Inside in Three Hours: A Physical Penetration Test Reveals What Technology Alone Cannot Protect

The client is a globally recognized leader in cybersecurity software – a company whose core business is protecting digital identities and privileged access for some of the world’s largest organizations. Their Americas headquarters operates in a modern commercial office environment with a staffed security desk and electronically secured internal access points.

Despite a sophisticated digital security posture, leadership recognized that physical security and human factors warranted independent validation. The question they needed answered was straightforward: could an unauthorized individual gain access to their facility, and if so, how far could they get?

The answer, as it turned out, was further than anyone expected.

Convoy Group conducted this engagement using a disciplined soft-approach methodology – no technical defeat devices, no badge cloning, no forced entry. The goal was to replicate what a motivated, reasonably resourceful threat actor could accomplish using only observation, patience, and social engineering.

Phase 1: Pre-Engagement Reconnaissance

Prior to the on-site visit, open-source digital reconnaissance was conducted against the target organization. This surface-level research – the same kind any motivated individual could perform – yielded an active job posting for an open position at the facility. That single piece of publicly available information became the pretext for the entire engagement.

Phase 2: Facility Entry

On the day of the assessment, the Convoy operator approached the building during normal business hours. The lobby security desk was staffed. Entry was achieved by observing foot traffic patterns and timing an approach to follow a legitimate employee through the entrance, a technique commonly referred to as tailgating. No confrontation occurred. No questions were asked.

Upon reaching an upper floor with electronically secured access points, the operator waited for an employee to exit, then used a door-hold technique to prevent the door from fully latching. Once the employee cleared the area, unescorted access to the secured floor was established.

Total time from building approach to secured floor access: under 15 minutes.

Phase 3: On-Site Operations

Over the next three hours, the Convoy operator moved freely throughout the facility. Photographic documentation was gathered of sensitive areas, workstations, posted materials, and other items that would be of interest in a real intrusion scenario. At no point was the operator stopped, questioned, or asked to present credentials.

Social engineering interactions were conducted with eight employees across different areas of the office. The operative pretext – a new hire awaiting afternoon onboarding with a named HR representative – was accepted without challenge in every instance. The HR contact’s name had been obtained organically through conversation earlier in the engagement.

The engagement reached its most revealing moment when the pretext had progressed to the point that employees were actively facilitating what amounted to an informal onboarding experience. The operator had lunch with a group of employees – welcomed as a colleague, not regarded as a threat.

Findings were documented and delivered in a tiered format reflecting severity and remediation priority:

Following the assessment, Convoy Group conducted a live debrief first with the employees who had been engaged during the test, then separately with organizational leadership.

The employee debrief produced a reaction that is, in the experience of Convoy’s team, entirely typical — and entirely instructive. The room moved through a rapid sequence of embarrassment, genuine shock, and in some cases a degree of defensiveness. These are natural responses. They are also exactly the kind of responses that signal a security awareness gap that training and policy can address.

The goal of the debrief is never to shame – it is to make the abstract concrete. Employees who experience a physical penetration test firsthand are measurably more receptive to security awareness training than those who only read about the concept. The moment the operator walked back into that room and revealed what had happened, the training had already begun.

A formal written report with tiered findings, detailed methodology, photographic evidence, and prioritized recommendations was subsequently delivered to leadership.

This engagement is a study in a gap that exists across virtually every industry, including – perhaps especially – organizations that are highly sophisticated in their digital security practices. Technology secures systems. People secure buildings. And people, without proper training, policy reinforcement, and a genuine culture of security awareness, are consistently the most exploitable element of any physical security program.

The threat actor in this scenario carried no tools, no credentials, and no inside knowledge beyond a single public job posting. What they carried was patience, situational awareness, and the confidence to behave as though they belonged. That combination, in this environment, was sufficient to sustain a three-hour undetected presence inside a secured corporate facility.

• Pre-engagement open-source reconnaissance
• Facility entry attempts using realistic, non-destructive methodologies
• Social engineering of personnel across multiple departments and roles
• Photographic documentation of access achieved and sensitive exposures identified
• Live employee and leadership debrief
• Formal written findings report with tiered severity and prioritized recommendations

We operate nationally. Whether your facility is a corporate headquarters, a regional office, a campus, or a critical infrastructure site, Convoy Group brings the same disciplined methodology and professional discretion to every engagement.

Schedule a security consultation today by reaching out to us at info@convoygroupllc.com