Physical security testing, with a signed letter in our pocket
An authorised on-site assessment of how well your premises protect people, information and equipment. We check entrances, reception, desks and technical rooms within rules you agree in writing, and report what we found without pointing at anyone.
Overview
Why the building matters
Firewalls and encryption assume that the person standing next to the server is supposed to be there. A propped fire door, a visitor nobody asks about or a printout left on a desk can undo a great deal of careful technical work.
A physical security test looks at your premises the way an unexpected visitor would. We review how entry and access controls work in practice, how reception and visitor handling cope with someone who does not belong, whether staff notice and speak up, how documents and devices are handled, and how well server and network rooms are protected.
Every engagement runs under written authorisation from someone entitled to give it, with agreed rules of engagement and areas that are out of bounds. Safety comes before any finding, and the report is about controls and processes, not about individual people.
Who it is for
Organisations with offices, data rooms, labs or other premises that hold sensitive information or equipment, and those whose clients, auditors, insurers or frameworks such as ISO/IEC 27001 expect physical and environmental controls to be checked in practice.
The work, from scoping to evidence.
What we do
Entry and access controls
Doors, gates, turnstiles, access cards and the procedures around them, reviewed for how they work on an ordinary day rather than how they look on paper.
Reception and visitor handling
Sign-in, identification, visitor badges, escorts and deliveries: whether the process holds up when someone arrives who is not expected.
Staff awareness of unknown visitors
Whether people notice someone they do not recognise in a restricted area, feel able to ask, and know whom to tell.
Clean desk and information handling
Documents, screens, unlocked devices, printers and disposal: what information is left where a visitor could see or take it.
Server and network rooms
How technical rooms, cabinets and network points are protected, who can reach them, and how access to them is recorded.
Combined engagements
On request, the on-site assessment can be paired with a penetration test, a wireless review or awareness training.
How the engagement runs
Kickoff and scoping
We agree the sites, the areas in scope, the objectives and what is out of bounds. An NDA can be signed before the first meeting.
Authorisation and rules of engagement
Written authorisation from someone entitled to give it, including for any shared or leased premises, and rules of engagement covering timing, conduct, safety and how we stop.
On-site assessment
We visit within the agreed windows, carrying an authorisation letter and with a named contact on your side reachable throughout. Safety of people always comes first.
Reporting and handover
A report on the controls and processes we observed, with what worked, what did not and what to improve first, walked through with the people who will act on it.
Follow-up
On request, a follow-up visit to review the changes, and a feedback session to close the project.
What you receive
- Agreed scope, authorisation and rules of engagement
- Authorisation letter carried on site
- Management summary of the physical security posture
- Detailed findings on controls and processes, without naming individuals
- Prioritised recommendations for premises, procedures and awareness
- Optional follow-up review of the improvements
Questions
Who needs to know about the assessment?
Someone entitled to authorise it, and a small number of named contacts you choose. Whether reception or security staff are told in advance is part of the rules of engagement. We agree it with you before the visit.
What happens if our staff challenge you?
That is a good result, and it goes in the report as one. We carry an authorisation letter, your named contact can confirm it at any time, and we follow the agreed way to stop and identify ourselves.
Will individual employees be blamed?
No. The report describes controls, processes and situations, not people. The aim is to show where the organisation can make the right behaviour easier, not to catch anyone out.
What about safety and sensitive areas?
Safety comes first. Areas, equipment and actions that are out of bounds are written into the rules of engagement, and we stop at once if a situation becomes unsafe or if your contact asks us to.
Related services
- Offensive securityPenetration TestingPenetration testing by Black Fox Security: black, grey and white box tests against an agreed scope, business and technical reports, and a retest of your fixes.
- Advisory and responseSecurity awareness trainingTraining from Black Fox Security: security and social engineering awareness, incident response and DevSecOps, for staff, developers and management.
- Offensive securityRF and Wireless TestingRF and wireless testing by Black Fox Security: your Wi-Fi, Bluetooth, sub-GHz links and access cards, assessed under written authorisation and radio rules.
- Governance and riskInformation security auditIndependent information security audits from Black Fox Security against ISO/IEC 27001, 27002, GDPR, PCI DSS, your own policies or a client's questionnaire.
Tell us which premises you want assessed
Send us the sites and what concerns you about them. We will come back with a scope, the authorisation we need and a proposal.