Physical Security Assessment

With your authorisation and under carefully agreed Rules of Engagement, we attempt to enter your premises as a determined intruder would. There are a number of ways in which an attacker could get in, and which we can test.

• Tailgating. Following behind a legitimate employee through a controlled door remains one of the most reliable techniques in existence, and we test it directly.
• Pretext-based entry. If an individual in a high-visibility jacket arrived at your premises claiming to be doing maintenance work, would your staff admit them? Our operators can arrive on your premises, present a plausible reason to be admitted, and test how your staff react.
• Physical lockpicking. Locks remain the most common way doors, cabinets, and other secure environments are protected when staff are not present, yet lockpicking is in fact generally quite straightforward.
• RFID spoofing. Electronic badges, cards, and key fobs are ubiquitous in modern physical access control systems, yet most of these systems can be spoofed by anyone listening in through radio through tools like Flipper Zero. This connects with our Wireless Security Assessment, which focuses on the testing of radio-frequency communication systems.

Once inside, we assess what physical access actually grants, because the door is only the beginning. Unattended and unlocked workstations, network ports in reception or meeting rooms that hand out direct access to internal networks, unsecured server rooms, and sensitive documents left visible or recoverable from bins are all common and all serious. Where in scope, we test whether a dropped or planted USB device finds its way into a machine, and whether physical access to a device defeats its disk encryption and login controls - a concern that connects directly to our Workstation Security Assessment.

A physical engagement carries its own risks, so we manage it with corresponding rigour. Every operator carries a signed authorisation letter naming the engagement and the people to contact, and we agree clear safety boundaries and abort conditions in advance, because no test is worth a genuine confrontation. We can run the work covertly, to measure how far a determined intruder gets before anyone intervenes, or overtly alongside your facilities team, to audit controls collaboratively - the former more realistic, the latter less disruptive. For organisations in shared or serviced premises, we pay particular attention to the assumptions made about communal areas, which are frequently far less controlled than the tenant believes.

You receive a report narrating how we approached, entered, and exploited access, illustrated where appropriate, with layered recommendations across access control, staff awareness, and the physical protection of equipment and network infrastructure. We treat your staff with respect throughout - an employee who lets us tailgate has been failed by a process, not personally, and our reporting reflects that.

Testing of physical access faces unique legal liability concerns. Shellhex only conducts security tests within the bounds of compliance with all applicable UK laws and regulations, and as such, we will need to conduct legal review of any particular physical testing methodology before we can proceed with it. No statements on this page are to be taken as guarantees of our ability to conduct specific testing strategies, merely suggestions about possible strategies to explore. Nevertheless, physical security testing is a legitimate industry that existing security providers sometimes offer, and wherever possible, Shellhex does as well.