Who can get through your doors, and who shouldn’t.
Your cyber team stops at the identity provider. Your integrator starts at the panel it sold you. Calibre assesses the layer in between.
Who can go where, and whether your systems enforce it.
A reader on the wall is not a control. We test whether the system behind it grants, updates and revokes access the way your policy says it does, in offices, data centers and colocation space.
Credentials
Reader and card technology in use — 125 kHz prox, MIFARE Classic, DESFire, SEOS — clone exposure, key management and what a migration would actually involve.
Read the guideDeprovisioning
The handoff between HR, the identity provider and the PACS. Leaver lists tested against the reader, not against the spreadsheet.
Read the guideEscort & contractor
Who walks in with whom, what is recorded at the time, and whether that record still means anything at an incident review six weeks later.
Tailgating & anti-passback
Mantraps, turnstiles, anti-passback logic, the loading dock, and the door everyone props at 07:40.
Cage & cabinet access
Separation inside colocation and shared facilities, down to the rack door — and the key that three companies share.
Read the guideChain of custody
Media handling, decommissioning and destruction witnessing, from the rack to the shredder.
Read the guide
What you receive
- On site in daylight and after dark, plus a review of your access records and vendor contracts
- Every finding prioritized, with a price range
- Findings name the technology to move to, not just the gap
- Written for the team that has to fix it
- A re-test once the fixes are in
- A fixed fee, agreed in writing before we start
- No referral fee or commission on anything we recommend
Each of these can be scoped on its own.
Physical security assessment
The whole facility, from the perimeter to the server-room door: entry points, camera coverage, guarding and visitor management.
Security strategy
Physical security policy, maturity benchmarking and incident response planning.
Compliance physical controls
Testing of the physical access controls in SOC 2 (CC6.4), ISO 27001 (A.7), PCI DSS (Req. 9), HIPAA (§164.310) and CMMC (PE) scope, with every finding mapped to the control it affects. We are not your auditor and issue no attestation.
Cybersecurity audit & assurance
Gap assessment, control testing and cloud security audits against ISO 27001, SOC 2, NIST CSF, PCI DSS and regional regulation worldwide, across AWS, Azure and Oracle Cloud.
For security firms
Physical penetration testing, social engineering and access control assessment delivered for pentest firms, MSSPs and vCISOs, white-label and under your rules of engagement.
Common questions.
Six areas, assessed on site in daylight and after dark: the reader and card technology actually in use and what it is exposed to; the deprovisioning handoff between HR, the identity provider and the access control system; escort and contractor workflow and what the record looks like weeks later; tailgating, anti-passback, mantraps, turnstiles and the loading dock; cage and cabinet separation in colocation and shared facilities; and chain of custody for media, decommissioning and destruction witnessing. We also review your access-control records and security vendor contracts. You receive one report: every finding prioritized, evidenced, and carrying a price range.
It is a fixed fee, quoted before any work starts — not a day rate, and not an hourly meter that runs while we are in your loading dock. The number depends on the number of sites, the size and type of each, and whether usable access-control records exist. You get the figure on the twenty-minute scoping call, in writing, with no obligation.
Yes. Where a finding calls for different technology we name it — the credential and reader class to move to, the configuration it needs, and a price range you can budget against — rather than leaving you with "upgrade your readers" and a procurement problem. We take no referral fee and no commission on anything we recommend, so a product appears in your report because it is the right answer to that finding and for no other reason. If you want, we will also review the quotes that come back.
About three weeks from the site visit to the report. What you receive is a prioritized list of findings, each with evidence, a remediation step and a price range, split into fixes that cost nothing, small spends, and items for next year’s budget — plus a walkthrough of the findings with your team if you want one. It is written for the people who have to fix it, not for a board summary that has to be decoded afterwards.
For most sites, every eighteen to twenty-four months, and sooner after anything that changes who holds a credential — an access-control replacement, a merger or acquisition, a management company change, a board turnover, or a build-out that puts contractors through the building for months. Controls decay quietly between reviews, which is usually how a portfolio ends up back where it started.
Yes, for the physical controls in scope — SOC 2 CC6.4, ISO/IEC 27001 Annex A.7, PCI DSS Requirement 9, HIPAA §164.310 and the CMMC Physical Protection family. We test whether those controls work on site, not just whether the policy exists, and map every finding to the control it affects so your team and your auditor can use it. We are not your auditor and issue no attestation or certification; the point is that nothing surprises you when the auditor looks.
Social engineering testing
Tailgating, pretexting and impersonation against reception, helpdesk and facilities staff, under written authorization.