Physical Security Assessments & Physical Penetration Testing
Discover whether your people, premises and physical security controls can withstand a determined intruder.
Samurai Security's Physical Security Assessment service evaluates how effectively an organisation prevents, detects and responds to attempts to gain unauthorised access to its premises. We combine extensive open-source intelligence (OSINT), on-site reconnaissance and realistic physical intrusion simulations with assessments of building security controls, employee behaviour and established procedures.
We offer both black-box physical penetration testing, where our testing team starts without privileged knowledge of the site, and policy-led physical security assessments, where we evaluate how consistently your physical security policies and procedures operate in practice. Both approaches can be combined to understand not only whether an intruder could gain access, but also why an attempt succeeds or fails and what improvements would reduce the risk.
Our testing does not end with the first unsuccessful entry attempt. Within the agreed rules of engagement, we adapt our approach, use multiple entry tactics and carry out further authorised attempts to assess security under different realistic conditions.
What Is a Physical Security Assessment?
A physical security assessment examines the controls, people and processes intended to keep unauthorised individuals out of a building and protect sensitive areas and assets within it. This may include access-controlled entrances, reception procedures, visitor identification, security personnel, internal secure areas, confidential information and employee responses to unfamiliar individuals.
The objective is to determine whether security controls operate as intended in day-to-day conditions, not simply whether they exist on paper. A building may have electronic locks, access badges and security policies, yet still be exposed if procedures are inconsistently followed or less-visible entry points are poorly controlled.
Our assessments can use two complementary approaches:
Black-Box Physical Penetration Testing
A realistic, no-knowledge test of an organisation's physical defences.
Our operatives approach a site without internal floor plans, staff schedules or privileged details. They begin with the information a real-world attacker could reasonably gather, develop plausible scenarios and carry out controlled attempts to gain access to approved locations.
Testing can include physical social engineering, attempted impersonation, tailgating and investigation of alternative entry points. The team may adjust its approach following unsuccessful attempts, rather than treating a single blocked entry as proof that the site is secure.
The exercise is authorised by the organisation and conducted within agreed safety, legal and operational boundaries, even where most site personnel are not informed of the specific scenarios in advance.
Physical Security Policy and Procedure Assessments
Evidence-based assurance that documented security requirements are followed in practice.
We review agreed physical security policies and assess whether the relevant controls and procedures are being applied across a site. This includes visitor registration and escorting, ID verification, door and badge controls, staff challenge procedures, secure storage, confidential disposal and protection of restricted areas.
Findings are assessed against the organisation's actual policy requirements, with supporting observations and an indication of whether each tested control was met, partially met or not met. This helps identify gaps between policy and everyday practice.
Combined Physical Security Assessment
For organisations seeking both realism and measurable policy assurance, the two approaches can be combined. The resulting engagement uses live infiltration attempts to test physical defences and a structured control review to explain the procedural or operational weaknesses behind the observed outcomes.
Why Is Physical Security Testing Important?
A cyber incident does not always begin remotely. An attacker who gains entry to an office, operations centre or other business premises may be able to encounter confidential documents, accessible workstations, network connections, sensitive equipment or restricted areas.
Security weaknesses may arise from human behaviour and inconsistent procedures rather than failed technology. Tailgating, inadequate visitor verification, unescorted visitors, unattended sensitive information and poorly monitored access points can undermine an otherwise well-equipped facility.
A physical security assessment helps answer practical questions:
- Could an unauthorised person gain access to our premises using publicly available information?
- Do entry controls remain effective at side entrances, secondary access points and during different staffing conditions?
- Will employees recognise, challenge or report an unfamiliar person?
- Are visitors identified, authorised and supervised consistently?
- Can an intruder move from a public area into offices, server rooms, executive areas or other restricted zones?
- Do our physical security policies reflect what actually happens on site?
- Would security staff and monitoring processes detect and respond to a simulated intrusion?
- If access is gained, what business information, assets or systems could be exposed?
Testing these questions in a controlled environment gives organisations evidence to improve their building security rather than relying solely on policy reviews or assumptions about how controls should operate.
Key Benefits of Our Physical Security Assessments
Realistic, Intelligence-Led Testing
Extensive OSINT and reconnaissance inform scenarios that reflect how a determined attacker might research and approach your premises. Testing is informed by publicly discoverable details and observed site conditions rather than generic, pre-set scenarios.
Multiple Attempts, Multiple Entry Tactics
A single rejected attempt does not establish that a building is secure. Our operatives assess different authorised approaches and adapt tactics following unsuccessful attempts, building a more representative picture of the site's physical defences within the agreed engagement scope.
Assessment of People, Processes and Technology
Evaluate physical barriers alongside reception procedures, employee vigilance, visitor management, security coverage and other operational controls. This helps identify weaknesses that may not be visible during a conventional facilities inspection.
Independent Policy Adherence Assessment
Determine whether documented requirements are followed consistently across public, business and restricted areas, supported by observations and an evidence-based control assessment.
Understanding of Post-Entry Risk
Establish what a simulated intruder could reach or observe after entering an approved area, including confidential information, high-value assets and potential access to digital systems where those activities are authorised.
Practical, Prioritised Remediation
Receive clear findings, supporting evidence and recommendations for strengthening physical security, employee procedures, monitoring and response. Multi-site engagements can also highlight recurring issues and differences in control effectiveness between locations.
What Does a Physical Security Assessment Cover?
The exact assessment is tailored to the organisation, its premises and agreed objectives. The following activities can be included individually or as part of a combined engagement.
OSINT and Pre-Engagement Reconnaissance
Before visiting a site, our team examines publicly accessible information that could assist a realistic intruder. This may include:
- Public maps, imagery and information about the location or layout of premises
- Public information about the organisation, employees, contractors and service providers
- Information published through company websites, social media and public events
- Publicly visible operational details, such as visitor arrangements and site activity
- Information that may reveal staff identification or physical security practices
- Other publicly discoverable details relevant to the authorised test scenarios
The purpose is to understand what an attacker could learn without privileged access and how that information could influence an attempted intrusion.
On-Site Reconnaissance and Building Security Review
On-site observations assess how the premises operate in practice, including:
- Main, rear and secondary entrances
- Reception desks, visitor access routes and security checkpoints
- Access-controlled doors, badges, keypads and other physical barriers
- Visible CCTV coverage, deterrents and security presence
- Employee and visitor movements, including busy periods
- External access points and the separation of public and restricted areas
- Day-to-day access control and visitor management practices
Reconnaissance helps identify relevant testing opportunities and the controls that should be evaluated during subsequent attempts.
Physical Infiltration and Social Engineering Simulations
Our operatives carry out authorised attempts to gain access and assess staff responses using realistic scenarios. Depending on scope, this may involve:
- Tailgating or piggybacking attempts at controlled entrances
- Impersonation scenarios involving staff, contractors or service personnel
- Verbal social engineering and requests for assistance or access
- Alternative entrances and less-visible access points
- Attempts to pass reception and visitor verification processes
- Attempts to enter or move between approved internal security zones
- Assessment of whether suspicious activity is challenged, escalated or reported
Repeated attempts are a core part of our approach. Where an attempt is unsuccessful, we assess what prevented it and, subject to the rules of engagement, test further scenarios using different tactics, entry points or conditions. We record successful and unsuccessful outcomes to distinguish effective controls from weaknesses that can be exploited under particular circumstances.
Physical Security Policies and Procedures
Where a policy-led review is included, controls may be assessed against documented requirements covering:
- Access control: Appropriate use of badges, PINs, access-controlled doors and restricted-area permissions
- Identity and visitor verification: Checking identity, confirming authorisation and issuing visitor passes appropriately
- Visitor supervision: Escorting and monitoring visitors according to site requirements
- Unauthorised access prevention: Staff challenge culture, tailgating prevention and reporting of suspicious activity
- Detection and deterrence: Security personnel, monitored reception processes, CCTV and other protective measures
- Secure storage: Protection of sensitive documents, valuables, credentials and portable assets
- Confidential disposal: Appropriate handling and disposal of sensitive business information
- Restricted areas: Protection of internal offices, server rooms, executive areas and other higher-risk locations
Controls are assessed against the policies provided and the evidence obtainable during the engagement. A control that cannot be adequately tested should be identified as not assessed rather than automatically marked as failed.
Post-Entry Exposure and Internal Security
Where an operator gains access, the assessment can examine the extent of potential exposure within the agreed authorised areas. This may include:
- Movement between public, business and restricted zones
- Whether internal access restrictions remain effective
- Exposure of unattended documents, credentials or other sensitive materials
- Clear desk practices, secure printing and workstation locking
- Physical access to critical equipment or network infrastructure
- Opportunities for an intruder to remain unnoticed or move without challenge
The assessment documents what was actually observed and demonstrated, distinguishing confirmed access from possible but untested follow-on risks.
Optional Physical-to-Digital Attack Simulation
Where separately approved, physical security testing can be extended to examine potential digital consequences of a successful intrusion. Examples may include controlled assessment of accessible network connections, unlocked workstations, wireless exposure or other agreed physical-to-digital scenarios.
This is not an automatic component of every physical security assessment. Any technical activity, test equipment, device placement or simulated access to data and systems must be explicitly authorised and subject to appropriate safeguards.
Multi-Site Physical Security Assessments
For organisations with several premises, we can assess sites individually and consolidate the outcomes to identify common weaknesses, differences in implementation and opportunities for organisation-wide improvements. Where policies are shared, results can be compared using consistent assessment criteria.
Who Is This Service For?
Physical security assessments are relevant to organisations that need assurance that their premises, personnel and sensitive assets are protected against unauthorised physical access. This can include:
- Organisations with offices, headquarters or multiple business sites
- Businesses that handle confidential, personal or commercially sensitive information
- Organisations with restricted areas, critical equipment or valuable physical assets
- Companies with formal physical security policies that need to verify practical adherence
- Security teams seeking realistic testing of reception, guarding and employee response procedures
- Organisations integrating new premises, changing access arrangements or reviewing security following an incident or significant operational change
Assessments can be tailored to individual facilities or coordinated across multiple locations.
Why Choose Samurai Security?
We Test Like a Determined Attacker
Our approach starts with intelligence gathering and site reconnaissance to inform realistic scenarios. It is designed to test how a motivated intruder would identify and adapt to weaknesses in the organisation's defences.
01
We Do Not Rely on a Single Attempt
We do not consider one blocked entry attempt conclusive. Within the agreed time and testing boundaries, we use varied approaches and further attempts to assess whether security measures remain effective when circumstances change.
02
We Consider the Whole Security Environment
We examine the interaction between access controls, building layout, employee behaviour and the procedures that govern daily activity. This provides insight into both technical and procedural weaknesses.
03
We Produce Evidence-Based Findings
Our reporting distinguishes demonstrated outcomes from potential risks. Where a policy assessment forms part of the engagement, observations can be mapped directly to the organisation's documented requirements.
04
We Support Practical Improvements
Findings are translated into prioritised recommendations that can inform building security, employee awareness, visitor procedures and wider physical security governance.
05
Our Physical Security Assessment Approach
01
Objectives, Authorisation and Rules of Engagement
We establish the purpose of the engagement, approved sites, permitted areas, assessment mode and relevant policies. We agree the testing boundaries, safety precautions, communication arrangements and escalation process before activity begins. For no-knowledge tests, the testing team may receive minimal site information while appropriate client authorisation and oversight remain in place.
02
Extensive OSINT and External Reconnaissance
We gather and analyse relevant open-source information, looking for publicly available details that could support plausible intrusion scenarios. This intelligence informs the initial approach without requiring privileged access to the site.
03
On-Site Reconnaissance and Scenario Planning
Our team observes authorised areas of the site, identifies relevant entry points and reviews how security processes operate. We develop or refine scenarios based on these observations and the agreed assessment objectives.
04
Repeated Physical Infiltration Attempts
We execute controlled, authorised scenarios using different entry tactics. An unsuccessful first attempt does not end the exercise. Subject to agreed constraints, our operatives adjust tactics and continue testing to evaluate the consistency of physical security under different conditions. Successful challenges and denials are recorded alongside any access gained.
05
Internal Security and Procedural Validation
Where entry is achieved and the scope permits it, we assess movement between zones, the protection of information and assets, employee responses and whether relevant procedures are followed. Policy-led engagements also compare observed behaviours and controls with the organisation's stated requirements.
06
Analysis, Reporting and Recommendations
We document each relevant scenario, the observed result, supporting evidence and potential business impact. Findings are risk-rated where appropriate and accompanied by practical remediation advice. For multiple sites, a consolidated view can identify recurring issues and help prioritise improvements across the estate.
What Will You Receive?
Deliverables are agreed during scoping and may include:
Executive Summary
A management-level explanation of the overall results, principal weaknesses, effective controls, business risks and priority actions.
Detailed Physical Security Assessment Report
A record of the assessment scope, methodology, infiltration scenarios, observations, successful and unsuccessful attempts, security weaknesses and supporting evidence.
Physical Security Policy Adherence Review
Where included, a control-by-control assessment against the organisation's own physical security policy. Requirements can be recorded as met, partially met, not met or not assessed, with explanations and relevant evidence.
Site-Level and Cross-Site Findings
For multi-site projects, results can be presented by location with an overall summary of recurring weaknesses, differences in controls and organisation-wide improvement priorities.
Risk-Rated Findings and Remediation Guidance
Actionable recommendations covering matters such as access restrictions, visitor management, employee awareness, secure storage, monitoring, security coverage and escalation procedures.
Assessment Debrief
A review of the findings and recommended next steps with relevant stakeholders, where included in the agreed engagement.
The final reporting format and deliverables are confirmed in the statement of work.
Physical Security Standards and Compliance Considerations
Physical security testing can provide evidence to support internal assurance, risk management and reviews of security control effectiveness. Policy-led assessments are particularly useful for demonstrating whether operational controls are applied consistently against an organisation's documented requirements.
Depending on the organisation and the scope, findings may inform reviews relating to:
- Internal physical security policies and visitor management procedures
- ISO/IEC 27001 physical security controls and related security management processes
- Protection of premises, sensitive information and business-critical assets
- Security awareness, incident reporting and security governance
- Risk assessments and corrective action planning
An assessment can support these activities but does not by itself establish compliance, certification or conformity with any framework. Conclusions depend on the applicable requirements and the evidence obtained.
Our Work
Strengthening Cybersecurity Resilience
“Samurai takes the time to understand our needs and helps us to be an enabler for Flagship Group’s mission. It’s always a pleasure to work with them and I’d recommend them to others.”
Enabling Remote Work for the NHS
“When I have a problem nobody else can solve, I call Samurai because I know that they’ll deliver what I need, every time, without fail.”
Incident Response Retainers To Enable Growth
“This partnership has allowed us to scale and grow with the confidence that we are protected from cyber threats around the clock.”
Client Testimonials
“Samurai takes the time to understand our needs and helps us to be an enabler for Flagship Group’s mission. It’s always a pleasure to work with them and I’d recommend them to others.”
“We were astonished by what Samurai’s Black Dragon assessment revealed, even though we thought we had everything covered. The findings spoke for themselves, and the team’s expertise and clarity were outstanding.”
"Samurai’s Black Dragon: Attack Surface Risk Assessment was exactly what we needed and something we’ve never seen done before. They turned it around quickly, highlighted risks that could have easily been overlooked, and gave us a clear roadmap for improvement."
Frequently Asked Questions
What is the difference between a physical security assessment and physical penetration testing?
A physical security assessment can include a structured review of buildings, security controls, employee practices and documented procedures. Physical penetration testing focuses on realistic, authorised attempts to bypass those defences and gain access to agreed areas. Samurai Security can provide either approach or combine them within one engagement.
What is black-box or no-knowledge physical penetration testing?
In a black-box test, the operatives receive little or no privileged information about the premises, such as internal layouts or employee schedules. They rely on publicly available intelligence, authorised reconnaissance and their observations to plan attempts. The engagement is still approved by an authorised client representative and controlled by rules of engagement.
Will you conduct more than one entry attempt?
Yes. Our approach is not based on a single attempt. We use multiple authorised scenarios and varied tactics, adapting where appropriate following unsuccessful attempts. The number of attempts and available testing windows depend on the agreed scope, safety requirements and practical constraints.
What types of entry techniques can be assessed?
Depending on authorisation, testing can include tailgating, impersonation, verbal social engineering, reception and visitor verification, alternative entrances and attempts to move between approved security zones. Scenarios are selected using intelligence from pre-engagement and on-site reconnaissance.
Can you assess our physical security policy as well as attempt to enter the building?
Yes. We can map observed site conditions and employee practices against your documented physical security requirements. A combined engagement measures both how defences perform against realistic attempts and whether day-to-day procedures are being followed.
Will staff or security guards know the assessment is taking place?
That depends on the chosen approach. In a no-knowledge simulation, most staff may not be told which scenarios will occur, allowing an assessment of normal behaviour. Appropriate client contacts will authorise the exercise and agree safety and escalation arrangements in advance.
Will testing damage the building or disrupt operations?
Engagements are planned around agreed, non-destructive methods and operational safeguards. The assessment boundaries are documented in advance. Forced entry, damage, unsafe activity or intrusive technical testing is not assumed to be permitted and would require separate consideration and explicit authorisation where appropriate.
Can the assessment include digital security risks after physical access is gained?
Yes, where separately scoped and authorised. A combined physical-to-digital simulation can assess selected exposures such as accessible workstations or network connections. These activities are not included automatically in a physical security assessment.
Can you assess multiple offices or buildings?
Yes. We can assess individual premises or carry out a coordinated programme across several sites. A consolidated report can help identify recurring weaknesses, inconsistent controls and opportunities to improve policies and practices across the organisation.
What does the final report include?
The report describes the testing scope, methodology, attempted scenarios, observed outcomes, evidence, findings and recommended improvements. Policy-led engagements can also include a control-by-control adherence matrix and multi-site comparisons where relevant.
Related Security Services
Penetration Testing
Assess vulnerabilities within networks, applications and digital systems using controlled technical testing.
Social Engineering Testing
Evaluate how employees respond to manipulation, deceptive requests and other human-focused attack scenarios.
Attack Simulation & Global Threat Assessment (GTA)
Explore intelligence-led cyber attack simulations that assess realistic external attack paths and potential routes to initial compromise.
Security Assessments
Explore other Samurai Security services for identifying security weaknesses and improving resilience.
How Secure Are Your Premises Against a Realistic Intrusion Attempt?
Access badges, security procedures and locked doors are only effective when they work consistently in practice. Our Physical Security Assessments and Physical Penetration Testing services help you understand whether a determined intruder could gain entry, how personnel and controls respond and where improvements are needed.
Whether you need a black-box infiltration test, a physical security policy assessment or a combined multi-site review, Samurai Security can develop a controlled assessment around your buildings, objectives and risk priorities.
Get in touch
Let's find a solution
If you want to chat, give us a call: 0121 740 1304
Or, email us: info@samuraisecurity.co.uk