Physical Penetration Testing Offices, headquarters, plants, warehouses and data centers, tested in person under signed authorization

01Definition

What is physical penetration testing?

Physical penetration testing answers a simple question: could someone who has no right to be in your building get in, reach something valuable and leave without being stopped? The tester plays the part of an intruder, a dishonest contractor or an opportunist, and tries the routes those people would try. Some routes are technical, such as copying an access badge or defeating a door sensor. Most are human: following an employee through a door, walking confidently past reception, or presenting a plausible reason to be in a restricted area.

The exercise differs from a security audit or site survey. A survey records what controls exist: cameras, card readers, fences, guard posts, visitor procedures. A test checks whether those controls work when someone actually tries to get past them, at real times of day, with real staff on duty. Many buildings look well protected on a floor plan and are easy to enter in practice because a side door is propped open for smokers, a loading bay is unattended at shift change, or a guard does not check the photograph on a badge.

The results are useful well beyond the security team. Facilities managers learn which doors and readers need attention. HR and training teams learn how staff respond to strangers. Legal and compliance teams get evidence for auditors and insurers. Leadership gets a realistic picture of how exposed the organization is to theft, sabotage, espionage and the planting of devices on its networks.

02Who tests

Who carries out Delator's physical security testing, and with what authority?

Physical testing is not private investigation work. Delator does not refer it to investigators in its network; it sends its own consultants. The people who do this work bring backgrounds that suit it: former law enforcement officers of many kinds, consultants with U.S. military intelligence and Department of Homeland Security experience, former bail enforcement agents who spent careers getting into places and finding people who did not want to be found, and technology specialists who understand access control systems, alarms and networked building systems.

Every engagement starts with a written authorization signed by someone who has authority over the premises. For a building the client owns outright, that is usually a senior executive. For leased space, shared office buildings, business parks and colocation data centers, the landlord, building manager or facility operator often controls the lobby, the shared doors, the guards and the alarm system. Their written consent is needed for those areas, or they are taken out of scope. Delator does not test any area based on the say-so of someone who cannot authorize access to it.

Each tester carries an authorization letter on site, often called a get-out-of-jail letter. It identifies the tester, states that the work is authorized, lists the scope and dates, and gives contacts at the client who can verify the letter at any hour. If a tester is challenged by staff, guards or police, the letter and the verification contacts resolve the situation quickly.

Background checks on guards, contractors or staff

Clients sometimes ask for background checks on security officers, cleaning contractors or staff with high levels of access as part of a site review. Delator leverages a locally licensed partner in its network to complete that work and does not do it itself. The physical testing stays with Delator's consultants.

03Sites

Facilities covered: offices, industrial sites, warehouses and data centers

Each type of facility has its own pattern of weaknesses. An office is busy, friendly and full of visitors. A plant has contractors, shift changes and wide perimeters. A warehouse has trucks, yards and dock doors. A data center has layered controls that are only as strong as the procedures around them. Delator plans each test around the risks that matter for that kind of site.

04Reconnaissance

Planning and reconnaissance before anyone approaches the building

A real intruder does homework, and so does a tester. Before visiting a site, Delator's consultants review what any outsider can learn: satellite and street imagery, public photographs of the building, staff posts on social media showing badges or interiors, job advertisements naming security vendors, delivery and contractor patterns, and the opening hours of shared areas. That research shapes the plan and often reveals easy routes, such as a photo of a staff badge that can be used to create a convincing copy.

Reconnaissance on the ground follows. Testers observe the site from public places at different times to understand shift patterns, smoking areas, delivery windows, guard patrols and how staff behave at entrances. They note which doors are used, which are alarmed, where cameras point and where they do not. All observation stays within what local law allows; testers do not enter private property outside the authorized scope and do not record people in ways that local privacy rules prohibit.

The plan that comes out of this phase sets out the scenarios to be attempted, the order, the agreed fall-back if a tester is challenged, and the objectives that count as success. Objectives are concrete and harmless: photograph a server rack, place a marked card on an executive's desk, connect a supplied test device to a network port, or reach a control room door.

• Open-source review of imagery, social media and public records about the site
• Observation of entrances, shifts, deliveries and guard patterns from public areas
• Identification of badge designs, lanyards and uniforms visible in public
• Agreed objectives that prove access without causing harm
• Scenario list approved by the client before entry attempts

05Access control

Access control and badge cloning assessment

Electronic access control is usually the backbone of building security, and it is often weaker than it appears. Many organizations still use older low-frequency proximity cards, which transmit a fixed number that can be read from a short distance and copied onto a blank card with inexpensive equipment. Some higher-frequency card families also have known weaknesses, particularly older smart card types whose security was broken publicly years ago. Physical penetration testing checks which technologies are in use and whether they can be copied in the client's environment.

A badge cloning assessment is carried out within strict limits. Testers only read cards with the consent arrangements written into the authorization, typically using cards issued to them by the client for the test, or volunteers who have agreed in advance. The aim is to show whether a copy works on the client's readers, not to collect staff credentials. Any card data captured is handled as evidence and destroyed at the end of the engagement.

Beyond the cards themselves, testers look at the readers and the system around them. Readers mounted outside the building may be opened or tampered with. Doors may unlock on request-to-exit sensors that can be triggered from outside. Turnstiles may allow two people through on one badge. PIN pads may show wear on the digits in use. Access rights may never be removed when staff leave. Each of these is tested and reported with photographs and recommended fixes.

Access control questions the test answers

• Can the cards in use be read and copied, and do copies open doors?
• Do turnstiles and speed gates stop a second person following on one badge?
• Can doors be opened from outside by triggering exit sensors or defeating latches?
• Are mantraps and interlocks used as designed or held open for convenience?
• Does the system alert anyone when doors are forced or held open?
• Are access rights reviewed and removed when people leave or change roles?

06People

Tailgating, reception and visitor management

The most reliable way into most buildings is to walk in behind someone who has a badge. Staff hold doors out of politeness, and few people feel comfortable asking a well-dressed stranger carrying coffee or a box to show a pass. Tailgating tests measure how often that happens at each entrance, at which times, and whether anyone challenges the tester once inside. The findings feed directly into training and into decisions about turnstiles, door hardware and signage.

Reception and visitor processes are tested with pretexts approved in advance by the client. A tester may arrive as a contractor, a job candidate, an auditor, a courier or a visitor for a named employee. The test looks at whether identity is checked, whether the host is called before a pass is issued, whether visitors are escorted, and whether visitor badges are collected at the end of the day. In shared buildings, testers also check whether a visitor to another tenant can reach the client's floors.

These tests involve real staff, so they are designed with care. Pretexts avoid anything that could cause distress, such as claiming an emergency or impersonating police or emergency services. Individual employees are not named in reports unless the client specifically requests and lawfully may receive that detail; findings describe behaviours and processes so the organization can improve without blaming individuals. In countries with works councils or strong employee privacy rules, the client may need to consult employee representatives before the test.

• Tailgating attempts at main, side and staff-only entrances
• Visitor pretexts approved in writing before the test
• Checks on identity verification, host confirmation and escorting
• Assessment of whether staff challenge unknown people inside
• Reporting by process and location, not by individual employee

07Locks and alarms

Locks, doors and intruder alarm testing

Mechanical security still matters. Many breaches of physical security come not from sophisticated lock picking but from simple weaknesses: latches that can be slipped with a thin tool, doors that do not close fully, hinges on the outside, gaps that allow an exit button to be reached, keys held in unlocked cabinets, and master keys that have been copied over the years. Testers examine doors, frames, locks and key control, and attempt bypass techniques that the client has authorized.

Lock picking and bypass tools are regulated differently in different countries, and some techniques may be unsuitable for a given site. During scoping, Delator agrees which techniques are permitted, which doors may be worked on, and which are off limits. No door, lock or frame is damaged beyond agreed limits, and anything that might leave a mark is discussed in advance. If a technique is not lawful or not appropriate where the site is located, it is left out.

Intruder alarms and monitoring are tested by checking whether alarmed doors actually trigger, whether sensors cover the areas they are meant to, whether alarms out of hours reach the monitoring center and whether anyone responds in a reasonable time. Delator coordinates these tests with the client and the monitoring company where needed, so that police are not dispatched against testers unless the client wants to test the full response chain and has arranged it with the right parties.

• Door hardware, frames, closers and hinges
• Latch slipping and exit sensor bypass where authorized
• Key control, master key systems and key cabinets
• Alarm triggering, coverage and monitoring response
• CCTV coverage, blind spots and recording retention

08Guarding

Guard procedures and security operations

Guards are only as effective as their instructions, training and supervision. Physical penetration testing looks at how the guard force actually behaves: whether officers check badges against faces, whether patrols follow predictable routes, whether the control room watches the cameras, whether guards leave posts unattended, and what happens when an officer finds someone where they should not be. Testers compare what they observe with the written post orders.

Challenge and escalation are particularly important. If a guard stops a tester, does the guard verify identity, call a supervisor, escort the person off site and record the incident? Or does a confident explanation end the conversation? Delator agrees in advance how testers will respond to a challenge, usually by complying and, where the scenario calls for it, presenting the authorization letter. The aim is to measure the process, not to argue with staff.

Where guarding is outsourced, the contract and service levels often matter as much as the officers on duty. Findings may point to gaps in the contract, such as no requirement to patrol a particular area, as well as to training needs. Reports are written so the client can raise them with the guarding provider constructively.

09Data centers

Data center and server room physical security testing

A data center combines several layers of control: perimeter fencing, vehicle barriers, guarded reception, mantraps, biometric readers, cages, locked racks and cameras. Each layer is usually strong on its own. Weaknesses appear in the procedures that connect them: escort rules that are relaxed for familiar contractors, delivery processes that let equipment and people in through a loading bay, shared colocation areas where one tenant can reach another's cage, or emergency exits that are not alarmed.

For companies that run their own server rooms inside offices, the picture is often simpler and weaker: a door with a standard lock in a corridor, a key held by reception, network cabinets in open areas or in storage rooms that also hold cleaning supplies. These rooms often hold the most sensitive equipment the organization owns, and testers check how hard it is to reach them.

Standards give useful reference points. ISO/IEC 27001:2022 includes a group of physical controls in Annex A covering security perimeters, physical entry, protection of offices and rooms, physical security monitoring and equipment security. PCI DSS requirement 9 covers restriction of physical access to cardholder data. Customers who audit colocation providers often look for evidence that these controls have been tested, not just documented, and a physical test provides that evidence.

• Perimeter, vehicle and loading bay controls
• Reception, identity checks and escort procedures
• Mantraps, interlocks and biometric readers
• Cage and rack security in shared areas
• Delivery, decommissioning and media disposal procedures

10Legal and safety

Authorization, local law and safety rules for physical penetration testing abroad

Physical security testing involves entering premises without the knowledge of most people present, which is why authorization and safety rules are non-negotiable. Delator's testing is always carried out within a signed authorization, with the authorization letter carried by testers, no harm to people and no damage beyond agreed limits. Testers do not carry weapons, do not use force, do not climb where a fall could cause injury unless specifically agreed with safety measures, and stand down immediately when the agreed stop conditions are met.

Local rules matter. Some countries treat certain physical security work, such as guarding, security surveys or the installation and testing of security systems, as a licensed security service. Laws on trespass, possession of lock tools, recording of people and use of uniforms or identification also differ. During scoping, Delator checks the rules that apply where the site is located and adjusts the plan accordingly. If part of the planned work requires a local licence, the work is either restructured, handled through appropriately licensed local arrangements or left out of scope.

Clients also decide how widely the test is known inside the organization. A small group, usually including a senior executive and the head of security, knows the dates and can verify testers at any hour. Some clients brief the local police or the building's guarding provider in advance; others keep the test unannounced and rely on the authorization letter and verification contacts. The approach is agreed in writing before testing.

Safety and conduct rules on every engagement

• No physical contact with or harm to any person
• No damage to property beyond limits agreed in writing
• No impersonation of police, emergency services or government officials
• Immediate compliance with any challenge from staff, guards or police
• Stop conditions defined in advance, including safety concerns and medical emergencies
• Authorization letter and 24-hour verification contacts carried at all times

11Combined testing

Combining physical entry with cyber testing

Physical access and network access are closely linked. Once inside a building, an intruder can plug a small device into a network port, connect to an unattended workstation, photograph documents, or take a laptop. Many organizations invest heavily in perimeter cyber defences while leaving open network ports in meeting rooms and reception areas. A combined test checks both sides together.

In a combined engagement, Delator's physical testers attempt to reach agreed points inside the building and connect a supplied, clearly marked test device. Delator's cyber testers then attempt to use that device to reach internal systems, within the same written authorization. This shows whether network access control, port security and monitoring detect a rogue device, and how far an attacker could go from it. The device is removed at the end of the engagement and its logs are handed to the client.

Combined testing also covers unattended workstations, printers and multifunction devices that store scanned documents, wireless networks reachable from public areas, and the handling of confidential paper waste. The report connects the physical and technical findings so the client can see the full path an intruder would take.

• Rogue device placement on open network ports
• Unlocked workstations and unattended laptops
• Printers, scanners and document stores
• Wireless networks reachable from lobbies and car parks
• Confidential waste and document handling

12Multi-site programmes

Running physical penetration testing across several countries

Groups with sites in many countries rarely need every location tested every year. A sensible programme of physical penetration testing starts with a risk ranking: which sites hold the most valuable assets, which have had incidents, which have recently opened or changed, and which connect most directly to group networks. High-risk sites are tested in depth, and lower-risk sites receive lighter checks or a rotation over several years.

Consistency is what makes a multi-country programme useful. Delator uses the same scenario library, the same control-layer structure and the same rating approach at every site, adapted to local law and culture. A headquarters in London, a plant in Poland and a warehouse in Mexico can then be compared directly, and group security can see whether a policy is failing everywhere or only in one place. Local differences, such as a country where visitor registration is handled by a building operator, are recorded rather than hidden.

Scheduling also matters. Physical penetration testing at a site is most informative under ordinary operating conditions, so Delator avoids local holidays, audits and major events unless the client specifically wants to test those periods. For clients in several time zones, a single engagement lead coordinates dates, authorizations and verification contacts so that every tester on every site has someone reachable who can confirm the work.

• Risk ranking of sites by asset value, incident history and network connectivity
• One scenario library and rating method applied across all countries
• Local legal and cultural adjustments recorded per site
• Group-level summary showing patterns and outliers
• Rotation plan for lower-risk sites over several years

13Reporting

Findings, photographs and remediation advice

The report for a physical test is a narrative as much as a list. It describes each scenario attempted, what happened, where controls worked and where they failed, supported by time-stamped photographs and notes. Leadership readers see the overall picture: which objectives were reached, how quickly, and what that means for the organization. Facilities, security and HR teams see the specific doors, readers, procedures and training needs involved.

Recommendations are practical and proportionate. Some fixes are inexpensive and immediate: adjusting a door closer, moving a camera, changing a reception procedure, removing access for former staff. Others involve investment, such as replacing an outdated card technology or adding turnstiles. Delator explains the risk each one addresses so the client can prioritize. For multi-site clients, findings are grouped to show patterns across countries as well as site-specific issues.

After changes are made, a follow-up visit can confirm whether they work. Fixes to physical security often fail in quiet ways: a new turnstile is installed but a side gate stays open for deliveries, a reception procedure is rewritten but temporary staff are never trained on it, or a card technology is upgraded at the main entrance while older readers remain on internal doors. A retest is often shorter than the original engagement because it targets the specific weaknesses identified, and it gives auditors and leadership evidence that the problems have been addressed.

Step by step

How an Engagement Works

1. 01

   Scoping

   Delator discusses the sites, risks, objectives and any landlord or operator involvement, and checks local rules for each country.

2. 02

   Authorization

   The premises owner and any third parties controlling shared areas sign the authorization, rules of engagement and stop conditions.

3. 03

   Reconnaissance

   Consultants review public information and observe the site from public areas to plan realistic scenarios.

4. 04

   Scenario approval

   The client approves the scenarios, pretexts and objectives in writing before any entry attempts.

5. 05

   On-site testing

   Delator's testers carry out the scenarios, carrying the authorization letter and keeping verification contacts informed.

6. 06

   Hot debrief

   Urgent issues, such as an unlocked server room, are reported to the client the same day.

7. 07

   Report and debrief

   The client receives the narrative report, photographs and recommendations, followed by a debrief with leadership and site teams.

8. 08

   Follow-up

   An optional retest confirms whether fixes work in practice.

Deliverables

What You Receive

• Signed authorization, rules of engagement and stop conditions for each site
• Authorization letters for every tester, with verification contacts
• Scenario plan approved by the client before testing
• Narrative report of each scenario with time-stamped photographs
• Findings organized by control layer: perimeter, entry, access control, locks, alarms, guarding
• Prioritized remediation recommendations with cost and effort context
• Debrief for leadership, security, facilities and HR teams
• Optional retest report confirming fixes

Industries

Who Uses Physical penetration testing Services

• Technology and data center operatorsCustomers and auditors expect evidence that physical controls around servers and networks actually work.
• Manufacturing and industrialPlants with contractors, shift work and wide perimeters need physical penetration testing that reflects real operating conditions.
• Logistics and warehousingDock doors, yards and high-value stock create theft and diversion risks that walk-in testing exposes.
• Financial servicesBranches, trading floors and back offices hold cash, data and systems that regulators expect to be protected.
• Pharmaceutical and life sciencesLaboratories, controlled substances and research data require strict and verifiable access control.
• Energy and utilitiesControl rooms and substations combine safety and security concerns where unauthorized access has serious consequences.
• Corporate headquartersExecutive floors, boardrooms and IT rooms attract espionage and are often less protected than staff assume.

Credentials

Who Does the Work

Delator Global's consultants come from backgrounds where finding facts under pressure is the job: U.S. military intelligence, the Department of Homeland Security, former law enforcement officers of every kind, former bounty hunters, and technology specialists across networks, applications, forensics and data. Behind them sits a network of locally licensed partners holding a wide range of licences and certifications, so every part of an engagement is done by someone entitled to do it in that country.

• Military intelligenceCollection planning, analysis and reporting discipline.
• Homeland securityFederal investigative and border, trade and financial crime experience.
• Law enforcementInterviewing, evidence handling and courtroom testimony.
• Bail enforcementLocating people who do not want to be found, lawfully.
• TechnologyNetwork, application, cloud and forensic specialists.
• Licensed partnersLocal licences for the work local law reserves.

Related services

Related Delator Global Services

• Penetration testingInternational Penetration TestingDelator Global provides international penetration testing for companies whose systems, offices and data sit in more than one country.
• Penetration testingSocial Engineering Testing and Red Team ExercisesDelator Global runs social engineering testing and red team exercises for organizations that want to know how their people, processes and defences hold up against a determined attacker.
• ConsultingInternational Security ConsultingDelator Global provides international security consulting to general counsel, CFOs, CISOs and compliance leaders who need practical advice on risks that cross borders.
• CorporateInsider Threat InvestigationsInsider threat investigations examine what happens when someone with legitimate access, an employee, contractor, partner or former staff member, uses it to take data, steal trade secrets, commit fraud or cause harm.

Every Delator Global service

Countries

Where Delator Global Works

Delator Global handles matters in 152 countries, with a country page for each and a city page for every city over 200,000 people. Larger markets are listed below; the full list is on the international page.

• United Kingdom
• Canada
• Mexico
• Germany
• France
• India
• Brazil
• Australia
• Japan
• United Arab Emirates
• South Africa
• Nigeria
• China
• South Korea
• Spain
• Italy
• Netherlands
• Poland
• Turkey
• Philippines
• All 152 countries