Capability
Physical security ASSESSMENT
Physical security assessment finds the entry points no firewall can protect. The Swarm tests your physical environment the way a real attacker would: on site, in person, and without warning.
CovertSwarm named in the Gartner® Hype Cycle™ for Security Operations, 2026
The threat
COMFORT IS what an attacker walks into.
Physical security testing exposes the entry points that exist outside your digital perimeter. A tailgate through a held-open door, a USB drive picked up in a car park, a contractor who was never challenged. These are not edge cases. They are the most common findings from every physical engagement the Swarm runs.
The gap is rarely in the technology. It is in the assumption that familiar surroundings mean safe surroundings. Physical security testing finds where that assumption breaks down, who exploits it, and what they can reach once they are inside.
The door your team holds open.
Tailgating works because holding a door open feels polite. Attackers rely on exactly that instinct.
The device nobody questions.
A USB drive in a car park. A laptop left with reception. Physical devices are the attack vector no firewall sees coming.
Trust is a vulnerability.
Close-knit teams are not safer. The stronger the culture of trust, the harder it is for anyone to challenge an unfamiliar face.
we attack the places you trust.
Real attackers do not wait for an invitation. They observe, build a pretext, and walk through the door your team holds open. The Swarm works the same way.
Site security assessment
Your physical environment assessed from the outside in, mapping entry points, security culture, and the gap between how your security looks on paper and how it performs under real pressure. Every engagement starts here before a single approach is made.
Tailgating and unauthorized access
We test whether your physical access controls and challenge culture stop an unauthorized person or whether a confident pretext and a held-open door is all it takes. Most of the time it is the door.
Physical device attacks
USB drops, hardware implants, and on-site device exploitation test whether a device left in a meeting room, car park, or common area gets picked up, plugged in, and used against you. In our experience, it usually does.
Insider threat simulation
What can a malicious new starter, contractor, or visitor do once they are legitimately inside. Data hygiene, unlocked workstations, unsecured rooms, and access they were never supposed to have are all in scope.
RFID cloning and badge attacks
Access badges can be cloned from close proximity without the cardholder knowing. We test whether your physical access credentials can be duplicated and used to enter restricted areas without detection.
Lock picking and physical bypass
Physical barriers that look robust on paper are tested against the techniques a real attacker would use before resorting to social engineering. Locks, door mechanisms, and access control hardware are all in scope.
We know that real attack surfaces don’t come in neat categories. If yours doesn’t fit above, tell us what you’re working with.
What a PHYSICAL ENGAGEMENT Finding Looks Like
Example: On-site engagement, financial services
Critical
Finding
A Swarm operator posed as a facilities contractor and tailgated into a restricted floor through a held-open door. An unlocked workstation in an unoccupied meeting room was accessed and a hardware implant installed. The operator was on site for forty minutes. No challenge was made and no alert was triggered.
Impact
The implant provided persistent remote access to the internal network from outside the building. The floor contained workstations used by senior finance staff. No detection event was logged during or after the engagement.
Remediation
Implement a challenge culture program that makes questioning unfamiliar faces an expected and supported behavior. Enforce a clean desk and screen lock policy enforced by technical controls rather than guidance alone. Review physical access logs for unescorted visitors and audit which floors and rooms are accessible from a single access event.
Board impact
An unauthorized person reached a restricted floor, accessed an unattended workstation, and left the building without a single challenge or alert.
Technical impact
Tailgating via social pretext. Hardware implant deployed on unattended workstation. Persistent internal network access established. Zero detection events.
Want the full picture?
The full range of offensive security the Swarm runs: every discipline, how they connect, and what each one tests.
No form fill required.
HOW WE attack SAFELY.
Your subscription starts with your Attack Strategy. What matters most, and what adversaries would target first.
Every physical security engagement is scoped and agreed before it starts. We work within your legal, ethical, and operational boundaries, testing only what you need tested, in the way that serves your actual risk picture.
1
Authorization
Every engagement is explicitly authorized in writing before any operator sets foot on site. Every operator carries documentation confirming the engagement is sanctioned and a named client contact is available to verify it immediately if required.
2
Permission
Scope, target sites, permitted techniques, and boundaries are agreed before any operator sets foot on site. Techniques outside the agreed scope are not used regardless of opportunity.
3
Hard limits
Every engagement has documented stop conditions. If an operator is challenged or detained, they produce authorization documentation immediately and request that the named client contact is called to verify the engagement.
4
Staff welfare
Findings are reported at team, process, and control level. The purpose of the engagement is to find gaps in systems and culture, not to single out people.
Constant Cyber Attack™
We become the threat. You get the proof.
You don’t outpace attackers by waiting for your next test. You do it by facing an adversary that thinks, acts and strikes like they do.
Constant Cyber Attack gives you a dedicated Swarm of ethical hackers, putting your whole organization under relentless offensive pressure across digital, physical and social vectors. One simple subscription. Clear proof of what’s exposed and what to fix.
Digital. Social. Physical.
Your Swarm attacks across digital, physical and social vectors, chaining weaknesses to prove what a real attacker could achieve.
Constant pressure.
Your Swarm keeps attacking as your business evolves, adapting to changing systems, people and risks. Constant pressure, not a one-off test.
One simple subscription.
One subscription is all you need. Combine continuous offensive security, penetration testing, red teaming, bug bounty and more in one simple subscription.
Sharper, battle-tested SOC
Improve detection times
Fewer false positives
Prove ROI of security tooling
Stories from the Swarm
These stories are real, but the names are deeply redacted. We’ll tell you how we uncovered the threats no one else could see, and why constant cyber attack is the best way to outpace cyber threats.
Become a story well told. Contact us to discuss how Constant Cyber Attack will help you outpace cyber threats.
Frequently asked questions
Yes. Every engagement is explicitly authorized in writing before any operator sets foot on site. Every operator carries documentation confirming the engagement is sanctioned. Your security team is given a named point of contact to call to verify the engagement immediately if an operator is challenged or detained.
Every operator carries written authorization for the engagement. If challenged, they produce it. If security detains them, they request that the named client contact is called to verify the engagement. No operator proceeds beyond the point at which they are detained without explicit guidance from the client contact.
That depends on the scope agreed before the engagement starts. A covert engagement means only the authorizing stakeholders know. The rest of the team is tested without prior notice, which produces the most realistic result. An escorted or disclosed engagement involves named contacts who can observe. Both approaches are available. The scope document defines which approach is used.
No. Findings are reported at team, process, and control level, not attributed to individual employees. The purpose of the engagement is to identify gaps in systems and culture, not to single out people. No staff member is identified in a finding without explicit prior agreement. The debrief is designed to build awareness, not assign blame.
In a point-in-time engagement, your physical security is tested once within a scoped window. Inside Constant Cyber Attack, physical pressure runs as a continuous vector alongside digital and social attack across your entire attack surface, with findings delivered on a rolling basis.
Yes. Engagements can be scoped across single sites or multiple locations. For organizations with distributed operations, testing across sites reveals whether security culture and physical controls are consistent or whether specific sites represent disproportionate risk.
You receive a full findings report covering every access point tested, what was achieved, how, and what it means for your risk posture. Every finding includes a board-level and a technical outcome line, and specific remediation guidance. The engagement closes with an on-site debrief in which the Swarm walks your team through exactly how they got in.
Looking for something specific?
Talk to us. We’d love to hear from you.
Stop testing.
Start knowing.
You’ll know exactly where you stand, and you’ll be able to prove it. To your board, your regulator, and yourself.
Transform to a proactive, continuous offensive security program
Your budget is aimed at the risk that matters, not the one you were handed
You show the board what security prevented, not a request for more
Security clears the way for the business to move faster
You enter the boardroom in command
It starts with a 30-minute Attack Discovery call.
No access to your systems required.