What We Assess
Testing focuses on the controls that decide who can get in, and what happens once someone does.
How We Test
We group testing into four areas. The specific techniques are examples, used only when authorized and in scope.
How the Engagement Works
A physical assessment combines on-site testing with reporting built for the people who have to fix what we find.
What Clients Receive
Executive summary with an overall risk picture
Goals, dates, and scope
Tests performed
Findings with identifier, severity, and number of instances
Description and evidence for each finding, including photographs
Steps to recreate each finding
Actionable remediation guidance
Reference resources for each finding
Severity definitions from Critical to Informational
Letter of Attestation, where applicable
Findings review, when requested or appropriate for the engagement
Standalone or Combined
Physical security assessment is a standalone Red Sentry service. It can be paired with other services, each scoped separately based on your objective:
Social engineering campaigns (pretexting and human-focused testing when personnel interactions are part of the objective)
Internal network pentesting
Wireless security testing, when proximity or on-site access is relevant
Red team engagements, when physical access is one tactic within a broader objective-driven adversary simulation
As a standalone assessment, it tests the doors, locks, sensors, and procedures that application and network testing never touch. Paired services are not part of the assessment automatically, so the scope reflects your objective.
HOW WE WORK
Physical assessments are scoped around your locations, objectives, and rules of engagement. Request a scoped assessment for an effort-based quote.
Number of locations and site types
Whether in-person social engineering of staff is in scope
Whether testers may connect to network jacks or place authorized devices after entry
Objective or success criteria, such as entering the facility, reaching a server room, accessing the corporate network, or placing an authorized device
Who at your organization knows about the test
Existing controls, such as guards, cameras, turnstiles, badge readers, alarms, and biometrics
On-site and after-hours emergency contact
Testing windows, and occupancy or staffing during each window
Authorization letter requirements
Techniques allowed, and people, areas, equipment, or techniques that are off limits
Frequently Asked Questions
How is physical testing authorized?
In writing. Before testing starts, we agree written authorization and rules of engagement covering authorized locations and entry points, allowed techniques, testing windows, off-limits people and areas, and an emergency contact. A formal Letter of Authorization is part of the process where testers need one.
Do you test the network too?
Only if it is part of the agreed scope. A physical assessment focuses on whether controls, people, and processes prevent unauthorized access. If you want testers to connect to network jacks or assess internal systems after entry, we define that up front and can pair the assessment with internal network pentesting.
What does the report include?
An executive summary, the tests performed, and each finding with severity, photographic evidence, steps to recreate it, and remediation guidance. A Letter of Attestation is included where applicable.
What happens after we fix the findings?
Remediation testing is not included by default for physical assessments. Because it requires on-site mobilization and coordination, any follow-up validation or return visit is scoped separately.
How long does a physical assessment take?
Timing depends on the number of locations, the entry points and techniques in scope, and the agreed rules of engagement. We confirm the expected effort and testing window before the engagement begins.