| Design offices | Domestic public design continues, and a project-file outage stops the drawing before the client site does. | 0-3 months | Wave 1 (direct) | AECOM client mix; CISA project-file page |
| EPC engineering teams | Pre-construction engineering keeps billing while pass-through construction cost is not this industry's payroll. | 0-3 months | Wave 1 (indirect) | AECOM pass-through disclosure |
| Project staff | Staff cannot book time when the file system or the timekeeping system is down. | 0-6 months | Wave 2 (direct) | AECOM headcount and DSO; Akira alert |
| CAD and engineering software | Infected project files can be written from engineering software into the systems a client operates. | 0-3 months | Wave 1 (direct) | CISA project-file technique |
| Public infrastructure clients | State, local, and federal design mandates continue when China trade stops. | 0-12 months | Wave 1 (indirect) | AECOM government rows; ACEC infrastructure demand |
| Billing and timekeeping | Invoices slip when backup servers or the credentials used to approve bills are taken. | 0-3 months | Wave 2 (direct) | AECOM DSO; Akira alert |
| Industrial and energy design clients | Private industrial work can pause even while the public book continues. | 1-6 months | Wave 2 (indirect) | AECOM private-client row; ACEC data-center demand |
| Small engineering practices | Firms with fewer than 20 employees have little bench if a ransomware event locks the only drawing set. | 0-6 months | Wave 3 (direct) | SUSB 2022 size file; Akira alert |
| Client program backlogs | Most of the signed gross book is domestic, and about half of remaining performance obligations fall inside a year. | 1-12 months | Wave 3 (indirect) | AECOM backlog and RUPO |