Nashville Physical Penetration Testing Your badge system is fine. Your back door at 7am is not.

No, and we want that clear before a scoping call rather than after. This engagement covers physical access and social engineering: doors, badges, reception, vendor impersonation, interior movement and staff response. Network, application and system testing is a separate discipline with separate qualifications, and a firm offering both as one package is usually strong at one and thin on the other. If a network assessment is what you need, we will tell you and help you find the right firm rather than taking the engagement.

A written authorization is what makes the difference between an authorized security assessment and a criminal trespass, and we do not begin without one signed by someone with authority over the premises. The engagement letter names the sites, dates, permitted scenarios and emergency contacts, and the tester carries a copy for the duration of every test — the escape clause that is produced immediately if police or security detain them. If the facility is leased, or a landlord or shared-tenant arrangement complicates who can authorize, we work that out during scoping.

As few people as the situation allows, which is usually two or three: the executive commissioning the test, the security lead, and one emergency contact reachable during the test window. The value of the exercise collapses if the front desk has been told to expect someone, and equally if nobody in the organization can confirm the tester is authorized when a police response occurs. We deliberately do not brief the staff whose behavior is the subject of the test.

That is a successful outcome, and we plan for it. The tester carries the signed authorization letter and the emergency contact's number, produces both immediately when challenged by police or security, and does not attempt to continue the pretext once law enforcement is involved. Your emergency contact confirms the engagement by phone. We also notify you promptly, because an employee who correctly escalated deserves to be told they did the right thing rather than left wondering.

Not by design, and we structure it specifically to avoid that. Findings are documented by control and role — reception accepted an unverified vendor pretext, the east service door was propped during shift change — rather than by individual name. A report used as a disciplinary instrument guarantees that the next test is sabotaged and that honest reporting stops. The only exception is conduct you would want to know about regardless of any test, which we raise with leadership directly rather than burying in a findings list.

Annually is a reasonable baseline for most organizations, with an additional test after any material change: a new access control system, a facility move or expansion, a significant turnover in security or reception staff, or an actual incident. Physical security decays gradually through ordinary convenience — a door propped for a delivery, a badge policy relaxed during a busy period — so the gap between a passing test and a failing one is often a few months of drift rather than a deliberate change.

Tailgating is following an authorized person through a controlled door, and it defeats badge systems more reliably than any technical attack because it exploits politeness rather than a flaw. Someone carrying boxes, dressed appropriately, walking with purpose, will be held the door for at most facilities. It is also the hardest gap to fix, since the remedy is cultural and physical rather than technological: mantraps and turnstiles where justified, and a staff norm that makes challenging a stranger ordinary rather than rude.

In most engagements the first successful entry is not the front door. It is a service or loading entrance during a delivery window, a smoking-area door propped with a wedge, or tailgating at shift change. The second common finding is how far someone gets once inside without anyone asking: unattended workstations, unsecured records, and conference rooms with network jacks. The third is that nobody filed a report afterward, which is usually the finding leadership finds most uncomfortable and most worth fixing.

Yes, and multi-site engagements often produce the most useful finding of all: which controls hold consistently and which depend entirely on the individuals at a particular site. A company with identical policies across six locations will typically see materially different results at each, and the variance tells you whether you have a policy problem or a local execution problem. Multi-site engagements are scoped together so the methodology is identical and the comparison is meaningful.

Generally two to four weeks for a single site. Scoping and authorization take a few days, reconnaissance runs several days without any contact, testing is spread across multiple time windows rather than compressed into one visit, and the report follows about a week after the final test. Multi-site engagements extend proportionally. We resist compressing the testing phase, because testing only during business hours on one day tells you about one window and nothing about the rest.

It is quoted per engagement rather than hourly, since the deliverable is a defined assessment and report. The main cost drivers are the number of sites, the number of distinct time windows tested, whether social engineering is in scope alongside physical entry, and how deep into the facility testing is authorized. Post-remediation retests are quoted at a reduced rate because the reconnaissance is already complete, and we recommend budgeting for one at the outset.

Yes, and we price it to make that easy. A remediation you have not verified under the same conditions is a remediation you are taking on faith, and the common outcome of a retest is that the technical fix held while the human one did not — the door now locks, and reception still accepts the vendor pretext. Retests are faster and cheaper than the original engagement because reconnaissance carries over, and they are the step that converts a findings report into an actual improvement.

Yes, with the scope adjusted for the regulatory environment. In records-sensitive environments we test whether an area is reachable and whether records are physically unsecured, and we document that finding without accessing, reading, photographing the contents of, or removing any actual record. Proving that a records room could be entered is the finding; handling protected information would create the exposure the test exists to prevent. That boundary is written into the authorization for these engagements.