We test how someone could get into your building, and into your systems.
Calibre is an independent security consultancy. We check badges, readers and access records on site, audit security controls and cloud setups against the standards you answer to, and write up every finding with a rough price to fix it.
- 1The door from the loading dock to the corridor is propped open for deliveries.
- 2The only corridor camera faces the lobby, not the dock.
- 3A copied staff badge opens the comms room.
Where the cyber team stops and the integrator starts.
Plenty of companies have spent years on their identity provider and their SOC. Then the data hall opens with a card format designed in the 1990s, and a badge that was switched off in the IdP still opens the door, because nobody checked that the access control system got the message.
Your security team usually stops at the identity provider. The integrator who installed the readers looks after the panel, and isn’t going to criticise hardware it sold you. That middle layer is the part we look at.
What the assessment covers
We spend time on site during the day and after dark, and we read your access control records and vendor contracts. These are the six things we look at:
Credentials
What your cards and readers actually are, and how easily they clone.
Deprovisioning
Whether a badge dies when the person leaves.
Escort & contractor
Who walks in with whom, and whether the record survives.
Tailgating & anti-passback
Mantraps, turnstiles, the loading dock, the propped door.
Cage & cabinet
Separation inside shared and colocation space, down to the rack.
Chain of custody
Media from the rack to the shredder.
What a finding looks like
Every finding is ranked and comes with a rough price and the product or setting to move to. The example here is written from the technology, not from a client.
The fee is fixed and agreed in writing before we start, and we don’t take commission on anything we recommend.
Site badges readable and writable with off-the-shelf hardware
The credentials in use at rely on a technology with no mutual authentication between card and reader. A working duplicate was produced from a badge presented in the lobby, in under two minutes, with a handheld tool that costs a few hundred dollars.
How an engagement runs, from first call to re-test.
1. Scoping callFree
About twenty minutes on the phone or video. We ask about your sites and what prompted the call, and tell you whether an assessment makes sense.
2. Assessment
We visit during the day and after dark. Where you have authorized it in writing, we actually try the doors rather than just reading the policy.
3. Report and re-test
A written report your facilities and IT teams can work from. Once the fixes are in, we come back and check them.
Short videos on security
Guillem explains how attacks actually work, physical and online, and what to do about them.
Scammy websites and fake malware popups are everywhere… but are they real?
I asked an AI chatbot to write a phishing email
What is phishing?