Physical Penetration Testing & Social Engineering

Facility breaches that expose your physical security gaps before real attackers do.

Adversary Simulation Since 2011

Proven Expertise in Physical Penetration Testing

Since 2011, Raxis has led physical penetration testing and social engineering engagements, helping organizations worldwide find and close critical security gaps.

An unattended reception desk inside an office lobby

Battle-Tested Tactics

We’ve executed every physical tactic on our list in real engagements: canned air attacks on data center sensors, badge cloning, lock picking, under door tool bypasses, perimeter breaches, dumpster diving, and pretexting. Not theoretical. Proven.

US-Based, Experienced Pentest Engineers

More than a decade refining physical adversary emulation. The creativity, persistence, and precision of real threat actors, always within strict rules of engagement. Clear proof of risk. Actionable steps to eliminate it.

Physical Access Stories That Drive Change

Every engagement ends with detailed reporting, remediation guidance, and Hack Stories that bring the breach to life for executives. Real narratives that build awareness and secure budget for physical security improvements.

Physical Entry to Full Network Compromise

In real engagements, Raxis engineers have bypassed access controls with nothing more than pretexting and confidence, then deployed our custom Raxis Transporter for persistent remote internal access. Physical entry cascades into digital compromise fast. We show you exactly how.

Continuous Testing That Builds Resilience

Raxis Social Engineering as a Service (SEaaS) delivers ongoing, unpredictable physical simulations all year. Unlike one off assessments that fade from memory, SEaaS embeds security awareness into your culture and delivers measurable improvements in your human defenses.

The Human Layer Technology Can’t Patch

Your people are your most exploitable attack surface. Our physical penetration testing uncovers vulnerabilities that no firewall or endpoint agent will ever detect: onsite impersonation, facility infiltration, and trust exploitation.

See the Full Blast Radius

Raxis goes beyond proving entry. We show how physical access escalates to credential theft, device implantation, and network compromise, giving you the evidence to prioritize defenses where they matter most.

Reports You Can Act On

Visual evidence. Technical remediation steps. Executive summaries. No noise, no false positives. Just clear findings your teams can address immediately and present to stakeholders with confidence.

Turn Failures into Training Wins

Our approach turns failures into learning moments. Guided training that builds employee confidence and an organization resilient to physical security threats.

Led by Red Team Engineers

Every physical test is run by career Red Team operators with real offensive experience. Creative pretexts and tactics generic assessments can’t match.

Core to Red Team Operations

Physical access chains into full compromise: network implants, data exfiltration, domain level access. Raxis demonstrates these attack chains in MITRE ATT&CK aligned scenarios.

Standalone or Full Scope

Run a focused facility assessment on its own, or fold physical testing into a broader Red Team engagement with phishing, spear phishing, and vishing.

Tailgating, Cloning, and Talking Our Way In

We go far beyond basic tailgating. Every one of these has been executed in real engagements. Ask us to tell you stories.

Tailgating & Pretexting

Following employees through secure entrances. Talking past reception and guards with cover stories built from OSINT and onsite recon.

Badge Cloning & Access Bypass

Cloning legitimate badges for unrestricted entry into server rooms, executive suites, and data centers.

Canned Air Attacks

Inverted canned air dusters triggering motion sensors and request to exit mechanisms to open secured doors, including data centers.

Onsite Impersonation & Loitering

Posing as vendors, contractors, or IT support. Exploiting trust to access workstations, retrieve keys, and harvest written passwords.

Device Implantation

Planting covert Raxis Transporter devices for persistent remote network access. The bridge from facility entry to full digital compromise.

Lock Picking & Bypass

Picking mechanical locks and bypassing electronic keypads on doors, cabinets, and safes to reach restricted physical assets.

Under-Door Tool Attacks

Specialized tools slid under doors to manipulate internal handles, latches, or crash bars. Bypassing locks entirely with no evidence of entry.

Fence & Perimeter Breaches

Exploiting weaknesses in perimeter fencing and electronic gates to gain initial site access undetected, often outside camera coverage.

USB Drop Attacks

Baited USB devices placed in parking lots, break rooms, and common areas. Testing employee curiosity and device handling protocols.

Camera & Sensor Evasion

IR illuminators, reflective materials, and timing based techniques to defeat surveillance cameras and motion detectors during infiltration.

Dumpster Diving

Searching trash and recycling for sensitive documents, passwords, access cards, or operational intel that aids further infiltration.

Request-a-Badge or Help Pretext

“Forgot my badge.” “New contractor, first day.” Believable stories that get employees to badge us directly into restricted areas.

How We Run a Physical Engagement

Confidence gets us through the door, but a documented method is what makes the results useful. Every physical engagement follows the same disciplined process, aligned to MITRE ATT&CK and PTES, so findings are repeatable, defensible, and ready for your auditors. Here’s how a Raxis physical test unfolds.

1. Scoping and Rules of Engagement

We define targets, off-limits areas, testing windows, stop conditions, and emergency contacts with you up front. You sign an authorization letter our engineers carry onsite, so a test never becomes a real incident.

2. Reconnaissance and OSINT

Before anyone arrives, we study your locations, employees, vendors, and routines from public sources and remote observation, building the cover stories and timing that make an intrusion believable.

3. Onsite Infiltration

Our engineers attempt entry using the agreed tactics: tailgating, pretexting, badge cloning, lock bypass, and more. We adapt in real time the way a determined attacker would, escalating only as far as scope allows.

4. Escalation and Impact

Getting in is the beginning. We show how physical access chains into credential theft, device implantation, and network compromise, proving the true blast radius rather than stopping at the lobby.

5. Reporting and Debrief

You receive visual evidence, an executive summary, and prioritized remediation steps, followed by a walkthrough with our team. No false positives, just clear proof and a path to fixing it.

6. Retest and Training

After you remediate, we validate the fixes. We also turn each finding into a teaching moment, building the awareness that keeps employees from falling for the real thing.

How Hackers Bypass Physical Security

Raxis CTO Brian Tant shows how simple tools like badge scanners and hidden cameras can infiltrate secure facilities, revealing how vulnerable physical security is without proper defenses.

How Badge Scanners and Hidden Cameras Help Hackers Past Your Security (video)

How Pentesters Walked Into a Secured Office Building Twice

Raxis Hack Stories

Our stories are based on real events encountered by Raxis engineers. Some details have been altered or omitted to protect customer identities.

When our penetration testing team dives into physical social engineering, whether a focused PSE test or a full Red Team operation, confidence is our secret weapon. We’re often stunned at how many people accept that we belong simply because we act like we do. Even more striking? The number of people who spot something off but don’t raise the alarm. As our tests ramp up, we push with bolder moves, daring employees to call us out. Spoiler: they rarely do.

On one assignment our team was tasked with infiltrating a sleek, big-city high-rise with a break room so stocked with free eats that employees practically lived there for breakfast and lunch. Our team did their homework, scoping out every detail before arriving onsite. On a bustling Monday morning, they slipped in one by one, tailgating through turnstiles and blending into crowded elevators before the guard could figure out what was happening. Each operative strolled onto the target floor, flashed a charming wave at the receptionist, and proceeded to regroup in that legendary break room. Then they split up to take a look around the floor. Unlocked workstations? Check. Sensitive customer documents left on a printer? Check. After gathering proof for the customer’s report, they glided out one by one, leaving no trace and not a single soul batted an eye.

In another operation, our team targeted an office secured by key card access. The plan? Pure audacity. They grabbed coffees from a local shop across the street and loitered by the parking lot entrance just before the 5pm rush. Sipping their coffee inconspicuously, our team chatted like they were waiting for a buddy to clock out. No aggressive moves, just casual vibes. Sure enough, several employees held the door for them. As the crowd thinned, they offered their thanks and slipped inside. For an hour, they laid low under a conference room table, biding their time before exploring. What did they find? A treasure trove of vulnerabilities: unlocked file cabinets stuffed with sensitive customer data, passwords scrawled on notes tucked under keyboards, a visitor badge stashed in a desk drawer, open network ports perfect for planting a network implant device (of course they did that), and even keys to the data center left in an unlocked cabinet. Our team made use of those keys to drop a second device for good measure. The cleaning crew? They just waved as our team worked. Hours later, our team sauntered out, armed with a visitor badge for a potential encore and leaving devices in place for further exfiltration.

FAQ: Physical and Social Engineering Testing

What is physical penetration testing?

A controlled security assessment where Red Team engineers attempt to breach your facility using the same tactics real adversaries use: tailgating, badge cloning, lock picking, pretexting, and device implantation. The goal: find exploitable physical security gaps and demonstrate real business impact before a malicious actor does.

How is physical penetration testing different from a digital pentest?

Digital pentests target networks, applications, and cloud infrastructure remotely. Physical penetration testing targets your buildings, access controls, employees, and onsite security in person. They're complementary, and Raxis often finds that physical access is the fastest path to full network compromise.

Should we fix known issues before testing?

No better time than now. If you have known gaps, a Raxis physical penetration test gives your leadership the documented proof they need to prioritize budget. And our assessments consistently uncover hidden vulnerabilities beyond what you already know about.

What if our employees fail?

We frame results as training, not judgment. The employee who falls for a Raxis pretext is often the least likely to fall for a real one afterward. Our reports document each tactic and response, powerful material for building a security aware culture when used positively.

How does physical penetration testing reduce business risk?

By showing exactly how an attacker would breach your facility, we identify and prioritize vulnerabilities before they're exploited. Employees who experience simulated attacks take security seriously afterward. The result: stronger access controls, better awareness, and documented proof for compliance and stakeholder reporting.

Can we scope the test to exclude certain areas?

You control the scope. But we recommend including leadership and sensitive areas, they're prime targets in real attacks, and excluding them creates blind spots. Raxis works with stakeholders beforehand to set clear objectives and boundaries.

What’s the difference between physical penetration testing and phishing?

Physical testing targets your facility: access controls, badges, locks, front desk. Phishing testing targets your people through digital channels: email, phone calls, and spear phishing. Both test the human element through different attack vectors. Raxis offers both standalone or combined in a full Red Team engagement.

How often should we test?

At least annually, or after significant changes to your facility, access controls, or security policies. For high risk organizations like financial services, healthcare, and critical infrastructure, Raxis offers SEaaS for ongoing, unpredictable physical testing all year.

Is physical penetration testing legal, and are we liable if something goes wrong?

Yes, it's legal because you authorize it. Every engagement runs under a signed authorization letter and agreed rules of engagement that define scope, boundaries, and stop conditions. Our engineers carry that letter onsite, so if they're stopped, your team can confirm the test immediately. Raxis is fully insured, and in over a decade of engagements we've maintained a clean safety record.

Does physical penetration testing help with compliance?

It does. PCI DSS Requirement 9, HIPAA physical safeguards, SOC 2, and most cyber insurance questionnaires all expect controls over physical access. A Raxis physical test gives auditors documented proof those controls actually work, not just that a policy exists on paper.

What methodology do you follow?

Every engagement follows a documented process aligned to MITRE ATT&CK and PTES, covering scoping, reconnaissance, infiltration, escalation, and reporting. That structure keeps results repeatable and defensible, whether you run a standalone facility test or fold it into a full Red Team operation.

How long does a physical penetration test take?

Most single-location tests run three to five days onsite, plus reconnaissance beforehand and reporting afterward. Multi-site engagements and full Red Team operations scale from there. We size the timeline to your scope during planning.

What happens if your engineers are caught or confronted onsite?

That's a win, not a failure; it means your people did their job. Our engineers de-escalate immediately and present the signed authorization letter to verify the test. We document every detection in the report, because knowing which employees spotted us and how they responded is some of the most valuable data an engagement produces.