Coverage note
Physical penetration testing: doors, badges and procedures, with authorisation
Physical penetration testing asks whether an unauthorised person could reach somewhere they should not. So it tests doors, badges and reception procedures, under a signed authorisation letter that the tester carries on site.
- Manual exploit chains
- PTES and the OWASP testing guide
- Authorised scope only
What physical penetration testing covers
The scope is agreed with the building owner and the tenant before anyone visits. Therefore every site, area and time window is listed in writing.
- Entry points, doors and their locks
- Badge and visitor procedures
- Reception and delivery handling
- Access to network points and server rooms
Why physical penetration testing needs extra paperwork
A physical test can look like a real intrusion to staff and to police. So the paperwork is stricter than for a network test.
| Document | Why it matters | Who signs |
|---|---|---|
| Authorisation letter | Proves the visit is approved. | The owner and the tenant. |
| Out-of-hours contacts | Lets anyone verify the letter. | Named senior staff. |
| Rules of engagement | Sets what is not allowed. | The system owner. |
Before physical penetration testing
Tick what is true. Every item must be settled before a site visit.
Your result appears here as you tick, so you can see what is still open.
Safety during physical penetration testing
Staff safety comes first. For example, no force, no damage and no confrontation are standing rules. In addition, the tester stops immediately if challenged and shows the letter. Then the named contacts confirm the visit.
What the site report shows
You receive each gap with evidence, the time it was found and a clear fix. Also, procedure gaps are reported without naming individual staff, because the aim is better process rather than blame.
Fees and fit
Full engagements run from $35,000 to $120,000, while the floor is $25,000. Also, the bounded Attack Surface Diagnostic starts at $4,500. Moreover, its fee is credited in full against a full engagement commissioned within ninety days. Physical work is often combined with an internal network test, because a network point in a meeting room is a common gap.
Physical penetration testing questions
Is physical penetration testing legal?
Yes, with a signed authorisation letter from the owner and a clear scope.
What happens if the tester is challenged?
The tester stops, shows the letter and the named contacts confirm the visit.
Does physical penetration testing damage property?
No. Force and damage are excluded by the rules of engagement.
Are staff named in the report?
No. Gaps are reported as procedure issues, not individual failures.
Related guides
Scope physical penetration testing
List the sites and what you want to protect. The penetration hacker who would lead the work replies with a draft authorisation letter, a written scope and one fixed fee.
Send the brief