59% of AEC firms faced a cybersecurity threat in the last two years. Your bid set is the target.

Egnyte and Dodge Construction Network studied data resilience in the AEC industry in 2023. 59 percent of architecture, engineering and construction firms had faced a cybersecurity threat in the previous two years. Among general contractors, 30 percent had been hit by a ransomware attack since 2021. In the same study, 77 percent of firms said they could not go more than five days without access to their documents before schedules began to suffer.

Now think about what a takeoff tool asks for on the way in. The full plan set. The owner, the site, the square footage, the scope you are pricing against three other contractors. Uploaded to a server you do not control, on bid week, so that it can be counted.

I work in electrical preconstruction, and I have never heard anyone at a desk ask whether the takeoff vendor is a careful custodian of that. The question does not come up, because a tool is a tool and the drawings are just the job. But a full bid set tells a competitor your scope, and it tells anyone else the layout of a building that has not been built yet.

The five-day figure is the other half of it. If the count lives in an account somewhere else, and that account is unreachable on a Tuesday, the takeoff is unreachable with it, and the bid is due Friday.

What LumenTakeoff does about it

LumenTakeoff runs on the estimator's machine. The PDF is opened, read and counted locally, page by page with progress on screen, and no drawing content leaves the machine. There is no account on a server holding your bid documents, because there is no server holding them. There is also no metered AI and no per-sheet fee, which is a consequence of the same decision rather than a pricing idea.

The firm's library of confirmed fixture names lives on that same machine, scoped to the firm. Every name someone confirms is written there, tied to the symbol geometry and to the engineer the set came from, and it compounds from job to job without any of it being shipped anywhere. Ask the plan works the same way: the answer comes from the sheet's own text, the schedule rows and the engine's counts, with a local model.

What leaves the machine is only what the estimator chooses to send. That is the XLSX with Coverage, Quantities, Findings and Evidence, and the proof images with every counted instance ringed. It goes wherever the team already sends deliverables, by the route they already trust.

None of this is a security product and I am not going to describe it as one. It is a design decision taken once, at the start, by someone who did not want to explain to an estimating manager why a client's drawings were sitting on a rented server in order to count circles on them. If your company already has a rule about which tools may see bid documents, this one is easy to clear.

The machine counts. You decide.