Mystery Guest: Physical Penetration Testing
In a physical penetration test, senior consultants attempt to enter your premises within agreed boundaries; every step is documented with evidence.
What is tested and why it matters
Evaluating whether physical access controls prevent unauthorised entry.
Physical access controls are tested less frequently than digital systems, yet a single successful entry can bypass network segmentation, endpoint protection, and identity controls entirely. Tailgating through a secured door or exploiting a gap in visitor management procedures gives an attacker direct access to internal networks, workstations, and sensitive areas. A mystery guest assessment tests these controls the way a real intruder would: by attempting to walk in.
Who needs this assessment
Organisations that benefit most.
This assessment is designed for organisations with physical locations containing sensitive information, critical infrastructure, or restricted areas that require validated access controls.
Organisations with physical locations containing sensitive information or critical infrastructure
Corporate offices, data centres, and government buildings with restricted areas
Financial institutions and healthcare facilities subject to physical access compliance requirements
Organisations that want to validate employee security awareness in physical access scenarios
Companies combining physical security testing with scenario-based pentests for multi-vector assessment
Government buildings, healthcare facilities, and critical infrastructure sites required to validate physical access controls
Where advanced testing is applicable
- Financial services: adversary simulation testing detection and response across trading and banking platforms.
- Critical infrastructure: scenario-based assessments validating incident response for essential entities.
- Corporate environments: physical access testing and phishing simulations measuring employee awareness.
- Organisations with a SOC or incident response team seeking realistic validation of detection capabilities.
What the assessment produces
The insight and evidence delivered at the conclusion of the assessment.
Every assessment concludes with a structured report covering access attempt evidence, employee response observations, physical control analysis, and recommendations. Reports are delivered through the Pentrox Portal and are available for download at any time.
- Evidence-based report on whether physical access controls prevent unauthorised entry
- Documented assessment of reception, visitor management, and badge security procedures
- Identification of gaps in employee vigilance and physical security awareness
- Prioritised recommendations for strengthening physical access controls and procedures
- Portal access with findings, report downloads, and project tracking for the lifetime of the client account
How an assessment runs
- Scope and Intake
- Planning
- Assessment
- Reporting
- Findings & Retest
Retesting of remediated findings is included as standard with every assessment.
Assessment methodology
Five phases from scenario definition through reporting.
Each phase builds on the previous one. Scenario boundaries define what is tested, reconnaissance informs the approach, and access attempt evidence drives the recommendations.
Scenario definition and boundaries
Physical access scenarios are defined with the client. Locations, permitted techniques, and escalation contacts are agreed. Only selected contacts are informed.
PTES (Pre-Engagement Interactions), Social Engineering Framework (Scope)Reconnaissance and preparation
The target facility is observed to identify entry points and visitor procedures. Materials and cover stories for the agreed access scenario are prepared.
PTES (Intelligence Gathering), Social Engineering Framework (Reconnaissance)Physical access attempts
Access attempts are executed and documented with timestamps and photographic or video evidence. Safe drop testing is included where agreed during scoping.
PTES (Exploitation, Physical Security), Social Engineering Framework (Attack Execution)Employee response observation
Employee responses are observed and documented. The assessment records whether visitors were challenged, badge checks enforced, and incidents reported.
Social Engineering Framework (Human Factor Analysis), PTES (Post-Exploitation)Reporting and recommendations
Findings are validated by a second reviewer. The report documents each attempt with evidence, outcome, employee responses, and prioritised recommendations.
PTES (Reporting), Social Engineering Framework (Reporting)Scope and deliverables
What is included, what is excluded, and what is delivered.
The statement of work defines the exact locations, access scenarios, and permitted techniques before the assessment begins. The lists below reflect the standard scope.
In scope
- Tailgating through secured doors and access-controlled entry points
- Social engineering of reception and on-site employees
- Visitor management and registration procedure testing
- Safe drop testing (controlled placement of a device inside the facility, where agreed)
- Restricted area access attempts within agreed boundaries
- Employee vigilance and security awareness observation
Out of scope
- Forced entry or destructive access methods
- Locations or areas not included in the agreed scenario definition
- Network or application exploitation (covered under penetration testing services)
- Email-based social engineering (covered under Phishing Simulation)
What you receive
- Executive summary Assessment scope, outcomes, and physical security posture written for leadership.
- Access attempt documentation Timestamps, photographic or video evidence, and outcomes per access attempt.
- Employee response observations Documented employee reactions per access attempt: challenge behaviour, badge enforcement, and incident reporting.
- Physical control assessment Evaluation of barriers, badges, cameras, and locks with identified weaknesses.
- Portal access Findings, report downloads, and project tracking through a dedicated platform.
- Findings meeting A scheduled session to align on physical security improvements and remediation priorities.
- Management report Condensed report for board-level stakeholders covering assessment outcome and recommendations.
Read more
How to choose your ethical hackers
Seven questions that reveal who will really test your systems.
What to expect during your first penetration test
The five stages from scoping to retest and what each asks of your team.
NDA and data handling during a penetration test
Confidentiality in the agreement, what the tester touches, and where findings are stored.
When independent assessment is the right step
An independent assessment is required ahead of an audit, a product launch, or a funding round, and the organisation needs documented evidence from a third party.
Digital platforms handle revenue, customer data, or service delivery, and the security of those platforms has not been validated by an external party.
Existing security controls have been implemented but have not been tested from an attacker perspective to confirm they work as intended.
Timeline
Illustrative durations to support planning. Confirmed in the statement of work.
The duration of a mystery guest assessment depends on the number of target locations, the complexity of the access scenarios, and whether the assessment is standalone or part of a broader multi-vector assessment. The calibration bands below are indicative.
What determines duration
- Number of target locations and restricted areas to be tested
- Number and complexity of agreed physical access scenarios
- Whether the assessment is standalone or combined with a scenario-based pentest
- Geographic distribution of target locations
- Whether safe drop testing or device placement is included
Actual duration is confirmed during scoping and depends on the number of locations and scenarios. A statement of work confirms the exact scope and timeline before the assessment begins. The final report is delivered within five business days after completion of testing.
Why Pentrox
The operational standards behind every mystery guest assessment.
These operational standards apply to every mystery guest assessment Pentrox delivers, regardless of scope or scenario complexity.
Controlled and non-destructive
Realistic testing within explicitly agreed boundaries.
All access attempts are authorised, non-destructive, and performed within boundaries agreed during scoping. Escalation contacts are defined in advance. Physical security is tested without risk to people or operations.
People, processes, and technology
Physical barriers, visitor procedures, and employee awareness. Tested together.
The assessment evaluates technical controls, procedures, and human factors. Weaknesses in one layer are tested in combination with gaps in another, reflecting how real intruders operate.
Direct access to the tester
No account managers between the client and the security expert.
Clients communicate directly with the consultant performing the assessment. Escalation situations are handled immediately through the contact agreed at kickoff.
Evidence-based reporting
Timestamped evidence for every access attempt.
Each access attempt is documented with timestamps, photographic or video evidence, technique description, and employee response. This evidence supports internal reviews and physical security improvement programmes.
Portal-delivered results
All findings accessible in the Pentrox Portal alongside digital assessment results.
Physical security findings are published in the Pentrox Portal alongside any digital assessment findings. The client team can review outcomes, track remediation, and download reports.
Frequently asked questions
Practical answers for security teams and procurement officers.
Is the assessment destructive or disruptive to normal operations?
All activities are non-destructive and performed within agreed boundaries. Access attempts use social engineering and exploit procedural gaps, not forced entry. Escalation contacts are defined in advance in case any situation requires immediate de-escalation.
Which standards does the assessment follow?
The assessment follows PTES for structured physical security testing methodology and the Social Engineering Framework for human factor analysis and attack execution. Standards references are documented in the report.
Can the assessment be combined with other services?
Mystery guest assessments can be combined with scenario-based pentests or red team assessments. Physical access can serve as an entry vector in a broader multi-vector attack scenario, testing the full chain from facility entry through network compromise.
What clearances do the testers hold?
All Pentrox employees undergo PES (Personnel Screening) background checks upon commencement of employment. Team members hold one or more industry-standard certifications such as OSCP, OSCE, OSWE, eWPTX, eMAPT, CPTS, CWES and BSCP. Authorisation documentation is carried during all physical access attempts.
Will employees be individually identified in the report?
The report documents employee responses in terms of roles and situations, not individual names. The objective is to identify systemic gaps in physical security awareness and procedures, not to attribute blame to individual employees.
Can the report be used as evidence for physical security compliance?
The report documents the scope, methodology, access attempts, and findings in a format suitable for submission to auditors. It provides evidence for physical access control validation and can support broader compliance programmes including ISO 27001 Annex A physical security controls.
How is assessment data handled and who has access to findings?
Findings, reports, and project data are stored in the Pentrox Portal, hosted on a dedicated VPS in a datacenter in the European Union. Access is controlled through mandatory two-factor authentication and role-based permissions. The client manages team membership. Data remains accessible for the lifetime of the client account and is removed only on explicit request.
Is the report delivered in Dutch or English?
Reports are delivered in English by default. Dutch-language reporting can be arranged when required. The statement of work confirms the reporting language before the assessment begins.
Related assessment categories
Scenario-Based Pentest
A predefined attack scenario executed to validate whether a specific attack path can reach critical assets.
Red Teaming
Full-scope adversary simulation across network, application, social engineering, and physical vectors.
Phishing Simulation
Controlled phishing campaigns that measure employee awareness and response behaviour.