Physical penetration testing and social engineering
A physical penetration test is an authorized attempt to get into your building and reach something that matters: the server room, an executive’s office, a network port. We use the methods a real intruder would, tailgating, cloned badges, a convincing pretext, a door that does not latch, under written authorization, and tell you exactly how we got in and how to stop the next person.
Who it is for
- Organizations that want evidence, not assumptions, about who can walk in.
- Security teams that need a realistic test to justify investment in access control or guarding.
- Companies whose SOC 2, ISO 27001 or customer requirements call for physical testing.
- Teams pairing a physical test with a network penetration test.
What we assess
- Reconnaissance: what your website, social media and the street tell an intruder about your building and staff.
- Tailgating and pretexting at reception, side doors and the loading dock.
- Badge cloning: 125 kHz prox and MIFARE Classic cards copied at a distance. See can prox cards be cloned?
- Door and lock bypass: request-to-exit sensors, latches, gaps and propped doors.
- Agreed objectives once inside: a room, a document, or a device on the network.
- Phone and email pretexting against the helpdesk and facilities, where in scope.
What you receive
- A timeline of the test with photographs: every attempt, what worked and what stopped us.
- Each finding with the fix, ranked, with a price range.
- A debrief for staff that focuses on process, not on individuals.
- A re-test once the fixes are in.
Every engagement has a fixed fee agreed in writing before we start, and we take no referral fee or commission on any product we recommend. Typically one to three days of testing per site, after a planning period to agree objectives, authorization and emergency contacts. Report within two weeks.
Common questions
Is this legal?
Yes, when the people entitled to authorize it do so in writing. We agree scope, objectives and emergency contacts in advance, carry an authorization letter throughout, and get the landlord’s consent where you do not own the building. See how a physical test works.
Will our staff be named in the report?
No. Findings are about processes and controls, not individuals. The person who held the door was following a culture, not breaking a rule nobody taught them.
What if we catch you?
That is a good result. We document how and when we were stopped, so you know which controls work, then show the authorization letter and stop.
Book a scoping call
Tell us what is in scope and any deadline. You get a fixed-fee proposal in writing before any work starts, and a mutual NDA before you share anything sensitive.
Physical penetration testing
We reply within one business day.
Nothing you send is shared outside Calibre.