UK plant hire · about 10 to 100 people
Authorise one public domain. Harry looks from the outside, then gives you 15 minutes on what is visible, what cannot be seen, and what is worth doing first.
One public domain from the outside. Then 15 minutes. Nothing runs until you authorise it.
Hire-desk email, invoices and the public website first. Not a catalogue, and not a guess at systems I cannot see.
If there isn't enough evidence to recommend spend, I'll tell you that too.
Why this conversation exists
You hire plant. You probably do not employ a CISO. You may have a yard, a depot, a hire desk, Microsoft 365, a local IT firm, and staff who are out more than they are in. None of that requires a six-month security programme. It does mean a few operational facts are worth being honest about.
If somebody convincingly spoofs the hire desk, the problem is not an interesting mail record. It is a machine collected from the wrong yard, or a payment sent to the wrong account.
I start with what a stranger can already see on the public domain you name. That is the honest first step for a plant-hire business, not a product list.
Quotes, collection instructions and hire agreements still leave the desk by email. If a customer trusts that address, a convincing fake is an operations problem first. Published mail controls on your domain are part of whether that message looks like you.
Bank-detail conversations with customers and suppliers still move by email. A message that “the account has changed” is a finance problem, not an IT curiosity. I can see what the domain publishes. I cannot see who sits on the invoice inbox.
Hire enquiries often start on the site. A neglected public surface is already visible to strangers. I only look at the domain you name, after you say I may. Sister companies and anything behind a login stay out of scope.
People work from the yard, the road, home and the office on the same domain. A local MSP looking after Microsoft 365 is normal. It is not the same as someone having looked at what the public website publishes.
Telematics, fleet portals and anything behind a login stay unknown unless they have been left on the open internet. I will not invent findings about them.
Brokers and insurers sometimes ask how you handle cyber. That is a conversation. An outside-in look is not an insurance quote, and it does not make you eligible for cover.
If email and the office systems stop, the hire desk stops. I will not open with a ransomware product. If the public surface is neglected, we talk about that first.
What the look can see
I do not need a login. I do not walk the yard network. I look at what the named public website already publishes.
The unknowns become questions. I will not invent findings to fill them. How the look works.
A useful result
A quiet look at the public domain is not a certificate that the yard is secure.
It means I have no evidence-led reason to manufacture a product recommendation from that look. MFA on the hire-desk mailbox, whether backups restore, patching, and endpoint protection sit behind a login. They stay unknown.
The useful next step may then be those internal questions, Cyber Essentials if a customer has asked, a broker conversation, a later re-look, or nothing for now.
Customers and cover
A hire account, a framework, or a broker may ask how you handle cyber, or whether you hold Cyber Essentials. I will not claim that every plant-hire customer requires it. When the question arrives, the useful work is to answer honestly, not to buy a stack of tools so the form looks busier.
The outside-in look can tell you whether the public surface is neglected before you spend time on that conversation. It cannot complete a questionnaire for you, it is not a certificate, and it is not an insurance decision.
Certification boundary
Cyber Essentials is a scheme with a question set and a badge. I do not award it. The 15 minutes do not replace the assessment.
What the look can do is start a sensible conversation: visible issues on the public domain, then the internal questions a plant-hire firm actually has to answer. If you only need the certificate, say so on the call.
Email trust
If the hire desk and accounts send quotes, hire agreements, invoices and supplier messages by email, email trust is a business control, not an IT nicety. Published mail records on the named domain are part of whether a message can look like it came from you. I can see those records from outside. I cannot see mailbox MFA, forwarding rules, or who has the hire-desk inbox.
I will not open this page with a product. If the look finds neglected mail records, the first step is usually to tidy what the domain publishes and how you confirm bank changes and collection instructions. Email security, in that sense.
Illustrative only
This is not a client. It is not a look at your site. It is the shape of the conversation so you can hear how observed facts stay separate from questions.
Illustrative sample · fictional firm · not a case study · not a look at your site
example-yard-hire.co.uk
A longer, still fictitious sample lives on the example briefing page. That one uses a made-up contractor, on purpose, and is not this yard.
How it runs
Fit
Construction and civils sit next to this: construction · contractors / civils · all sectors.
Harry
I run Securixy. If I emailed you, this is me. I look at a plant-hire domain the same way I look at a site firm: from outside, after you say I may. No account managers. No offshore desk. No invented team.
Trust here is process, not a wall of logos. Permission first. Observed versus unknown. No login. One domain. No forced recommendation. More about me.
Questions
The public website you name, its published mail records, certificates, and any obvious remote or admin login on the open internet. Not yard cameras. Not telematics or fleet systems unless that login is already public. Not anything behind a password.
No. A pentest is a scoped, usually longer test, often against systems you have agreed in writing. This is an outside-in look at one public website you name, then 15 minutes.
No. The tick on the form is the permission. Nothing starts before that. Submitting the form asks me to look. It does not fire a scan on its own. Query strings and clicks are not consent.
That is common in plant hire. I am not here to replace them. I look at what the public domain publishes. If they already keep that tidy, the 15 minutes may be short and I will not invent work. If something obvious is visible, you can take it to them with a straight question.
No. Multi-factor authentication on mailboxes, hire-desk logins and anything behind a password sits where I cannot see it. I will say I cannot see it rather than guess.
Only if that system is left on the open internet as part of the domain you name. If it is not publicly visible, I will not invent a finding about it. Most telematics sits behind a login, so it stays unknown.
No. Cyber Essentials is a certification scheme with a question set and a badge. This look is not that, and it does not make you certified. It is also not an insurance quote, and it does not make you eligible for cover.
I tell you. That is not proof the yard is secure. It means I could not see enough from outside to recommend spend. You then decide whether internal questions, Cyber Essentials, a broker conversation, a later look, or nothing is the honest next step.
I reply from my inbox and we book 15 minutes. After that, you decide. There is no retainers pack that starts because you ticked the box.
Same offer
Name the public website. Tick that I may look at it from the outside. I reply from my inbox. Nothing runs from this page.
Authorise the outside-in look