Offensive Security
Physical Security Testing
The assessment uses named sites, explicit techniques, safety rules and designated oversight.
- Named sites and accessible areas
- Approved physical access scenarios
- Safety, privacy and stop controls
- Observed control and response findings
The proposition
Examine physical controls for one objective
Examine whether selected physical controls and procedures protect an agreed objective under controlled conditions. The work focuses on named sites and accessible areas and records where evidence or authorization limits the conclusion.
Physical authorization must be unmistakable
Physical testing can affect staff, visitors, facilities and safety systems. The engagement therefore starts with precise written authority, allowed areas, prohibited techniques, oversight contacts and stop conditions.
Cyberus tests only the approved scenario. Emergency systems, unsafe actions, coercion and uncontrolled interference remain out of scope unless a lawful, safe and explicit plan says otherwise.
Route past physical controls
- Outer perimeter. The approach to a building, where fences, gates or reception set the first expectation.
- Challenge point. A badge reader, escort rule or alert employee has the chance to stop an unauthorised visitor.
- Restricted area. Inside, a sensitive room or device is reachable only if earlier checks were passed.
- Protected objective. The asset or information the physical controls exist to keep secure.
Why it matters
- Business risk: Strong digital controls can be bypassed by someone who simply walks in, borrows a badge or follows staff.
- Decision it supports: Facility and security leaders can decide where to adjust door controls, visitor handling or staff routines.
- What you receive: You receive an authority matrix, scenario evidence, a response timeline and an improvement plan for named sites.
A controlled record of physical observations
Authority matrix
Lists sites, zones, dates, permitted methods, exclusions and approving owners.
- Why it matters
- Unclear permissions create safety, legal and reputational problems for everyone involved.
- Supports
- Safe, documented authority for each site and method
Scenario evidence
Records observable access-control and procedural behavior without unnecessary personal data.
- Why it matters
- Observations show how controls behave in practice, not just how a policy describes them.
- Supports
- Evidence for facility and identity decisions
Response timeline
Documents relevant verification, challenge and escalation events.
- Why it matters
- Seeing who challenged, verified or escalated shows whether procedures work under pressure.
- Supports
- Tuning visitor, reception and escalation routines
Improvement plan
Connects findings to facility, identity, visitor and staff processes.
- Why it matters
- Findings are only valuable when facilities, HR and security can each act on their share.
- Supports
- Prioritised changes across buildings, badges and staff
How physical testing is governed
Why choose Cyberus for physical security testing
The assessment can demonstrate weaknesses in the selected scenario and support practical changes. It does not establish the condition of every site or shift.
Physical Security Testing
Frequently asked questions
Will staff be deceived during testing?
Only an explicitly approved scenario may involve staff interaction, with clear safeguards and a planned debrief.
Are locks or safety systems damaged?
Destructive action is excluded. Any specialist technique must be expressly approved and safe for the environment.
Can several sites be compared?
Yes, but each site needs its own authority, constraints and evidence context before conclusions are compared.
Team certifications
Individual qualifications held by members of the Cyberus team. They are not company accreditations, and not every consultant on an engagement holds every badge.
OSCP
Hands-on penetration testing skills, from enumeration to exploitation and privilege escalation.
OSWE
Web application security skills, including source code review and exploiting complex web vulnerabilities.
OSED
Exploit development skills, including analysing Windows software and writing custom exploits.
OSCP+
Hands-on penetration testing skills, from enumeration to exploitation and privilege escalation.
CRTA
Red team analysis skills, including adversary tactics and techniques.
eWPT
Web application penetration testing skills, from assessment method to exploiting common web flaws.
eWPTX
Advanced web application penetration testing skills, including complex attack techniques.
eMAPT
Mobile application penetration testing skills for Android and iOS applications.
BTL1
Defensive security skills across security operations, phishing analysis, forensics and incident response.
eCIR
Incident response skills, including investigating, containing and analysing security incidents.
CRTE
Red teaming skills focused on Windows environments and the tradecraft used against them.
CCT
EC-Council's Certified Cybersecurity Technician (CCT) validates foundational security, network, and defense skills.
Security+
CompTIA Security+ validates core skills in baseline cybersecurity, risk management, and threats.
Discuss a controlled physical assessment
Identify the site, objective, approving owner and safety constraints for the proposed scenario.