UK construction · civils · plant hire · contracting

Know what needs attention before you spend.

Start with a free review of one public domain. With your permission, I check the public website and email records, then give you a short written summary and a 15-minute briefing: what I found, what I cannot establish from outside, and any sensible next step.

No obligation to buy. Any further work is quoted and agreed separately.

See an example briefing

Your free initial review
One named public website. No access to your accounts or internal systems. Not a pentest.

This records your permission and sends me a request. I will confirm the scope and timing by email before starting. How your details are used.

Want the scope first? Email Harry or call 07745 599904.

Harry Tinson
Your point of contact, from the first conversation. Harry Tinson · Securixy

What you get

See the finding. Understand where it could lead.

Your free review gives you a short written summary and a 15-minute briefing: what was observed, where it could lead and any sensible next step.

Illustrative assessment

Example Contractor Ltd

Fictional example

01   Payment diversion

A convincing email. A costly bank change.

Example observationThe published email policy is set to monitoring, rather than asking receivers to reject messages that fail authentication.

Plausible attack path, if other checks fail

  1. A message impersonates the firm
  2. It requests a change of bank details
  3. A payment goes to the wrong account

Still to confirmHow receiving mail filters behave, and how bank changes are verified.

First stepReview legitimate senders before tightening the email policy. Verify bank changes through a known phone number.

02   Mailbox takeover

A public sign-in. Questions about access.

Example observationA sign-in page is visible from the internet. That alone is not a security weakness.

Plausible attack path, if access controls fail

  1. An attacker tries stolen credentials
  2. Access controls fail to stop the sign-in
  3. The mailbox is used for fraudulent requests

Still to confirmWhether credentials are exposed, MFA is enforced and suspicious sign-ins are blocked.

First stepAsk your IT provider to confirm MFA coverage and review sign-in protections.

These are possible routes, not confirmed attacks. A public review cannot establish what happens behind a login. Your briefing separates observed evidence from questions to check.

See the full example briefing for the report format, limits and a quiet result where no immediate work is recommended.

Why this exists

A useful first step. Help with the next one.

Before recommending work, I want to understand whether the public-facing evidence points to anything worth addressing. I'll explain what I can see, what I can't, and where more questions are needed. If there isn't enough evidence to recommend a paid first step, I'll say so.

Where work is needed, I can source and quote security products through my distribution partner, Brigantia. Any proposal will make clear the cost, who implements it and who provides ongoing support. Your existing IT provider can stay involved.

How it runs

Permission, then a look, then 15 minutes.

  1. 1You name a public website and give permission.
  2. 2Harry confirms the scope and timing by email.
  3. 3Harry carries out the authorised look before the conversation.
  4. 4You discuss the findings and any sensible next step in 15 minutes.

The process in more detail.

Scope

This is not a pentest.

A quiet result is not a clean bill of health. It is not proof you are secure. MFA, backups, who still has admin, and anything behind a login stay unknown from the outside.

This is

  • Outside-in
  • One public domain
  • Permissioned
  • A short briefing
  • Observed evidence, then questions

This isn't

  • A pentest
  • A login to your systems
  • An internal audit
  • Cyber Essentials certification
  • An insurance quote
  • A guaranteed finding

Who this is for

UK firms that build, hire plant, or contract.

Construction. Civils. Plant hire. Contracting. Roughly 10 to 100 people. MD, owner, FD, operations.

If you run another type of business, get in touch. We can establish whether this is a useful starting point for you.

Who we help Construction Plant hire Contractors / civils

Questions

Short answers before you tick the box.

Is this a pentest?

No. A pentest is a scoped, usually longer test. This is an outside-in look at one public website, then 15 minutes.

Do you log in?

No. I do not use your passwords, VPN, or admin accounts.

What do you look at?

What is visible from the public internet on the domain you name: the website, mail records, exposed logins, that kind of thing. Not your internal network. Not sister companies. Not arbitrary subdomains you did not name.

Do you run anything without permission?

No. The tick on the form is the permission. Nothing starts before that. Submitting the form asks me to look. It does not fire a scan on its own.

What if you find nothing?

I tell you. That is not proof you are secure. It means I could not see enough from outside to recommend spend. We then decide whether questions, Cyber Essentials, insurance, a later look, or nothing is the honest next step.

Can you prove MFA or backups?

Not from outside. Those sit behind a login. I will say I cannot see them rather than guess.

Is this Cyber Essentials?

No. Cyber Essentials is a scheme with a question set and a certificate. This look is not that, and it does not make you certified.

What happens after?

Harry uses the request to arrange a 15-minute briefing. If there is a sensible first step, he explains it. If there is not, he says so. You decide.

Same offer

Authorise one public domain. Then 15 minutes.

The initial review is free: one domain, a short summary and 15 minutes. No obligation to buy. Any further work is quoted and agreed separately.

Authorise the outside-in look