Physical penetration testing
On-site intrusion testing under a signed authorisation letter and clear rules of engagement: whether someone can walk, talk or badge their way into spaces and assets you meant to keep closed — without damage, and with a stop contact always available.
- Signed authorisation letter
- Rules of engagement first
- Retest where practical
-
Authorisation letterSigned before any visit
-
Response observedGuards, CCTV and reception
-
Facilities involvedWorking with your teams
-
Retest where practicalWithin 6 months, up to 10 issues
Who this is for
A good fit
- Useful before a new site opens, after a badge or receptionist change, or when a customer or insurer asks whether physical controls were tested.
- Always booked with written authorisation from someone who can approve access to the premises.
Worth knowing
- Organisations that need evidence their offices, warehouses, data halls or clinics resist a determined visitor — not only a network scanner.
What we test
Entry and tailgating
Following authorised people through controlled doors
Details
- Following authorised people through controlled doors
- Piggybacking at turnstiles and vehicle gates
- Use of propped or slow-closing doors
- Loading bay and goods-in paths
Badges and access control
Cloned or copied proximity badges where lawful and approved
Details
- Cloned or copied proximity badges where lawful and approved
- Reader and controller behaviour with unauthorised credentials
- PIN and code observation risk at keypads
- Orphaned or overly broad badge rights discovered during the test
Locks and bypass
Common non-destructive bypass techniques on doors and cabinets in scope
Details
- Common non-destructive bypass techniques on doors and cabinets in scope
- Padlocks and secondary barriers on agreed targets
- Server room, wiring closet and secure-cabinet checks
- No destructive methods unless the letter expressly allows a named item
Reception and pretexting
Visitor sign-in and escort procedures
Details
- Visitor sign-in and escort procedures
- Pretexts to reception, facilities and help desk on site
- Contractor and delivery personas approved in advance
- Whether unverified visitors reach restricted floors
Rogue device drops
Details
- Placement of approved test devices (for example a drop box or cable) in agreed areas
- Whether staff report or remove them
- Whether the device can reach the network — handed to a network test if in joint scope
Guards, CCTV and response
Whether cameras cover the paths we used
Details
- Whether cameras cover the paths we used
- Whether guards challenge strangers in restricted areas
- Time from anomaly to challenge or alarm
- Observation only — we do not disable cameras or alarms
About this scope
Scope is set by site and building. Techniques are chosen from the approved list in the rules of engagement. Planning follows the physical-security assessment discipline in NIST SP 800-115 (authorisation, scope, safety).
What you receive
- An executive summary written for non-specialists.
- Technical findings with evidence (photos, timestamps, paths) and remediation guidance for facilities and security owners.
- Severity based on what an unauthorised person could reach.
- A debrief call; optional joint debrief with a red team or social engineering engagement.
More about the report
- A retest of agreed physical fixes (for example a door closer or badge rule) within 6 months of the original test (up to 10 issues) where retesting on site is practical.
Legal authorisation and safety first
Nothing starts without a signed authorisation letter (sometimes called a get-out-of-jail letter) naming the sites, dates, testers and permitted techniques. A trusted contact on your side must know the test is running and be reachable to stop it. We do not force entry that would damage property, threaten people or break criminal law beyond what the letter expressly allows. If a guard, receptionist or police officer challenges the team, we identify ourselves and stop.
- Signed authorisation letter before any visit.
- Rules of engagement: hours, buildings, floors, exclusion zones and banned techniques.
- Named escalation contacts on both sides, including an emergency stop.
- No property damage, no lock drilling, no violence, no real theft of valuables.
- Staff who challenge us are treated with respect; the test ends at that point for that path.
Common findings (examples)
- Tailgating into a badge-only floor because nobody challenges a confident walker.
- A reception process that issues a visitor badge without verifying the host.
- A wiring closet or plant room on a master key that many people still hold.
- A dropped USB or network implant left untouched for hours.
- CCTV that covers the lobby but not the side stair the tester used.
What we need from you
- Signed authorisation letter before the first visit.
- Site addresses, floor plans if available, and exclusion zones (for example clinical areas, trading floors).
- A stop contact reachable throughout the window.
- Agreement on whether reception and guards are told in advance (your choice).
- Optional: spare badges or test credentials if cloning is out of scope but badge abuse is in.
Typical timeline
Duration depends on the number of sites, buildings and whether attempts are limited to business hours. A single office with a focused set of techniques is often a short engagement; multi-site work with night windows and joint network hand-off takes longer. Dates are fixed only after the authorisation letter is signed.
What stays out of scope by default
- Property damage, lock drilling, cutting or forced entry that leaves a permanent mark — unless a named item is approved in the letter.
- Any action that endangers people.
- Theft of valuables or personal belongings.
- Sites or floors not named in the authorisation letter.
- Attacks on neighbouring tenants without their written approval.
Working with facilities and people teams
Physical tests touch reception, facilities and sometimes security contractors. Before the visit we agree who is briefed and how results will be shared. The report is written for fixes — door hardware, badge rules, escort policy — not for blaming the person who held a door open. Staff who challenge testers correctly are a success, not a failure of the exercise.
Scope and rules
- Scoping and authorisation. Sites, buildings, hours, techniques and the signed letter.
- Open-source and site familiarisation. Public information and, if you allow, a supervised walk-through before the covert window.
- On-site attempts. Within the rules: entry, badge, pretext, device drop and observation of response.
- Immediate stop if challenged or unsafe. Testers identify themselves to the stop contact.
- Evidence pack. Photos, timestamps and paths — no images of staff faces in the main report unless you ask.
- Report and debrief. Findings for facilities, security and reception owners, plus optional joint debrief with a red team if booked together.
- Signed authorisation letter
- Rules of engagement first
- Retest where practical
Related
Frequently asked questions
Do we really need a signed authorisation letter?
Yes. Without it we will not attend site. The letter protects your staff, our testers and anyone who might otherwise treat the attempt as a real incident.
Will you damage doors or locks?
No, by default. Non-destructive techniques only, unless the letter expressly approves a named destructive test on a specific item.
Should we tell reception and guards?
That is your choice. Some clients keep them unaware; others brief a small trusted group. Either way, a stop contact must know.
What if police or security detain a tester?
The tester presents the authorisation letter and contacts the stop number. You agree in advance who will confirm the test is real.
Can this be combined with a red team?
Yes. Physical entry is often the agreed starting point for a red team that then continues on the network.
Do you clone employee badges?
Only if the rules of engagement approve it and it is lawful for the engagement. Alternatives include test badges you issue.
Will staff faces appear in the report?
Not in the main report by default. Evidence focuses on doors, paths and processes.
Is this the same as a security guard audit?
No. It is an intrusion attempt under agreed rules, with a technical report — not an HR or contractor performance review.
Scope a physical penetration test
Tell us the sites, who can sign the authorisation letter and what you want to learn. We reply with a suggested approach and a letter template.
Request a free scope review →