A physical penetration test follows a structured process, much like a digital penetration test, but the target is the building rather than the network. This article walks through each phase: from scoping and planning through to execution, evidence collection, and reporting.
Phase 1: Scoping and pre-engagement
Every physical assessment begins with a conversation about what the client wants to achieve and what constraints apply.
Objectives. The client and the testing team agree on specific goals. These might include gaining access to a server room, reaching an executive floor, planting a simulated surveillance device, or simply demonstrating that the building can be entered without authorisation. Clear objectives ensure the test delivers actionable results rather than a generic pass/fail.
Rules of engagement. Physical tests carry risks that digital tests do not — the potential for confrontation, alarm activation, or even arrest. The rules of engagement define what techniques are permitted (lock picking, tailgating, social engineering), what areas are off-limits, and what times of day testing may occur. They also establish how the assessor should respond if challenged by security staff or police.
Authorisation letters. The assessor carries a letter of authorisation signed by someone with the authority to commission the test. This letter confirms that the assessor is acting lawfully and with permission. It includes emergency contact details for the client so that any misunderstandings can be resolved quickly.
Stakeholder awareness. Depending on the test type, the client may choose to inform certain stakeholders (such as the head of security) while keeping the broader workforce unaware. Fully covert tests — where only senior management knows — provide the most realistic results but require careful planning to avoid unnecessary alarm.
Phase 2: Reconnaissance
Before making any physical attempt, the assessor gathers as much information as possible about the target site.
Open-source intelligence (OSINT). Publicly available information can reveal a great deal: satellite imagery and street-level photography show building layouts, entry points, and external security measures. Job adverts may describe internal systems or security procedures. Social media posts from employees can reveal office layouts, badge designs, or even door codes visible in the background of photographs.
Physical observation. The assessor may visit the area around the target site to observe patterns: when staff arrive and leave, how deliveries are handled, whether fire exits are propped open, how visitors are processed at reception, and whether security patrols follow predictable routes.
Identifying entry points. From the reconnaissance data, the assessor identifies potential points of entry: main reception, side doors, fire exits, loading bays, underground car parks, roof access, shared building entrances, and any doors or windows that appear to be unsecured or poorly monitored.
Phase 3: Execution
With reconnaissance complete, the assessor makes their attempt. The specific techniques depend on the agreed rules of engagement and what reconnaissance has revealed.
Lock picking and bypass. Many commercial locks can be picked, bumped, or bypassed using specialist tools. This includes Euro cylinders, padlocks, and cabinet locks. Some doors can be opened using bypass tools inserted through the gap between the door and frame, or by manipulating the latch mechanism.
Electronic access control bypass. If the site uses RFID or NFC access badges, the assessor may attempt to clone a badge. This can be done using a concealed reader to capture badge data from a nearby employee, or by obtaining a badge through social engineering. Some older access control systems use unencrypted low-frequency cards that can be cloned in seconds.
Tailgating. One of the most reliable techniques. The assessor follows a legitimate employee through a controlled door, often by timing their approach to coincide with someone entering or leaving. Holding a box, carrying a coffee, or appearing to be on a phone call all reduce the likelihood of being challenged.
Pretexting. The assessor adopts a cover story to gain access legitimately — or at least without forcing entry. Common pretexts include posing as a contractor, IT support technician, courier, health and safety inspector, or a new employee on their first day. A convincing pretext, supported by appropriate clothing and props, can bypass even staffed reception desks.
Out-of-hours attempts. Some tests are conducted outside business hours, when buildings may be less actively monitored. The assessor tests whether external doors are properly secured, whether alarm systems are functioning, and whether security patrols are effective.
Objective completion. Once inside, the assessor works towards the agreed objectives. This might mean reaching the server room and photographing the racks, accessing an executive’s desk and placing a simulated device, or simply reaching a specific area of the building and documenting the route taken.
Phase 4: Evidence collection
Throughout the test, the assessor documents everything. This is critical — the report must provide enough detail for the client to understand exactly what happened, which controls failed, and why.
Evidence typically includes:
- Photographs and video of entry points, techniques used, and areas accessed.
- Timestamps for each stage of the attempt.
- Descriptions of each control encountered and whether it was effective.
- Details of any interactions with staff (if social engineering was used).
- Photographs of objectives reached (server rooms, executive areas, sensitive documents).
All evidence is handled securely and shared only with authorised stakeholders.
Phase 5: Reporting
The report is the primary deliverable. A good physical penetration test report includes:
Executive summary. A high-level overview of what was tested, what was achieved, and the overall security posture of the site. Written for senior stakeholders who need to understand the risk without reading every technical detail.
Methodology. A description of the techniques used and the approach taken, so the client understands how the results were achieved.
Detailed findings. Each finding is documented individually, with a description of the control tested, the technique used, the outcome, supporting evidence, and a risk rating. Findings might include: “The side fire exit on the ground floor could be opened from the outside using a bypass tool — no alarm was triggered.”
Remediation recommendations. For each finding, the report provides practical, prioritised recommendations. These are specific and actionable: not “improve physical security” but “replace the Euro cylinder on the ground floor fire exit with an anti-snap, anti-pick cylinder and connect the door to the intruder alarm system.”
Risk ratings. Findings are rated by severity to help the client prioritise remediation. A server room door that can be opened without a badge is a higher priority than a ground floor window that is difficult to reach.
What comes after
The report is typically followed by a debrief with the client’s security team, where the assessor walks through the findings and answers questions. Many clients also commission a retest after remediation to confirm that the issues identified have been resolved.
Physical penetration testing is most effective as a recurring activity — not a one-off exercise. Sites change, staff turn over, and new weaknesses emerge. Regular testing ensures that physical controls keep pace with the evolving threat.