Physical
Penetration Testing
Check how well your premises and access procedures hold up. Every exercise has an agreed scope and written authorisation.
Overview
Digital security stops at the front door.
We test access controls, surveillance, reception and visitor processes, and employee awareness through tailgating, impersonation, and badge-cloning scenarios. For advanced engagements we partner with ex-intelligence professionals — with specialist delivery partners.
Coverage
What we test.
Physical controls, processes, and human awareness across your sites.
- Access-control & badge bypass
- Tailgating & piggybacking
- Impersonation & pretexting on-site
- Reception & visitor processes
- Surveillance & alarm response
- Server room & comms access
- Clean-desk & sensitive material
- Network access from inside
FAQ
Physical penetration testing FAQ
Scope, cost, and what happens next.
How much does physical penetration testing cost?
Physical penetration testing typically starts around €5,000 per site and depends on the number of locations, objectives, and whether it forms part of a wider red team. Contact us for a tailored figure.
What does a physical penetration test involve?
Reconnaissance of the site, then attempts to gain unauthorised entry through access-control bypass, tailgating, impersonation, and pretexting, aiming to reach defined targets such as a server room.
Is physical penetration testing safe and authorised?
Yes — fully authorised in writing, with named contacts, an authorisation letter carried by testers, and agreed rules of engagement to keep everyone safe.
Do you really use ex-intelligence professionals?
For advanced engagements, yes — we partner with experienced ex-intelligence practitioners for realistic, high-assurance operations.
How is this different from a red team exercise?
Physical testing focuses on premises and access. A red team combines physical, digital, and social vectors into one full-scope adversary simulation.
What do you need to authorise a physical test?
A signed authorisation ("get out of jail") letter, named emergency contacts, in-scope locations, and clear objectives and limits.
More questions about this service
Will staff or guards be informed?
Usually only a small control group knows, so the response is realistic; safety and de-escalation rules are agreed in advance.
What are typical objectives?
Reaching a defined target — a server room, executive floor, or a planted network drop — to demonstrate impact.
Do you cover multiple sites?
Yes — multi-site engagements are scoped per location and often combined into a red team.
Is it safe?
Yes — engagements are fully authorised, carefully planned, and testers carry authorisation documents and follow strict safety rules.
Related services
Explore more.
Ready to test your premises?
A 30-minute scoping call costs nothing. A physical breach costs considerably more.
Book a short call Send an email