Physical penetration testing evaluates the effectiveness of an organisation's physical security controls by attempting to gain unauthorised access to buildings, secure areas, and sensitive assets. Testers use techniques including lock picking, badge cloning, tailgating, social engineering of reception staff, bypassing access control systems, and exploiting weaknesses in physical barriers.
Physical pen testing assesses entry points, CCTV coverage and monitoring, alarm systems, guard procedures, visitor management processes, and the security of sensitive areas such as server rooms and executive offices.
This type of testing is critical for organisations that rely on physical security to protect data centres, critical infrastructure, research facilities, and high-value assets. Physical pen testing is often combined with social engineering testing for a comprehensive assessment of human and physical security controls. It is required or recommended by several compliance frameworks and is particularly relevant for organisations in defence, financial services, healthcare, and government sectors where physical access could lead to significant data breaches or operational disruption.
UK offensive security consultancy delivering CREST-accredited penetration testing, adversary simulation and CBEST, TIBER-EU and TBEST threat-led testing, mainly for financial services and other large organisations.
Elite UK offensive security consultancy specialising in CBEST/STAR/TIBER red teaming, advanced adversary simulation, and CREST-accredited penetration testing for FTSE 100 clients.
US penetration testing firm founded in 2011, running 600+ engagements a year with a fully remote, US-based team. Manual, expert-led testing across web, network, cloud, mobile, wireless, OT/ICS, and AI/LLM. Gartner Sample Vendor for PTaaS.
Full-service London-based cybersecurity consultancy with CREST, CHECK, and NCSC accreditations delivering offensive testing, managed detection, and strategic advisory services.
Munich- and Budapest-based embedded cybersecurity experts focused on financial services, automotive and mobility, manufacturing and industrial automation, energy and more. The services and platform go beyond compliance, supporting the requirements of the Cyber Resilience Act, PCI PTS, UN R155, ISO/SAE 21434 and other standards and regulations.
CHECK and CREST-accredited Birmingham-based cyber security consultancy with over 15 years of experience delivering penetration testing, red teaming, and OT security assessments for government and private sector clients.
World-renowned cybersecurity firm now part of Google Cloud, delivering threat intelligence-led penetration testing and red teaming informed by front-line incident response experience.
US-headquartered cybersecurity consultancy with 800+ employees, serving ~40% of the Fortune 500. FedRAMP 3PAO, PCI QSA, and HITRUST accreditations.
Subscription-based offensive cybersecurity firm delivering continuous cyber attack services with CREST STAR and CBEST accreditations from its London headquarters.
CREST-accredited California consultancy blending compliance expertise with penetration testing. First to earn ISO 17020 for MITRE ATT&CK and PTES frameworks.
Denver-based offensive security boutique with a community-first red team culture. Home of PTES co-authors and the Continuous Red Team retainer.
CREST-accredited Birmingham-based cyber security consultancy delivering penetration testing, social engineering assessments, and Cyber Essentials certification for public and private sector clients.
Physical pen testing requires written authorisation from the property owner or authorised representative. Testers carry authorisation letters and emergency contacts. All activities must comply with local laws.
Testing covers perimeter security, access control systems, badge cloning, lock picking, tailgating, CCTV blind spots, alarm systems, guard response, dumpster diving, and access to sensitive areas like server rooms.
A typical physical pen test takes 3-7 days including reconnaissance, testing, and reporting. Larger sites or multiple locations require additional time.