A prestigious TV and film production company believed their security was ironclad. They were wrong.
In five days, we breached their systems. Worse, we walked through their front door on a quiet Saturday evening and left our calling cards in their data centre. It’s proof that physical security testing matters exactly as much as firewalls.
Your security isn’t what you think it is. Here’s why: sporadic testing gives you a snapshot. Threats don’t wait for a scheduled test.
The infiltration
Our foothold came through a simulated user compromise. In practice, within hours we’d mapped the internal network of the company and pivoted through their VPN straight into core infrastructure.
We didn’t chase the obvious targets first. Instead, we catalogued every device and service across their render farms, editing suites, and storage arrays. Those arrays held terabytes of content. Here’s the catch: the most ordinary device in the building is what broke their defence.
The printer predicament
Lateral movement led us to an overlooked weakness: the office printer. Compromised printer credentials gave us access to Active Directory, the system that controls permissions across the entire network. Which means most doors were open from there.
The printer held more than network access. On top of that, it held printed documents that would shape the rest of the engagement.
The paper trail
Two documents mattered most: their ISMS documentation and risk register. Together, they mapped every weakness in the building’s defences. Add to that a risk register flagging poor CCTV coverage, complete with office floor plans, and for a physical breach, that combination is decisive.
The physical security testing gap
The floor plans pointed us straight to Pax, the platform controlling building access. We brute forced our way in. Then, on a quiet Saturday evening, we connected to their WiFi from outside, triggered the door release, and walked straight into their data centre.
Their CCTV system never caught us. In practice, nobody had run physical security testing on that door in years, and we proved why that matters.
The reality check
The calling cards in the data centre weren’t just theatre. They proved attackers don’t stop at firewalls and don’t respect business hours.
Here’s the structural lesson: most security programmes test digital and physical defences separately, if they test the physical side at all. Real attackers don’t work that way. They use whichever door is open, on a screen or in a hallway.
The consequence is clear. Digital security testing alone missed the gap that physical security testing exists to catch, and the company’s actual security fell far short of what they believed. Which means a single, point-in-time test can’t cover a gap that spans both worlds. Constant testing does.
Ready to find the gap between your digital and physical security?
Constant Cyber Attack™ subscriptions hit both surfaces at once, continuously, the way a real adversary would. Contact CovertSwarm to find out if your printer, your risk register, or your back door would hold, before someone else finds them first.