Plainsight Security

Independent security testing and certification from Lancashire

Plainsight Security is a UK cybersecurity firm based in Lancashire that combines certification work under the government-backed Cyber Essentials scheme with independent penetration testing. The company presents itself as an IASME-appointed Certification Body, which allows it to assess and issue Cyber Essentials and Cyber Essentials Plus certificates in-house rather than passing clients to a third party. Its stated positioning is that organisations should not assume their controls work but demonstrate it, first by certifying the basics and then by testing what a determined attacker could actually reach.

The firm reports that its lead tester is registered with the UK Cyber Security Council as a Principal (PriCSP) for Security Testing, and that it holds Cyber Essentials Plus and IASME Cyber Assurance Level 2 certification itself. Infrastructure testing is described as following a recognised methodology delivered by a tester holding The Cyber Scheme's Team Leader qualification for infrastructure testing, recognised by the NCSC against UK government testing standards, while web application work follows the OWASP methodology.

Certification: Cyber Essentials and Cyber Essentials Plus

The certification line covers the scheme built around five fundamental controls that, according to the company, stop the majority of common attacks. The service begins with a gap review against the current scheme, continues with hands-on support to close those gaps, and ends with certification. The Plus level adds a hands-on audit in which the same controls are checked from outside the client's team rather than accepted on trust. Plainsight frames certification as a credential that customers, insurers and tenders increasingly expect.

Penetration testing across three environments

• External infrastructure: probing everything reachable from the internet, including perimeter, exposed services, VPNs and cloud edges, in the manner of a real adversary.
• Internal infrastructure: modelling a breached laptop or rogue insider to see how far that foothold spreads across network, servers and Active Directory.
• Web applications: authenticated, role-aware testing of applications and APIs against the OWASP Top 10, including logic flaws that automated scanners tend to miss.

The company illustrates the value of internal testing with an illustrative attack path, explicitly not a real client, that runs from a phished and reused employee password through discovery of a plain-text administrator password in a file share, privilege escalation, lateral movement and finally domain administrator control.

Configuration reviews and continuous scanning

Two review services sit alongside the testing work. A firewall rules review examines every rule and device setting line by line from an export of the configuration, without live access and therefore without downtime, so the client knows exactly what the firewall permits. A Microsoft 365 security audit checks the tenant against the CIS Microsoft 365 Foundations Benchmark, covering MFA, admin roles, email security, sharing and app permissions, and specifies the exact setting to change for each finding.

For ongoing assurance, the company offers vulnerability scanning under the name Pulse: scheduled internal and external scans with reviewed reports intended to show exposure trending down over time. The site listed a starting price of £50 per month plus VAT at the time of writing this profile.

How an engagement runs

Plainsight describes a five-stage process designed to remove friction. It opens with a free scoping call, after which the client receives a fixed price and a written plan with no obligation. Dates are then agreed, including out-of-hours work, with the in-scope and out-of-scope elements confirmed in writing. An experienced tester carries out the assessment, flagging anything critical as soon as it is found. The deliverable is a plain-English report with an executive summary plus prioritised, reproducible findings and fixes for the client's engineers. Aftercare includes a walkthrough of the findings, answering the team's questions and re-testing remediation at no extra cost.

The company states that a single point of contact runs each engagement end to end, that engagements are led by a senior tester with no hand-off to a junior, that a fixed-price quote typically follows the scoping call within 48 hours, and that the final report usually arrives within five working days. It also reports that 100% of engagements are led by an experienced senior tester and that remediation re-tests and aftercare carry no charge.

Coverage and client evidence

Plainsight is based in Lancashire and works across the North West and the wider UK, naming Blackpool, Preston, Manchester, Liverpool, Cheshire and Cumbria among its areas. Testing is delivered remotely or on site where required. Among the published case studies is a web application penetration test for the WTF Giveaways platform, accompanied by a client testimonial from Ben Govier praising the clarity of the explanations and the practicality of the recommendations.