Physical Penetration Testing

Reception, doors, badges, cameras and the staff who use them are security controls, and like any control they can be misconfigured or ignored. A badge reader means nothing if the door next to it is propped open for deliveries. A camera means nothing if no one watches it. We test whether these controls work as a system or only on the plan.

People rarely challenge someone who looks like they belong. A lanyard, a confident stride and a coffee in hand get further than any lock-picking kit. Most of our successful entries come from social engineering at the door, not from defeating hardware, and that’s the uncomfortable finding most clients need to hear.

We study the target before we ever approach: entrances and exits, delivery and smoking areas, shift patterns, uniform and badge design, and what open sources reveal about the site and its occupants. From this we plan the approach and the pretexts, and we identify the objectives, a specific room, a network port, a document, so success is measurable.

On the day, our operators attempt entry through the routes the plan identified: tailgating a group returning from lunch, presenting as a contractor or delivery driver, using a cloned badge, or defeating a poorly-fitted lock. We keep detailed notes and photographic evidence of each control we pass, so the report shows precisely where the chain broke.

Badge cloning

Many access-control systems still use legacy proximity cards that can be read from a pocket’s distance and cloned in seconds. Where your badges use this technology, we demonstrate the clone and use it, because “our doors are badge-controlled” is only reassuring if the badges themselves can’t be copied on a busy pavement.

Once in, we head for what matters. A live network port in an empty meeting room lets us plug in a small device that connects back to our infrastructure, turning a physical breach into a network foothold. An open server room, an unattended logged-in workstation, or a folder of sensitive papers on a desk all prove the same thing: the perimeter was the building, and it failed.

We leave cleanly, remove any devices we placed, and account for everything. The report then walks the full journey with photographs, from the car park to the objective, naming each control that should have stopped us and didn’t, alongside the specific, practical fixes.

The most reliable way in is to follow someone through a door they’ve just badged open. Politeness does the rest: holding a door for the person behind you is good manners and terrible security. Staff who feel awkward challenging a stranger are the single most common reason we succeed.

Legacy proximity cards, badges left on desks, and access credentials shared between staff undermine an otherwise decent access-control system. If a card can be read and copied from a nearby pocket, the whole barrier is theatre.

An active ethernet port in a public or semi-public area is an open invitation. So is a comms cabinet with the key left in the lock or a server-room door held open by a fire extinguisher. These give an attacker the network foothold that the rest of your security spend was meant to prevent.

Sensitive documents left on desks, whiteboards covered in credentials, and workstations left logged in hand an intruder information and access without any technical skill at all. It’s mundane, and it’s everywhere, and it usually costs nothing but discipline to fix once a report puts a photograph of the problem in front of the right people.

An operator who tailgates in, finds an empty desk and plugs a small implant into a live port has just handed our team a foothold behind every perimeter firewall. From there the engagement can continue as an internal network or Active Directory test, showing you the whole path from the pavement to your most sensitive systems. Run as one exercise, it makes the case for both physical and network controls far more powerfully than either test alone.

Physical entry and social engineering are close cousins, since most successful entries come from talking past a person rather than defeating a lock. Combining a physical assessment with pretext phone calls and phishing gives a rounded picture of how your people respond to pressure, whether it arrives by email, by phone or in person at the reception desk.

A concise account for leadership of how far we got and what it would have meant, backed by photographs that make the risk impossible to dismiss. Nothing focuses a board quite like a photograph of one of our testers sitting calmly inside the server room.

Every control tested, every one bypassed, with the method, the evidence and a specific remediation, prioritized by how much each fix reduces risk. Where the physical breach led to network access, we document that chain too.

An attestation letter for auditors, insurers and clients confirming the assessment and its scope, and a free retest once you’ve made changes to confirm the gaps are genuinely closed.

ISO 27001 Annex A includes a full set of physical and environmental security controls covering secure areas, entry controls and equipment protection, and auditors value independent testing of them. SOC 2 assesses physical access as part of its common criteria, and PCI DSS requirement 9 sets specific physical-access requirements for any environment handling cardholder data.

GDPR Article 32’s expectation of appropriate technical and organisational measures extends to the physical protection of systems holding personal data, and NIS2 pushes essential-service operators to consider physical resilience alongside the digital kind.