Real attacks. Real risks. Real evidence.

While a security walkthrough often just checks off a visual list, a Physical Pentest is an active, adversarial attack simulation process. We use the same tactics as criminal actors or corporate spies.

The process follows the OSSTMM standard: After a passive phase (reconnaissance), where we analyze shift schedules, supplier frequencies, and technical barriers like RFID reader types, we move into active infiltration attempts. We rely on a combination of Social Engineering (pretexting as a service provider), technical bypasses (e.g., overriding request-to-exit sensors), and hardware attacks (RFID cloning via Proxmark3). The goal is to reach critical assets like server racks or executive offices to map out the actual business impact chain, not just to “get in.”

Knowing about a vulnerability is no protection against liability. On the contrary: documented but ignored risks can be interpreted as gross negligence in the event of a security breach. A professional physical pentest transforms your “gut feeling” into reliable data.

We quantify the risk: How long does it take an attacker to reach the core switch? Which detection mechanisms fail? Using our risk rating (based on CVSS-like metrics for physical assets), we prioritize actions. Often, it's not expensive new fences but simple process changes at reception or technical adjustments to existing doors that eliminate 80% of the risks. A pentest provides you with the economic justification for security investments to your management.

Safety and legality are our top priorities. Before every test, we create a “Letter of Authorization” (Get-out-of-jail-free card), which defines the scope, authorized persons, and emergency contacts. Our pentesters carry this document and official IDs at all times.

Additionally, we clarify the Rules of Engagement (RoE) beforehand: Which areas are off-limits? What are the escalation levels? We work on the principle of minimal disruption. If an employee discovers us, the situation is immediately de-escalated and counted as a “success of awareness.” We identify systemic vulnerabilities in the organization this way, without compromising workplace peace or the physical integrity of individuals and without shaming your team.

Physical security and IT security are inextricably linked. Many companies still rely on outdated RFID technologies like 125 kHz transponders (EM4102) or MIFARE Classic. These are technically broken and can be cloned within milliseconds using mobile devices like the Flipper Zero or hidden readers.

As part of the pentest, we check whether your access control systems are protected against replay attacks or card emulation. We demonstrate realistic scenarios where we gain unauthorized access by cloning an employee's badge. This is often an eye-opener for the IT department, as a compromised physical badge frequently provides a direct path into secured IT zones.

You will receive a comprehensive, audit-ready report. This includes a management summary for C-level executives as well as a detailed technical analysis for security officers. Every vulnerability found is documented with photo evidence and timestamps and categorized by criticality.

Especially regarding the NIS2 Directive and ISO 27001 (Annex A.7), our reporting provides the necessary proof of the effectiveness of your physical controls. Beyond the problems themselves, we provide concrete remediation roadmaps. This allows you to prove to auditors that you are engaged in proactive risk management and adhering to the state of the art in securing your critical infrastructure.

Social engineering is the most effective lever in physical pentesting. We use psychological triggers like authority, helpfulness, or time pressure (pretexting). For example, our testers appear as external maintenance technicians, fire safety officers, or couriers.

We test your process stability: Does the reception ask for ID? Are visitors escorted? Are doors held open for the “colleague” (tailgating)? This part of the test is essential to check the security awareness of your team under real conditions. The results are incorporated into recommendations for awareness training, as technical barriers are worthless if they can be bypassed by human factors.

A physical intruder has one goal: data. If we succeed in accessing server rooms, we often deploy rogue devices. These are modified microcomputers (e.g., LAN turtles or dropboxes) that we hide behind printers or under desks.

These devices build an encrypted reverse VPN tunnel to our lab, allowing us permanent access to your internal network—bypassing any firewall. We test how long this hardware remains undetected and whether your network access control (NAC/802.1X) blocks such devices. A physical pentest would be incomplete without checking for hardware implants, as this is the primary method for modern industrial espionage.

Absolutely. A realistic attacker chooses the time of least resistance. We often conduct tests during off-hours, at night, or on weekends to check the alertness of security guards and the effectiveness of intruder alarm systems and video surveillance (CCTV).

In doing so, we analyze your reaction times: Does the alarm center respond? Does security arrive on-site in time? Are there blind spots in the surveillance? These flexible timing scenarios ensure that your physical protection measures work 24/7 and not just during core business hours when the building is busy anyway.