What is a physical penetration test?

A physical penetration test is an authorised, controlled attempt to gain unauthorised physical access to an organisation's premises and the assets inside, such as server rooms, workstations, documents and network ports. It evaluates physical controls, staff behaviour and security processes together, and reports which controls held, which failed and how to fix them.

Is a physical penetration test legal?

Yes, when it is authorised in writing by someone with authority to grant access to the premises, bounded by agreed rules of engagement and carried out by testers carrying that authorisation. Without the letter the same actions would be trespass; with it they are a commissioned security assessment. For leased or shared buildings the landlord usually has to be informed.

Will the testers break in or damage anything?

No. Forced entry, damage, theft and coercion are excluded in every engagement. Testers use tailgating, pretexting, unattended doors and process gaps, and prove they reached an objective with timestamped photographs or a tagged marker.

How long does a physical penetration test take?

Typically two to five days on site, preceded by one or two days of reconnaissance and followed by reporting, so around two to three weeks end to end for a single site. Multi-site programmes and after-hours testing extend that.

Do our employees need to know about the test?

Only a small group of trusted agents should know: the sponsor, one security lead and the signatory of the authorisation. Informing everyone would invalidate the results. In the Netherlands, check with counsel whether the works council should be informed or consulted.

What is the difference between a physical penetration test and a red team engagement?

A physical penetration test focuses on one vector, in-person access to premises and assets, over a few days. A red team engagement combines physical, social engineering and digital vectors over weeks to pursue a business objective against an uninformed defensive team. Physical testing is often one phase of a red team engagement.

What does the report include?

An executive summary, a timed attack narrative with redacted photographic evidence, findings rated by business impact, a section on controls that worked, and a prioritised remediation plan separating process changes from hardware changes. Individual employees are never named.

1 November 2026 · 10 min read · By Michael van Mameren, Lead Penetration Tester (OSCP)

Physical penetration testing: how a controlled intrusion tests your building, your people and your processes

A physical penetration test is an authorised attempt to enter your premises and reach the assets that matter, using the methods a real intruder would use: following an employee through a door, a confident story at reception, an unlocked comms room, a live network port in a meeting room. This guide explains what is tested, how an engagement is authorised and bounded, what it is not, and what you receive at the end.

Scope a physical or red team engagement

What a physical penetration test is

A physical penetration test is a controlled, written-authorised attempt to gain unauthorised physical access to an organisation's premises, and from there to the people, paper, devices and networks inside. Where a network penetration test asks whether an attacker can reach your systems over the internet, a physical test asks whether someone can simply walk to them. The tester plays a motivated outsider: a courier, a contractor, a new hire who forgot a badge, a visitor nobody escorted back out. The objective is agreed in advance and is almost always specific: a server room, a finance workstation, a boardroom network port, a stack of printed customer records.

The test evaluates three layers at once. The physical layer: fences, doors, locks, readers, cameras, alarm zones. The human layer: whether reception checks identity, whether staff challenge an unfamiliar face, whether anyone notices a propped door. The process layer: how badges are issued and revoked, how visitors are logged and escorted, how deliveries are handled, what a guard does with a letter at eleven in the evening. Most real intrusions succeed on the second and third layers while the first works exactly as designed.

Several frameworks name physical testing. DORA Article 25 lists physical security reviews among the tests in a financial entity's resilience programme. ISO 27001:2022 Annex A controls 7.1 to 7.4 cover physical security perimeters, physical entry, securing offices and facilities, and physical security monitoring, and an auditor accepts a test report as evidence that they operate. PCI DSS v4.0.1 Requirement 9 restricts physical access to cardholder data environments. NIS2 Article 21(2) requires access control policies and asset management, and a test is the simplest way to show the policy survives contact with a stranger in a hi-vis vest.

What a physical penetration test examines

An engagement is scoped to a subset of these, chosen around the assets you most need to protect. Each one tests a control, a behaviour and a process.

Perimeter and parking

Fences, gates, barriers, loading docks, smoking areas and the car park. Not whether a fence exists, but whether there is a path around it that staff use daily, and whether anyone watching the cameras would notice.

Reception, visitors and deliveries

Is identity checked against an expected visitor, or is a name and a company enough? Are visitors escorted, badged, logged and signed out? Do couriers and parcels pass reception unchecked and reach restricted floors unescorted?

Access control and badges

Badge issuance, revocation of leavers and contractors, zoning between public and restricted areas, propped or slow-closing doors, emergency exits used as entrances, and whether a missing badge is challenged.

Tailgating and challenge culture

Following an employee through a secured door is the most common entry method. The test measures how often it works, at which doors, at what times, and whether anyone speaks up. A challenge culture is a control; its absence is a finding.

Clean desk, print and paper

Unlocked screens, passwords on notes, reports left in printer trays, confidential waste in open bins, whiteboards with network diagrams. These often carry more business impact than the door that let the tester in.

Network ports and unattended devices

Live wall jacks in meeting rooms and lobbies, unattended laptops, unlocked docking stations, printers and conference systems on the corporate network. Is a device plugged into a spare port blocked, isolated or welcomed?

Server, comms and utility rooms

Where the racks, patch panels, switches and backup media live. Are these rooms a separate access zone, logged and alarmed? Is the key in a cabinet nearby, or with the cleaning contractor? Who would notice a person inside for twenty minutes?

After-hours, alarms and guard response

Evenings and weekends test alarm arming, guard tours, response time when a sensor trips, cleaning and maintenance access, and whether the person on duty follows the verification procedure when handed a story and a letter.

Scoping and authorisation: the paperwork that makes the test legal and safe

Entering premises without permission is a criminal offence. The authorisation package is what separates a physical penetration test from one, and it is drafted before anyone goes near the building.

1. The letter of authorisation

A signed letter from a person with authority to grant access to the premises (typically the CISO, facilities director or a board member) stating that the named testers may attempt entry to the listed addresses during the listed window. Every tester carries a copy plus identification, and the letter names two or three contacts reachable at any hour to confirm it. It is the document a guard or police officer reads when a tester is stopped, hence its nickname, the get-out-of-jail letter. It must survive that reading: specific addresses, dates, names and verifiable phone numbers.

2. Legal review

Counsel confirms who can authorise access to each building. In a leased or multi-tenant building the landlord and building security usually have to be informed and may need to co-sign. In the Netherlands, unauthorised entry to enclosed premises is an offence under the Dutch Criminal Code (huisvredebreuk, Article 138 Sr) and connecting to a network without permission is computer trespass (Article 138ab Sr); the authorisation removes the test from both. Counsel also reviews liability, insurance and confidentiality terms.

3. Works council and privacy

A physical test observes employee behaviour. In the Netherlands, check whether the works council (ondernemingsraad) must be informed or consulted under the Works Councils Act; many organisations inform it as good practice regardless. Under GDPR the test needs a lawful basis (normally legitimate interest), a short data-protection assessment and evidence rules: photographs show controls and locations, not faces; individual staff are never named; recordings are kept only as long as the engagement requires.

4. Exclusions

What the testers will not do and where they will not go: forcing or damaging any door, lock or window; entering hazardous areas such as plant rooms or laboratories; interfering with fire doors, alarms or life-safety systems; approaching named individuals or executive offices; impersonating police, emergency services or a regulator; removing anything from the premises. Written down, so the report can state they were respected.

5. Safety rules and the abort protocol

A stop word that ends the test immediately when either side speaks it. A tester who is challenged and asked to leave does so, shows the letter if needed and does not argue. The test pauses for a real incident, a medical emergency or a genuine intruder. Agreed hours, a maximum time inside restricted rooms, and a rule that nothing is ever disconnected or powered down.

6. Trusted agents and deconfliction

A very small group knows the test is happening: usually the sponsor, one security lead and the signatory of the letter, all reachable throughout. If you use a guarding contractor, their control room needs a sealed envelope or a named contact so an escalation is verified rather than ending in a police call. For after-hours testing, agree in advance how a tripped alarm is handled.

What a physical penetration test is not

Buyers sometimes expect a burglary, and staff sometimes fear a trap. It is neither. The rules of engagement exclude these in writing.

Not forced entry. Nothing is broken, cut, drilled or damaged. A control that holds is recorded as a control that works
Not theft. Reaching an asset is proven with a photograph, a timestamp or a small tagged marker collected afterwards, never by taking the asset
Not coercion. Testers may use a plausible pretext; they do not threaten, pressure, bribe or exploit a personal relationship to get a door opened
Not a test of individuals. The report describes which controls and processes failed and where; it never names the receptionist who held the door, and no audio or video of staff is kept beyond the agreed evidence rules
Not a hacking exercise in disguise. Plugging a device into a wall port to see whether it is blocked tests a physical control; attacking internal systems from there is a network or red team scope agreed separately
Not a demonstration of lock bypass or badge technology. Where such a weakness matters, the report states that the control can be defeated and recommends the fix; it does not teach the technique

Physical penetration test, social engineering test and red team: how they relate

The three overlap, and buyers often need a combination. The differences are in the vector, the objective and how much of the organisation knows.

Aspect	Physical penetration test	Social engineering test	Red team engagement
Primary question	Can someone reach our premises and assets in person?	Can someone manipulate our people remotely into giving access or information?	Can a realistic adversary achieve a business objective by any route without being stopped?
Vectors	Perimeter, doors, badges, tailgating, in-person pretexting, ports, rooms	Phishing, vishing, smishing, pretext calls, fake vendor contact	Physical, social, digital and supply-chain vectors combined
Typical duration	Two to five days on site, plus reconnaissance and reporting	One to three weeks of campaigns	Four to twelve weeks, longer for TIBER-style tests
Who knows	Sponsor and a few trusted agents	Sponsor and a few trusted agents	Sponsor and a white team; the defensive team is not informed
Typical output	Narrative, photographic evidence, process findings, prioritised fixes	Campaign statistics, examples, awareness and process findings	Attack narrative, MITRE ATT&CK mapping, detection gaps

Deliverables: what the report contains and how findings get fixed

The report opens with an executive summary that answers the sponsor's question plainly: did the testers reach the objective, how, how long it took, and who noticed. The core is an attack narrative with a timeline: reconnaissance, each approach attempted, which were stopped and by what, which succeeded and why, and the moment of detection if there was one. Every step is evidenced with timestamped, redacted photographs. A section on controls that worked is included deliberately; a receptionist who insisted on a callback or a guard who verified the letter are results the organisation should reinforce.

Findings are rated by the business consequence of what was reached, not by how clever the entry was. Standing in a lobby is not a finding. Standing in the comms room with a device on the network for twenty minutes undetected is a critical one. Each finding carries a prioritised remediation recommendation split into immediate, short-term and structural actions.

In our experience the fixes are mostly process, not hardware. A new reader on a door that staff still hold open changes nothing. What changes the outcome: a visitor process that is followed when reception is busy; a leaver process that revokes badges the same day; a culture in which asking a stranger for a badge is normal; network access control so an unknown device gets nothing; server-room access on a separate zone with a log that someone reads; a rehearsed guard verification procedure; and a short awareness session built around what actually happened in the building. Where hardware does matter, the report says so: a lock that can be defeated, a reader zone that leaks, a camera blind spot.

How to prepare for a physical penetration test

Preparation is what makes the engagement safe, legal and useful. Most of it happens in two or three conversations with your tester before the window opens.

Decide the objective: which rooms, assets or outcomes would hurt most if an outsider reached them
Identify who can authorise access to each address, including landlord and building security where premises are leased or shared
Agree the window: business hours, evenings, weekends or a mix, and whether reconnaissance may start earlier
Write the exclusions and safety rules, and confirm them with facilities and health and safety
Pick two or three trusted agents and align with your guarding contractor on how an escalation is verified without a police call
Involve legal counsel, the privacy officer and, where appropriate, the works council before the letter is signed
Decide in advance that the debrief is no-blame: staff who are named or disciplined afterwards will never challenge anyone again

How HackersHub runs physical testing

HackersHub has delivered offensive security engagements for over ten years from Amsterdam, Netherlands. Physical testing is run by the same team that performs our red team work, led by Michael van Mameren. Every tester holds at least OSCP, and the team includes OSWE and CREST-certified members. We scope physical testing as a stand-alone assessment or as the physical phase of a wider red team engagement, aligned with PTES and NIST SP 800-115, and we do not start without a complete authorisation package reviewed by your counsel.

You receive an executive summary, an evidenced attack narrative, findings prioritised by business impact and a remediation plan that distinguishes process from hardware. A verification retest of medium and higher findings within 90 days is included, so the process changes you make are confirmed, not assumed. Our clients rate us 4.9/5 across 127 reviews.

Frequently asked questions

Related guides and services

Want to know whether a stranger can reach your server room?

We scope physical testing around the assets you most need to protect, with a complete authorisation package and a report your facilities, security and HR teams can act on. Talk to an expert.

Scope a red team or physical test Talk to an expert