Physical Penetration Testing: What It Covers and When You Need It

Physical penetration testing is an authorised attempt to get into your buildings, secure rooms or equipment the way an intruder would. Testers follow staff through controlled doors, try to copy access badges, check locks and doors for weaknesses and talk their way past reception. They then try to reach something that matters: a comms cupboard, an unlocked laptop, paper records or a card terminal. The result shows whether your physical controls and staff habits would stop a real intruder, and what to change if they would not.

What is physical penetration testing?

Physical penetration testing, also called physical pentesting, physical pen testing or physical security penetration testing, tests the controls that stop unauthorised people reaching your premises and the systems inside them. Unlike a checklist review, it shows what actually happens when someone tries to get in, rather than what the policy says should happen.

Physical tests are also described by how covert they are and where they start. In a covert test only a few senior people know, so staff and guards behave as they normally would; in an announced test they are briefed, and the focus moves to locks, doors and badge technology. A perimeter test asks whether someone can get into the building at all, while an internal test starts inside, for example as a visitor, and asks what that person can reach.

What does a physical penetration test cover?

A physical test covers the route from the street to the assets inside. Typical non-destructive techniques:

Tests can run in working hours, when social engineering does most of the work, or outside them, when alarms, guards and locks carry more weight. The rules of engagement set what is allowed at each site.

When do you need a physical penetration test?

A physical test is worth doing when an intruder could reach something valuable, or when something has changed:

• On-site servers, comms rooms or network equipment.
• Areas where cardholder data is handled or payment terminals are used (PCI DSS Requirement 9).
• Paper records, prototypes or other sensitive material.
• A new office, access control system or security contractor, or an unexplained incident.

If you are fully cloud-based with no on-site infrastructure, a lighter physical security review may be more proportionate.

Is physical penetration testing legal in the UK?

Yes, when the organisation that controls the premises and systems authorises it in writing and testers stay within the agreed scope. In general terms, for England and Wales:

• Entry. Trespass is usually a civil matter, but entering some protected sites without permission is a criminal offence. Damaging property without the owner’s consent is criminal damage, which is one reason good tests avoid damage altogether.
• Computers and networks. Plugging a device into a network or using an unlocked computer without authority from the person entitled to control it can be an offence under the Computer Misuse Act 1990. The authorisation must cover these acts explicitly.
• Impersonation. Rules of engagement normally rule out posing as police, emergency services or other officials, which can be an offence in itself.
• Personal data. Photos, video and badge data captured during a test can identify staff and visitors. Under UK GDPR they should be kept to a minimum, stored securely and deleted on an agreed date.

Scotland and Northern Ireland have their own law on entry and property, as do other countries, so take local advice for sites there. This guide is general information, not legal advice.

What is a get-out-of-jail letter?

A “get-out-of-jail letter” is the informal name for the authorisation letter a physical tester carries. It is evidence of the client’s consent, not immunity from the law, and lets security staff or police quickly confirm that the tester is authorised.

A good authorisation letter includes:

A forged letter is easy to make, so a careful guard verifies it by calling a number they already hold for your organisation, not one printed on the letter. Some tests deliberately check whether guards do this, so agree the verification route in advance.

What can an authorisation letter not do?

• It cannot cover premises the client does not control. A tenant can authorise entry to its own office, but not to the landlord’s reception, lifts or car park, a neighbour’s floor or a colocation provider’s data hall.
• It does not bind the police. Officers called to a suspected break-in act on their own judgement and may arrest a tester while they check the story, whatever the letter says. Testers should stop, cooperate and ask officers to call the emergency contact.
• It does not authorise anything outside scope. Damage, entry to excluded areas and techniques not listed are not covered.

How do landlords and third-party premises affect scope?

Shared buildings are where physical tests most easily go wrong, so third-party consent is part of scoping:

1. Map who controls each space: your floors, common parts, reception, car parks and any data centre or comms room run by someone else.
2. Get written consent from each controller whose space is in scope, usually the landlord or managing agent, or exclude that space.
3. Tell security contractors’ management enough to keep the test safe, without warning the guards on shift.
4. Agree the escalation path, so a guard who calls the police reaches someone who can verify the test.

How is a physical penetration test run?

Well-run physical penetration testing services follow the same broad stages, and the paperwork comes before anyone goes near a door:

1. Scoping. Objectives (for example, reach the comms room), sites, times and techniques.
2. Authorisation. The client’s letter, landlord and third-party consents, and emergency contacts.
3. Reconnaissance. Remote research and observation from public areas.
4. Plan approval. The client approves the pretexts, entry routes and stop conditions.
5. On-site testing. Attempts within the agreed windows, under safety rules: no force, no climbing, no tampering with fire exits or alarms, and an immediate stop if anyone is at risk.
6. Reporting and debrief. A timeline of what was tried and what worked, with photos that capture as little personal data as possible, a rating and fix for each finding, and credit for the staff who challenged the tester.

Fixes are usually procedural (escorting visitors), technical (badge readers that resist cloning) or about awareness (making it normal to challenge strangers).

How much does a physical penetration test cost in the UK?

There is no standard price, because a physical test is priced by the tester-days it takes, and those vary widely from one site to the next. The main cost drivers are:

Travel to distant sites adds to the total. Our penetration testing cost guide shows published UK day rates for testers and how to sense-check what a quote buys.

How does physical testing relate to PCI DSS Requirement 9 and ISO 27001?

PCI DSS does not require a physical penetration test, but Requirement 9 sets the physical controls a test puts under pressure. In PCI DSS v4.0.1:

Our guide to the 12 PCI DSS requirements puts Requirement 9 in context, and the standard itself is in the PCI SSC document library. A QSA assesses these controls by observation and interview; a test shows how they hold up against a real attempt.

Under ISO/IEC 27001:2022, physical tests give evidence for the physical controls in Annex A, particularly 7.1 (physical security perimeters), 7.2 (physical entry), 7.3 (securing offices, rooms and facilities), 7.4 (physical security monitoring) and 7.7 (clear desk and clear screen).

How does physical testing combine with social engineering and red teaming?

Most physical entry relies on social engineering: a confident story at reception or a held door. Our guide to the types of social engineering attacks covers the wider family of techniques. In practice, physical testing is scoped in one of three ways:

• Within social engineering testing. Our social engineering penetration testing can include physical pretext scenarios such as tailgating, reception and visitor checks where they are in scope, alongside phishing and phone pretexts.
• Within a red team assessment. A red team assessment can use physical access as one route towards an agreed objective, testing whether your security team notices.
• Alongside technical testing on site. Wireless penetration testing usually involves work at your site, and checks whether your Wi-Fi can be reached and attacked from the car park or a shared area.

How can Sovereign Secure help?

Sovereign Secure is a PCI SSC Qualified Security Assessor (QSA) company, so we assess Requirement 9 controls as part of PCI DSS assessments, and we are ISO 27001 certified. Our testing services include social engineering, red team and wireless testing, and hardware penetration testing that covers point-of-sale and PIN devices.

Next step

If you want physical scenarios tested, contact us with your sites, what you need to protect and any landlord or shared-building constraints. We will confirm what can be scoped and how authorisation will work.