Most organisations spend heavily on firewalls, endpoint detection, and security operations centres. Far fewer apply the same rigour to the doors, locks, and access controls that protect the buildings where their people and data actually sit. Physical security testing exists to close that gap.
The assumption gap
It is common for organisations to assume that physical security is someone else’s problem — facilities management, building security, or the landlord. The result is that physical controls are rarely tested with the same discipline applied to networks and applications.
This creates an assumption gap: the belief that because a building has locks, cameras, and access badges, it must be secure. In practice, these controls are often weaker than they appear. Locks can be picked. Badges can be cloned. Cameras can have blind spots. Reception staff can be talked past.
A physical security test is designed to find out what actually happens when someone tries to get in.
What is at stake
The consequences of a physical breach extend well beyond stolen laptops. Consider these scenarios:
Direct access to systems. An attacker who reaches an unlocked workstation or a server room can install a hardware keylogger, plug in a rogue device, or exfiltrate data directly. No amount of network segmentation helps if someone is physically plugged into the switch.
Theft of equipment and materials. For organisations that handle high-value goods, sensitive documents, or intellectual property, physical access is the shortest route to theft. A determined attacker does not need to bypass encryption if they can walk out with the hard drive.
Planting surveillance devices. A small, inexpensive device hidden under a desk or inside a meeting room can capture audio, video, or keystrokes for weeks before anyone notices.
Bypassing all digital controls. The most sophisticated security operations centre in the world cannot detect an attacker who is physically inside the building, sitting at a trusted terminal, using legitimate credentials harvested from a keylogger installed during a previous visit.
What a physical security test involves
A professional physical security assessment is not a single technique — it is a structured engagement that tests multiple layers of control. Depending on the scope agreed with the client, this might include:
Reconnaissance. Before any attempt is made, the assessor gathers information about the target site. This includes satellite and street-level imagery, publicly available floor plans, social media posts from employees, and observations from site visits during normal operating hours.
Covert entry attempts. The assessor attempts to gain unauthorised access using techniques such as lock picking, lock bypass tools, manipulation of door hardware, and exploitation of poorly secured entry points (fire exits, loading bays, roof access).
Access control bypass. If the site uses electronic access controls (RFID badges, key fobs, PIN pads), the assessor will test whether these can be cloned, bypassed, or circumvented through tailgating.
Social engineering. In many cases, the easiest way past a locked door is to convince someone to open it. Assessors may use pretexts such as posing as a contractor, delivery driver, or IT support technician to gain access during business hours.
Objective completion. Once inside, the assessor works towards agreed objectives: reaching the server room, accessing a specific floor, planting a simulated device, or demonstrating that sensitive areas can be reached without challenge.
Evidence collection. Everything is documented — photographs, video, timestamps, and descriptions of each technique used and each control that failed. This evidence forms the basis of the report.
How findings become remediation
The value of a physical security test is not in demonstrating that entry is possible — it is in identifying exactly which controls failed and why. A well-structured report will detail:
- Each point of entry or attempted entry, with the technique used and the outcome.
- Which controls were in place and whether they functioned as expected.
- Which controls were absent or inadequate.
- Risk-rated findings with practical remediation recommendations.
Remediation might range from replacing easily defeated locks to implementing multi-factor physical access controls, improving CCTV coverage, introducing visitor management procedures, or training reception and security staff to challenge unfamiliar individuals.
When to commission a physical security test
There is no single right frequency — it depends on the organisation’s risk profile. Common triggers include:
- New or refurbished premises. Before occupying a new site, testing confirms that physical controls meet the organisation’s security requirements.
- Post-incident. If a physical breach or attempted breach has occurred, testing identifies whether the weakness has been addressed and whether others remain.
- Regulatory or contractual requirements. Some sectors and frameworks require or strongly recommend physical security assessments, particularly where sensitive data or critical infrastructure is involved.
- As part of a broader security programme. Organisations with mature security functions include physical testing alongside penetration testing and red teaming to ensure all attack surfaces are covered.
- Annually or as needed. For most organisations, an annual physical assessment — supplemented by ad-hoc testing after significant changes — provides a reasonable baseline.
Physical security is part of the picture
No security programme is complete if it only addresses digital threats. Physical security testing provides the evidence needed to understand whether your premises are as secure as you assume — and to fix the gaps before someone else finds them.