The digital landscape of the AEC sector is changing rapidly. With new AI-assisted tools revolutionising design processes, continuing demand for flexible working, and the reality of project teams spread across different sites and offices around the world, many firms are finding that their old IT solutions are no longer fit for purpose.

To keep pace in a fast-moving market, many AEC firms are switching to Virtual Desktop Infrastructures (VDIs).

A VDI enables your team to access their full desktop environment, including GPU-intensive design software, from anywhere, on any device. It’s all the power of a high-end workstation, delivered through the cloud.

Here at WIT, we’re proud that WIT’s founders were co-founders of the Inevidesk virtual desktop platform, a VDI that is tailor-made with the high-performance requirements of the AEC industry in mind.

Read on to learn more about how a VDI can benefit your firm.

Solutions for a modern workplace

Flexible work is becoming more and more crucial to the AEC industry, across all industries, employees consistently rank it among their most important workplace benefits.

It benefits employers too: a hybrid work environment not only means greater engagement and productivity, but also reduced office costs.

A VDI enables your team to work from anywhere on the most challenging of GPU workloads. Your team can access their specialised tools on any device, whilst you maintain complete control of your IT infrastructure.

Superior power at a lower price

Traditionally, big-tech VDIs have been seen as overpriced, underperforming and too complex for AEC firms and their high GPU workloads.

Inevidesk has been engineered specifically to meet the needs of the AEC industry, providing a GPU-accelerated platform that is accessible for firms of all sizes, and significantly more cost-effective than comparable big-cloud alternatives.

Scalable

Need to bring a team online for a time-sensitive project? Struggling to incorporate freelancers or contractors into your IT systems?

With the Inevidesk platform, you can create and deploy high-performance, remote-access vdesks in a matter of minutes.

You can scale up for big projects and down again after they are completed, paying only for what you use.

Security

With a VDI, you don’t have to choose between flexibility and security.

The Inevidesk platform stores all of your sensitive, proprietary data and workstation resources within a single secure network, eliminating the need for VPNs and vulnerable remote endpoints.

This centralised system not only improves your firm’s security, but also makes it easier and more efficient to manage your IT estate.

Outsourced support

As WIT’s founders were co-founders of the Inevidesk virtual desktop platform, our team can offer expert assistance in implementation, deployment and management of a part or fully virtualised IT estate.

We guide you through every step, from initial setup to staff training, ensuring a smooth transition that keeps your projects moving without disruption.

If you would like to learn more about how the Inevidesk platform can help make your firm more agile, more secure and more sustainable, get in touch with our team.

If your practice bids for public-sector work or responds to client security questionnaires, you will have seen Cyber Essentials mentioned. It is a UK government-backed certification scheme designed to show that an organisation has basic, sensible protections in place against the most common cyber attacks.

For AEC businesses it is increasingly a commercial requirement as much as a security one: frameworks, local authorities and larger clients often ask for it as a condition of appointment.

What the certification covers

Cyber Essentials focuses on five technical control areas: firewalls and internet gateways, secure configuration of devices and software, access control, malware protection, and keeping software up to date.

None of these are exotic. The value of the scheme is that it forces an honest audit of the basics, the unpatched machine in the corner of the studio, the shared admin password, the ex-employee account that was never disabled.

Cyber Essentials vs Cyber Essentials Plus

The standard certification is based on a self-assessment questionnaire, verified by a licensed certification body. Cyber Essentials Plus covers the same controls but adds independent technical testing of your systems.

For many practices, standard certification is the sensible starting point, with Plus considered when client requirements or risk profile justify it.

How AEC firms should approach it

The biggest mistake is treating certification as a one-off paperwork exercise. The questionnaire reflects the real state of your estate, so the work is in tidying that estate: building an accurate asset list, closing down legacy accounts, standardising device configuration and getting patching under control.

Done properly, the process leaves you with a better-managed, better-documented IT environment, the certificate is almost a by-product.

WIT guides clients through Cyber Essentials as part of a wider security programme, so the controls stay in place year after year rather than being rebuilt each renewal.

Few things generate IT tickets in an architecture practice like a sluggish Revit model the week before a submission. The instinctive diagnosis is usually hardware: the machines are old, so the fix must be new ones.

Sometimes that is true. But before a practice commits to a round of workstation spending, it is worth checking the factors that just as often govern real-world Revit performance.

Model health comes first

Heavily-detailed families, unpurged models, excessive design options, imported CAD geometry and sprawling warnings lists all drag performance down regardless of the hardware underneath.

A model audit, purging unused elements, reviewing warnings, rationalising families and splitting oversized models, frequently recovers more speed than a hardware refresh, at a fraction of the cost.

Storage and network are the hidden bottleneck

Worksharing performance depends heavily on where the central model lives and how fast every workstation can reach it. Ageing file servers, congested switches and Wi-Fi-connected workstations all show up as “Revit being slow”.

Synchronise-with-central times are a useful diagnostic: if they vary wildly across the office, the problem is usually infrastructure rather than individual machines.

When hardware genuinely is the answer

Revit is largely single-threaded for day-to-day modelling, so a smaller number of fast cores beats a large number of slow ones, and plentiful memory matters for big models. Rendering and point-cloud work shift the balance towards GPU.

Virtual workstations change the economics again: platforms like Inevidesk let practices provision GPU-accelerated performance per project rather than per desk, which suits fluctuating team sizes.

The right answer starts with measurement rather than assumption, and that is a conversation worth having before the purchase orders go out.

Microsoft 365 is close to universal in the AEC sector, but a licence is not a configuration. When we review tenants for new clients, the same handful of problems appear again and again, most of them invisible until they cause a security incident or a data-loss headache.

1. Multi-factor authentication left optional

Compromised passwords remain the most common way into a business. If MFA is not enforced for every account, including partners and directors, who are the most valuable targets, the tenant is one convincing phishing email away from trouble.

2. SharePoint sprawl with no information architecture

Project collaboration works dramatically better when there is a deliberate structure: consistent project site templates, sensible permissions inheritance and a naming convention that matches how the practice actually numbers projects.

Without that, practices end up with hundreds of ad-hoc sites, duplicated documents and permissions nobody can explain.

3. No retention or backup strategy

Microsoft operates the service, but responsibility for your data remains yours. Retention policies, versioning settings and third-party backup should be deliberate decisions, not defaults, particularly for practices with contractual document-retention obligations.

4. Everyone is an administrator

Global admin rights accumulate over time and rarely get removed. Admin access should be limited, role-based and protected with the strongest authentication available, attackers who land an admin account own the entire tenant.

5. Licensing bought once and never reviewed

Practices change size and shape; licence assignments usually do not. An annual review of plans against actual usage regularly recovers meaningful budget, and often reveals security features already being paid for but not switched on.

A well-run tenant is not a project, it is a discipline. That is exactly what a specialist managed service is for.

“We have backups” is one of the most dangerous sentences in business technology, because it is usually where the conversation stops. The questions that matter come next: backups of what, tested when, restorable how fast, and what does the practice do while the restore is running?

Backup is a copy; continuity is a plan

Backup answers the question “is our data safe?”. Business continuity answers “can we keep working?”, which involves people, communications, alternative ways of accessing systems and a clear order of priorities, not just data.

A practice can have flawless backups and still lose a week of production because nobody planned how sixty people would actually work while systems were rebuilt.

Two numbers every director should know

Recovery Time Objective (RTO) is how long you can afford to be down. Recovery Point Objective (RPO) is how much recent work you can afford to lose. Neither is an IT decision, they are business decisions with cost implications, and IT builds to whatever targets leadership sets.

For deadline-driven AEC work, the honest answers are often more demanding than the current setup can deliver. Better to discover that in a planning meeting than mid-incident.

Test like you mean it

An untested backup is a hope, not a control. Restores should be tested regularly and realistically, including full-scale scenarios such as recovering a project server or a Microsoft 365 site, timed against your stated RTO.

Layered protection matters too: at least one backup copy should be off-site and isolated from your production credentials, so an attacker who compromises the network cannot also destroy the backups.

WIT builds and tests layered backup and continuity arrangements as standard for managed clients, because a bad day should never become a lost project.

The attacks that do real financial damage to AEC businesses are rarely sophisticated technical exploits. They are confidence tricks executed over email, aimed at the moments when money moves: valuations, stage payments, retentions and supplier invoices.

The classic pattern: invoice redirection

An attacker compromises or convincingly imitates a supplier, subcontractor or even the practice itself, then sends a plausible email announcing new bank details shortly before a genuine payment is due.

Because the projects, names and amounts are real, often gleaned from a compromised mailbox that the attacker has quietly read for weeks, the request looks routine. The money leaves, and by the time anyone reconciles, it is gone.

Why AEC is targeted

Project-based industries make ideal targets: many counterparties, regular large payments, time pressure and email as the default channel for financial instructions. A live project generates exactly the context an attacker needs to sound legitimate.

Defences that actually work

Process beats technology for this threat: any change of bank details should be verified by phone on a known number, without exception, including when the request appears to come from your own directors.

Technical controls still matter: enforced multi-factor authentication, mailbox-rule monitoring and modern email filtering close off the account compromises that make the fraud convincing in the first place.

Finally, staff awareness training turns your team from the attack surface into the alarm system. People who have seen the playbook spot it.

For years the question did not exist: design work needed a powerful machine under the desk, and that was that. GPU-accelerated virtual desktop platforms, including Inevidesk, which WIT’s founders co-founded, have made it a genuine choice. Neither answer is universally right.

Where physical workstations still win

A fixed team, working from one studio, on stable long-term workloads remains well served by physical machines: maximum performance per pound at the desk, no dependency on connectivity, and a hardware lifecycle the practice already understands.

Where VDI changes the game

Virtual desktops earn their keep when work is distributed orfluctuating: hybrid teams needing full Revit capability from home, freelancers and contractors who must be productive on day one, international project teams, and practices that scale up and down with project cycles.

Centralising data also simplifies security and backup: models never leave the data centre, which removes an entire category of endpoint risk.

The honest trade-offs

VDI depends on decent connectivity, and the platform choice matters enormously, general-purpose cloud VDI has historically disappointed AEC firms on GPU performance and cost. Sector-specific platforms exist precisely because of that gap.

Many practices land on a hybrid estate: physical workstations for anchor desks, virtual desks for flexibility. The right mix is a design exercise, and it starts with how your people actually work.

AI-assisted tools are already inside most practices, whether leadership has sanctioned them or not: drafting text, summarising documents, generating imagery, writing scripts. The productivity upside is real. So is the governance gap.

The risks specific to AEC

Design practices trade on intellectual property and client confidentiality. Pasting project information, client details or unreleased designs into consumer AI tools may transfer that material outside your control, in ways that can conflict with client agreements and data-protection obligations.

Accuracy matters too: AI output that looks authoritative still needs professional review before it informs a design decision, a specification or a contractual document.

What a proportionate policy covers

Good AI policies are short. They name the approved tools and accounts, define what data may and may not be entered, require human review of outputs used in deliverables, and give staff a clear route to request new tools rather than adopting them quietly.

Pair the policy with sanctioned, business-grade tools so the compliant path is also the convenient one, shadow AI thrives where the official answer is simply “no”.

Governance as an enabler

Handled well, governance accelerates adoption: staff experiment confidently inside known guardrails, clients get credible answers about how their data is handled, and the practice builds an honest picture of where AI genuinely helps.

WIT helps practices define approved toolsets, configure enterprise controls and align AI use with their wider information-security obligations.

Many AEC businesses grow into the same bottleneck: one capable IT person who has been there for years, knows everything, and is now expected to be helpdesk, project engineer, security officer and strategist simultaneously. Holidays become risky. Big projects stall. Nobody sleeps well.

The problem is structure, not the person

A single individual, however good, cannot provide cover, breadth and progression at once. The choice is usually framed as “hire more staff or outsource everything”, but both options discard something valuable: either budget efficiency or hard-won internal knowledge.

How co-managed arrangements work

Co-managed IT splits responsibilities deliberately. Typically the internal team keeps what they are best at, often user-facing support and institutional knowledge, while the partner provides monitoring, escalation engineering, project capacity, security operations and strategic input.

The internal IT manager gains a deep bench behind them, cover when they are away, and specialists to call on, rather than a competitor for their role.

Making it succeed

Clear boundaries are everything: documented ownership of each responsibility, shared tooling and ticketing, and honest reporting to leadership from both sides.

WIT runs co-managed arrangements alongside internal teams at several practices, usually beginning with monitoring and escalation, then expanding as trust builds. It is often the most cost-effective step between “one person doing everything” and a full internal department.