Physical pen testing is not network pen testing. What to ask about authorization, rules of engagement, reporting, insurance, and facility fit before you hire a firm.
Search for a penetration testing company and most results will be cybersecurity firms testing networks. Physical penetration testing is a different discipline: people, on foot, trying to get into your building. The two services share a name and almost nothing else, so the first job in hiring is making sure you are evaluating the right kind of firm.
A legitimate physical pen test begins before anyone touches your door. Expect a written authorization, often called a get-out-of-jail letter, that names the testers, the dates, and the scope. Expect agreed rules of engagement: which buildings, which hours, which methods are in bounds and which are not, who at your company knows the test is happening, and what happens if a tester is stopped by police or your own guards. A firm that treats this as a formality will treat your facility the same way.
The report is the product. A useful one shows each entry path attempted, how far it got, what stopped it and what did not, with photos or timestamps where lawful and appropriate, and a prioritized remediation plan your facilities team can execute. Ask for a sanitized sample. If the sample is a two-page letter saying entry was achieved, keep looking.
A firm that mostly tests data centers runs a different playbook than one that mostly tests hotels or hospital campuses. Ask what facility types they test most, and listen for specifics: turnstiles and visitor desks in multi-tenant towers, escort policy and mantraps in data centers, back-of-house routes in hospitality. Generic answers about social engineering are a red flag.
The firm should carry liability coverage sized for physical entry work, and should be able to explain how it handles safety: no weapons simulation without explicit sign-off, no methods that endanger staff, and a deconfliction plan so your guards and local law enforcement are handled correctly if an alarm trips. Discretion matters twice: during the test, and afterward in how findings are stored and shared.
Be cautious of firms that guarantee entry, that lead with network testing and treat physical work as an add-on, that skip rules-of-engagement paperwork, or that cannot explain their remediation deliverable. A test that ends with a story instead of a fix list is entertainment, not security work.
Braav's testers run authorized physical penetration tests for offices, campuses, hotels, healthcare facilities, and data centers, with written rules of engagement and a remediation plan on every engagement. See how we work in Los Angeles, or schedule a call to scope a test.