and the current set is the 2022 Digital Practice series. If your standard exhibits still name the older documents, they point at paperwork that no longer exists.
We are a fifteen person studio. Is any of this overkill?
No, and small studios are where these problems bite hardest, because one corrupted central model is a larger share of the week. Most of what is on this page costs very little to get right up front and a great deal to undo later. The firms that struggle are usually the ones where a decision about where the model lives got made once, quietly, by whoever set up the server, and never got revisited.
Where does your central model live?
If the answer is a sync folder, that is the place to start.
