AECOM is a $16.1 billion infrastructure consulting firm headquartered in Dallas, Texas, publicly traded on the NYSE (ACM). The company operates globally, delivering professional services across the entire project lifecycle - from planning, design, and engineering to program and construction management. Its work spans critical sectors: transportation, buildings, water, new energy, and the environment.
The cybersecurity threat surface here is massive and high-stakes. When your projects include water systems, energy infrastructure, and transportation networks across the globe, the attack model isn't theoretical - it's about operational technology (OT), industrial control systems (ICS), and the digital layers binding together physical infrastructure that millions of people depend on. Supply chain risk, convergence of IT/OT environments, and the integrity of design and engineering data are not abstract concerns at this scale.
For security professionals, the draw is scope. AECOM ranked #1 in 2025 for general building, transportation, and water by Engineering News-Record and was named the world's top design firm the same year. That volume of critical infrastructure work means security teams aren't just protecting corporate endpoints - they're embedded in environments where a breach could have real-world physical consequences. The company has been recognized as one of Fortune's "World's Most Admired Companies" for twelve consecutive years and was named one of Ethisphere's 2025 World's Most Ethical Companies.
