Physical Penetration Testing: When Human Trust Bypasses Layers of Security with a Simple Pretext

This article is part of an ongoing series from Sophos frontline security operations specialists, sharing the expertise they use to strengthen our industry-leading Managed Detection and Response (MDR) service and defend customers against evolving AI-era threats.

Every physical penetration test starts with the same quiet hope: that somewhere, between the polished lobby, the badge readers, the CCTV domes, and the confident hum of office life, there is a tiny gap no one has noticed.

This one had plenty of impressive controls. Badge readers. PIN pads. Security gates. Mantraps. Reception. Guards. Cameras. The sort of layered setup that makes people feel safe enough to stop thinking about it.

And that, as it turned out, was the real vulnerability.

The first plan was straightforward: capture a badge at the entrance. Nothing dramatic. Just stand close enough, blend into the commuter traffic, and let the technology do the work. We had the gear, the timing, and the patience. What we did not have was the right antenna for the particular flavor of legacy badge in use. After a few hours of walking loops, loitering politely, and pretending a laptop bag was just a laptop bag, it became clear that the clean technical approach was not going to be the way in.

So the plan changed.

If technology would not open the door, maybe people would.

That evening, we spent time watching the rhythm of the building. Every office has one. The early arrivals. The smokers. The coffee runners. The cleaners. The people who hold doors because they are decent human beings and because nobody wants to be the awkward person who says, “Sorry, who are you?”

We needed a believable reason to be at a secured entrance before the workday started. The answer came in the form of a simple maintenance pretext: one consultant dressed like a badge-reader technician, the other like a familiar employee type, smart outfit, branded-looking clothing, calm demeanor, and just enough confidence to make the story feel boring.

Boring is powerful. Nobody wants to get involved in boring.

Before sunrise, we were waiting near the entrance. The building was quiet in that strange early-morning way: too clean, too still, the kind of silence where every elevator ding sounds louder than it should. Eventually, the cleaning crew arrived with their trolley. We explained that the badge reader had been misbehaving and that we needed them to test their access.

The door opened.

For a brief moment, everyone looked surprised, including us, although we tried very hard not to show it. The trolley rolled forward, the door stayed open, and the first layer was behind us.

Then came the second layer: a security gate.

It was badge-controlled, which was inconvenient. But it also had a generous gap underneath, which was very convenient.

So, at an hour when most people were still asleep, two grown professionals in carefully chosen outfits crawled under a security gate and into a corporate office.

Not glamorous. Very effective.

Once inside, the atmosphere changed immediately. Outside, the building had felt like a fortress. Inside, it felt like any other office before business hours: desks, chairs, monitors, paper trays, meeting rooms, kitchen areas, and little islands of human habit scattered everywhere.

And that is where the real story began.

Sensitive documents were left out. Drawers were unlocked. Filing cabinets were accessible. Keys were sitting where keys should never sit. Confidential waste processes existed, but the evidence suggested they were not consistently followed. Workstations were left unlocked. Laptops were unattended. Access badges were sitting on desks like coasters.

The physical controls at the perimeter had created a strong first impression, but once that perimeter was crossed, the office trusted us almost completely.

We booked a meeting room and used it as a base. This is one of those tricks that feels absurdly simple: if you have a room, a laptop, and the confidence of someone who knows where the coffee machine is, people mentally file you under “probably supposed to be here.” From there, we took turns walking the floors, observing habits, checking exposed information, and learning how the office actually behaved when nobody thought anything unusual was happening.  

Some things went well for the defenders. The USB drive that we dropped was found and returned rather than plugged in. Reception challenged our suspicious stories. A fake contractor pretext was checked and rejected. A security guard escalated our after-hours presence instead of casually accepting it. These were good moments, the kind that prove awareness training can work when people slow down and verify. 

But other moments told a different story.

During lunch, badges were left behind on desks. A brisk walk was taken and for each badge, a small device was used to make contact and clone them within seconds. One of the badges later opened the door to a sensitive technical room. Suddenly, a plastic card forgotten beside a keyboard had become a key to critical infrastructure.

There was also the network port.

After hours, we went hunting for exposed Ethernet access. Most ports behaved properly, which was encouraging. Then one did not. A single misconfigured port gave us network access. From there, it was possible to capture encrypted authentication material and recover a user password offline. That was the moment the engagement shifted from “physical access risk” to “physical access can become logical compromise very quickly.”

To the organization’s credit, this activity did not go entirely unnoticed. The security operations team detected unusual activity and escalated it. That matters. Prevention had gaps, but detection showed signs of life.

Still, the most memorable part of the engagement was not the badge cloning, the server room, or the network access.

It was the day we decided to act suspiciously on purpose.

We moved furniture. Raised desks. Opened floor traps. Sat on the ground with short Ethernet cables. Walked into areas we should not have been in. Entered a sensitive room using a cloned badge. We made ourselves visible enough that someone could have asked a very simple question:

“Can I help you?”

No one did.

That question might be the cheapest security control in the building.  

Later, we tested a basement storage room. The door looked solid, but the gap underneath made it vulnerable to an under-door tool. The process was noisy, awkward, and not exactly subtle. People passed nearby. Nobody asked why two people were on the floor working at the bottom of a locked door. Eventually, the door opened.

Inside and nearby, another lesson appeared in shredded paper. The documents had been shredded, yes - but into strips long enough that words and numbers were still readable. It was a perfect metaphor for the whole engagement: the control existed, but the implementation did not fully solve the risk.

Finally, there was the QR code poster.

A harmless-looking seasonal poster was placed near the office, inviting people to vote on festive photos. It contained a tracking QR code. By the next morning, it had been scanned multiple times before someone removed it.

That small campaign summed up social engineering nicely. Curiosity is not a bug in people; it is a feature. Security programs have to account for it.

By the end of the week, the story was clear. The organization had invested in serious physical security, and several employees did exactly the right thing when challenged with suspicious situations. But security is not only about strong doors and badge readers. It is also about what happens after the door opens.

A badge left on a desk can become server room access.

An unlocked workstation can become data exposure.

A single network port can become domain visibility.

A strip shredder can become readable confidential waste.

A friendly habit of holding doors can become an intrusion path.

And a quiet failure to ask “Who are you?” can make all the expensive controls feel optional.

The takeaway is not that physical security failed completely. It did not. Some controls worked. Some people made excellent decisions. Detection eventually noticed part of the activity.

The takeaway is that layered security only works when every layer is alive: technology, process, people, and culture.

Because sometimes the attacker does not smash a window, pick a lock, or hack the badge system.

Sometimes they arrive early, wear the right outfit, tell a boring story, and crawl under the gate.

Want to know whether anyone in your office would ask “Can I help you?” Sophos Red Team has delivered thousands of offensive security engagements, and our Security Services Retainer lets you draw on everything from Offensive Security Services to DFIR & Readiness Services with the flexibility to pivot whenever your priorities change. We're happy to help.  If you enjoyed this real-world engagement story you will not want to miss this ~2 minute video about a recent bank heist.