If you’re a Raxis pentesting customer, I’ve likely met you while project managing your engagement. I schedule the engagements and keep the moving parts aligned so our clients get the report they need on the day they expect it. What I do not normally do is walk into a client’s office acting like I belong there and quietly start opening desk drawers and file cabinets. This year I did exactly that, and it changed how I think about what a red team really is.
Our pentest team invited me onto a red team engagement to help with the physical social engineering portion. I came away convinced that physical access is one of the most underestimated risks a company carries and that the physical piece only reaches its full value when it is woven into everything else a red team does.
Confidence Opens More Doors than Any Tool
The part that surprised me most was how easy it was to get in and establish a foothold. I am not a lockpick. I did not carry a bag of gadgets. I simply walked through a turnstile behind an employee who had just badged in and kept moving like I had somewhere to be. That is tailgating, and it works because most people do not want to be the person who challenges a stranger who seems as though they belong. In fact, I triggered an alarm in this instance, but no one tried to stop me, including a security guard who was no more than 20 feet away.
Once I was inside, the same posture kept working. I walked the floor at a normal pace. I made eye contact and gave a friendly hello. When someone glanced my way, I looked like I already knew where I was going, so they went back to their own work. I spent a long stretch of time in that office space. I looked through desks. I opened file cabinets. Nobody stopped me, and nobody asked who I was until I went back toward the end of the engagement just to see how hard I needed to push to get noticed.
The lesson landed hard for me as a project manager because I spend my days assuming that process and people catch problems. Here was a case where a confident stranger walked past all of it. If I could do that with no technical background and a calm face, imagine what a motivated attacker would do with real intent and real patience.
Why a Non-Technical Person in the Building is a Serious Problem
Here is the part that should worry any executive reading this. I am not a hacker, so I could not crack a wireless network or pivot through Active Directory if my job depended on it. But, and this was an eye-opener for me, I did not need to.
Because I could get into the building and move around freely, I became the delivery mechanism. A person like me can walk in, find a quiet corner, and plug a small device into an open network jack. From that moment, the people who do have deep technical skill no longer need to be anywhere near the property. They can work from a parking lot down the street or from another country entirely, and they have a foothold inside the walls.
That is the uncomfortable math of physical access. The skill needed to get inside, and the skill needed to exploit what is inside do not have to live in the same person. One quiet visitor with a friendly manner can hand the keys to a remote team that never shows a face on a camera. Splitting the work that way makes an attack easier to pull off and harder to spot.
Scouting the Ground so the Technical Team Moves Faster
My role went beyond getting in and looking convincing. While I was inside, I was scouting. I noted where the network jacks were. I noticed which areas were busy and which were quiet enough to work in without drawing attention. I paid attention to which doors led to secured spaces and how people moved through them.
All of that saved our pentesters real time. Instead of spending their limited time-boxed hours figuring out the layout, they arrived with a map of where to focus. In a red team engagement, the clock always matters, and every hour I removed from their reconnaissance was an hour they could spend on the work only they can do.
I also did something that made the technical testing possible in the first place. After I had tailgated into a secured area, I let the pentesters in behind me. That opened the door, literally, for the rest of the operation.
What the Technical Team Did Once They Were Inside
This is where the engagement stopped being about one confident guy in a hallway and became a full red team. The pentesters brought in wireless testing equipment so they could probe the client’s networks the way an attacker would. They placed Raxis Transporter devices onto the network, which gave certified testers remote access to keep working long after we left the property. They sat down in hotel offices with their own laptops and looked like ordinary employees while they scanned the network and mapped what they could reach.
That image stuck with me. Two people sitting quietly at a desk, laptops open, looking exactly like everyone around them, while they quietly cataloged the client’s internal systems. No alarms. No raised voices. Just work that looked like everyone else’s work.
The badge cloning effort ran in parallel. While I was proving that confidence alone could get someone in, the technical team was proving that the client’s access control could be copied and reused. The two approaches reinforced each other. If the badge system had held, confidence still worked. If confidence had failed, cloned badges were another way in. A real attacker would carry both options, and so did we.
The Pieces Only Matter When They Connect
The biggest thing I took away is that no single tactic tells the whole story. Physical social engineering got us in the door. Once inside, that access enabled wireless testing, network scanning, and the placement of remote devices that kept working after we left. Phishing and vishing test whether employees hand over access from their desks. OSINT and dark web reconnaissance tell an attacker who works there and where the soft spots are before anyone ever steps onto the property.
Each of these is interesting on its own. Strung together, they turn into something far more dangerous than the sum of the parts. OSINT tells the attacker which employee to impersonate. That impersonation gets a confident person through the door. That person drops a device. The device gives a remote team a network foothold. The remote team moves laterally toward the systems that actually matter. Every link raises the risk of the one before it.
That is exactly what a red team is built to reveal. A single-vector test shows you isolated gaps. A red team shows you how those gaps combine into a path an adversary would take. When a client sees the full chain laid out, from a friendly face at the door to remote access to their crown jewels, the conversation changes. It stops being about a checklist and starts being about how a real attack unfolds against their real people and their real building.
Why I Feel Lucky to Have Been Part of It
I went into this as the project manager who keeps all the pieces on schedule. I came out understanding the work in a way no status meeting could have taught me. Feeling the ease of that physical access and then watching the technical team turn it into a live foothold, gave me a respect for the whole operation that I carry into every engagement I run now.
Our client came away better for it. They saw the weak points in their physical security. They saw how a stranger could move through their space. They saw how quickly that access could become a network compromise. Most importantly, they saw where to focus their effort, and we left them with a clear picture of the gaps they could close.
I feel lucky that our team let me contribute and prouder still that my part helped make the test a success for the customer. More than anything, I now understand what a red team engagement really is. It’s not a single clever trick. Instead it’s physical social engineering, phishing, wireless testing, network testing (internal, cloud, and external), and OSINT working together to show an organization the truth about its defenses. Seeing that truth is the first step toward fixing the gaps.
If you have ever wondered whether a confident stranger could walk into your building and quietly hand your network to someone far away, that is precisely the question a Raxis red team is designed to answer. The engineers behind this series run real engagements every week. Let us show you what an attacker would find first, before a malicious one does.
