Skip to content

For HVAC, Plumbing & Electrical

Your AP inbox pays suppliers, subs, and permit fees. Hijack it and every wire goes somewhere else until you reconcile at month-end.

Trades businesses run on email: supplier orders, subcontractor invoices, change orders, permit correspondence. One compromised AP or dispatch inbox lets an attacker redirect wires for the whole billing cycle. SentinelSMB watches every inbox around the clock so the hijack is caught before the invoice goes out.

Ask about monitoring Run a free scan first
  • Month to month
  • No setup fees
  • Cancel anytime
$3.05B

Business email compromise losses reported to the FBI in 2025, across 24,768 complaints, from businesses of every size

Source: FBI IC3 Internet Crime Report, 2025

Credentialed, insured, operational

  • RegisteredND LLC
  • IRS registeredEIN on file
  • E&O insured$1M per claim, $2M total
  • EncryptedYour data, at rest and in transit
  • Sign-inAlways a second step
  • Audit trail365-day retention

Threats we catch

Three attacks aimed at HVAC, plumbing, and electrical contractors.

36 detection engines check your Microsoft 365, Google Workspace, AWS and Cloudflare accounts every five minutes. Critical threats surface instantly. Normal activity gets filed away.

Supplier invoice wire redirect

Attacker sits in a hijacked AP inbox, waits for a real supplier invoice, then replies with updated banking details from a lookalike domain. The wire leaves before anyone thinks to call the supplier.

ServiceTitan / Jobber account hijack

ServiceTitan, Jobber, Housecall Pro, FieldEdge — all authenticate via OAuth against your email. One hijacked inbox is full read-write access to your customer list, pricing, scheduling, and billing history.

Customer PII and card data exposure

Residential service businesses hold customer addresses, access codes, alarm-system details, and stored-on-file card tokens. A compromised dispatch inbox is a home-invasion kit and an identity-theft kit at the same time.

36 detection engines Every five minutes
Supplier invoice wire redirectFlagged. You get a text with the steps to fix it.

Example alert for a made-up business.

Your blind spot

What a typical IT setup does not watch.

  1. Dispatch, AP, and owner inboxes all handle invoices — which means three different hijack paths, all ending with the same wire fraud outcome.
  2. Your techs work from trucks, jobsites, and home — sign-ins from new locations look identical to sign-ins from an attacker on a hotel Wi-Fi.
  3. You onboard and offboard seasonal techs constantly, and dormant accounts pile up fast. Every one is an attacker target.
  4. When a commercial GC asks for your cyber-security program before awarding a sub contract, a policy doc is not the same as actual monitoring.

The screen is an example for a made-up business, not real customer data.

Compliance alignment

The rules and frameworks we line up to.

SentinelSMB provides the continuous-monitoring, access-control, and incident-response controls these frameworks require. Pro subscribers get the audit-ready evidence package.

  1. State contractor licensing

    Professional conduct standards

    Most state contractor licensing boards now include data-handling and customer-privacy expectations in their professional conduct rules. Documented cyber-security controls are part of meeting that standard.

  2. State breach notification

    Customer notification on PII exposure

    Every US state requires notification to affected individuals when personal information is accessed without authorization. Residential customer data (address plus payment info plus access details) is especially sensitive under state laws.

  3. Commercial customer contracts

    Cyber-security reps in GC agreements

    If a general contractor adds cybersecurity promises to your subcontract, a monitoring record helps you show you kept them.

  4. Card payment processing

    Merchant account obligations

    If you store card tokens (even through ServiceTitan or Jobber), your merchant agreement requires reasonable security of systems that touch that data. Monitoring your email and cloud accounts protects the OAuth credentials those platforms rely on.

Questions

Questions HVAC, plumbing, and electrical contractors ask.

Text Cole at (701) 391-5973
We use ServiceTitan / Jobber / Housecall Pro — does this work?

Yes. SentinelSMB monitors the Microsoft 365 or Google Workspace account those platforms authenticate against. OAuth grants, API tokens, and SSO logins all leave signals in the underlying cloud account — that is what we watch.

Our techs use their phones for everything. Is that a problem?

Not for us. SentinelSMB monitors account activity regardless of device — a sign-in from your normal tech on his phone from your service area looks fine. A sign-in from a foreign IP at 3 AM does not. We baseline the normal and alert on the abnormal.

What about the office laptop and the truck tablets?

Workstation and device management is the job of your IT vendor. SentinelSMB covers the cloud accounts — email, shared drives, field-service platform OAuth — where account takeover actually happens now.

We already have antivirus. Is this redundant?

Antivirus watches laptops for malware. It does not watch your email for a forwarding rule that silently copies every invoice to an attacker. It does not watch your Microsoft 365 for a malicious OAuth grant. Those are the attacks that cost trades businesses real money, and that is what we catch.

Every invoice, every supplier email, every customer record — monitored around the clock.

Under 10 minutes to connect. No hardware, no IT-speak. Cancel in one click. Catch the hijack before the wire goes out.

Ask about monitoring See pricing