1 · Reconnaissance
OSINT for facility location, employee names/roles, delivery services used, and Google Street View analysis. Building exterior observation to map camera positions, guard patterns, and shift schedules.
Services / Physical Security
Physical Security Assessment
A hands-on evaluation of your facility's physical defenses — not a checklist review, but an actual attempt to bypass access controls, gain unauthorized entry, and reach sensitive areas. Conducted with full documentation and photo evidence.
What we test
- Perimeter control — fencing, gates, camera coverage gaps, exterior lighting blind spots
- Entry point bypass — door latch manipulation, under-door attacks, door-gap exploitation
- Access control system — badge reader vulnerabilities, HID/iClass cloning, keypad bypass
- Tailgating and piggybacking — can an unauthorized person follow an employee through a controlled door?
- Reception / lobby controls — visitor logging, ID verification, unescorted access
- Server room and sensitive area access — what's reachable once inside the building?
- Dumpster and document disposal — are sensitive materials being discarded without shredding?
- Network drop accessibility — are exposed RJ45 ports accessible from public areas?
What you get
- Full narrative of each access attempt — succeeded or failed, how, and why
- Photo evidence for every entry point tested (handled per agreed evidence policy)
- Map of tested entry points with success/failure markings
- Risk-rated findings per control gap (e.g., "server room accessible without badge in 3 of 5 attempts")
- Remediation recommendations: hardware, policy, and procedural
- Executive PDF and full portal access with finding detail
Rules of engagement matter
Physical assessments require clear written authorization before any attempt is made. We document our rules of engagement carefully — including emergency contact information, abort procedures, and what to do if we are confronted. Your security team and, where appropriate, local law enforcement contacts are briefed before testing begins.
Methodology
2 · Pretext development
Develop realistic pretexts appropriate to your facility type — IT vendor, delivery driver, fire safety inspector, job candidate. Pretext scenarios agreed with your team before execution.
3 · Entry attempts
Attempt physical access using agreed vectors — tailgating, badge cloning, door bypass, pretext-based social engineering of staff. Each attempt timestamped and documented immediately.
4 · Internal access
Once inside: attempt to reach server rooms, network closets, executive offices, and document storage. Test whether internal doors enforce access controls or rely on perimeter security alone.
5 · Evidence collection
Photos taken per agreed scope — typically entry point images, badge reader close-ups, and accessible equipment. No employee photos without explicit written consent.
6 · Debrief & report
Findings presented to facilities, security, and executive teams. Each control gap tied to a realistic threat scenario and a concrete, costed remediation recommendation.
Best for
- Data centers, server rooms, and co-location facilities
- Healthcare facilities with HIPAA physical safeguard requirements
- Financial institutions with physical control compliance obligations
- Government and defense contractors with facility security requirements
- Any organization that has never tested whether "badge access required" signs actually work
Test your physical defenses before an adversary does
We'll define scope, pretext scenarios, and rules of engagement on a scoping call before any assessment activity begins.
Request a consultation All services