Your doors are run by computers. Most physical security firms don’t test them, and most cyber firms don’t look at them. We test both, usually as part of an access control assessment, or on their own.
Access control panels, camera and video management systems, intercoms and building management systems are computers on your network. We test how exposed they are, whether default passwords and old firmware are still in place, whether they are separated from the office and operations networks, and whether someone on the network could add a badge or open a door.
When someone leaves, their identity provider account is usually disabled the same day. Their badge often is not. We test the handoff between HR, the identity provider and the access control system at the reader, not on the spreadsheet.
Why a leaver’s badge still worksPhysical and logical access controls tested together and mapped to SOC 2 CC6.x and ISO 27001 Annex A.7, so the evidence holds up when your auditor looks. We are not your auditor and issue no attestation.
Physical controls testingNetwork tests against security systems are read-only unless agreed otherwise in writing.
We don’t run general network, application or cloud penetration tests. If you need one alongside a physical assessment, we’ll refer you to a specialist firm and coordinate the scope, so the two reports line up instead of overlapping.
Security firms that need the physical side covered for their own clients can work with us directly.
For companies that need someone to own security without a full-time hire: strategy, risk, audit preparation and board reporting, covering physical security as well as cyber.