An assessment tells you what to fix. A physical penetration test tells you whether what you have actually works. Most buildings need them in that order. Here is how to decide.
Two services get confused more than any others in physical security: the security assessment and the physical penetration test. They sound interchangeable. They are not, and buying them in the wrong order wastes money.
A security assessment is a systematic review of everything that protects your building: perimeter, parking, lobby and visitor management, badge and turnstile controls, camera placement and retention, alarm response, guard post orders, and emergency procedures. The output is a prioritized list of gaps, ranked by risk, with specific fixes.
A physical penetration test is narrower and more aggressive. Authorized testers try to get into your building the way a real adversary would: tailgating through turnstiles at peak traffic, presenting as vendors at the loading dock, working service corridors and stairwells, testing roof access and after-hours doors. The output is a record of every entry path that worked, how far it went, and what stopped it or did not.
Put plainly: an assessment tells you what to fix. A penetration test tells you whether what you have actually works.
Most buildings should start with the assessment. If you have never had a structured review, if you just moved into a new facility, if you had an incident and patched it ad hoc, or if you are building next year's security budget, you need the full picture before you test any piece of it. Testing one door in a building with a broken camera policy and outdated post orders tells you about the door.
An assessment also gives you the documentation most insurers, landlords, and compliance regimes actually ask for. California employers mapping to SB 553, Texas healthcare facilities working under SB 240, and New York retailers covered by the Retail Worker Safety Act all need written assessments as part of compliance, not just test results.
A test pays off when you already believe your controls are good and want proof. That usually means a mature program, recent upgrades you want validated, high-value assets like labs or data floors, or a board or insurer asking for evidence rather than policy. It also fits buildings that share perimeters: multi-tenant towers, campuses with common garages, facilities with heavy vendor traffic. Shared access points fail in ways paperwork never predicts.
A penetration test without an assessment finds holes but gives you no program to fix them. An assessment without a test assumes your controls work, and controls on paper fail more often than controls in practice. If the budget allows one, take the assessment first and schedule the test after the fixes land. Testing a building you already know is broken confirms what you know.
For many organizations the right sequence is a full assessment, remediation, then a test to verify. If you need a fast first look, a remote video-based assessment returns a report in 24 hours and tells you whether a deeper engagement is worth it.
Braav runs both, across California and in major metros by arrangement. See how we work in Los Angeles, or schedule a call to scope an assessment or a test for your building.