Getting in is the least useful result of a pen test. Detection time, first-failure analysis, challenge rates, and the retest are what you are paying for.
Most companies buy a physical penetration test expecting a verdict: did they get in or not. That verdict is the least useful thing a test produces. Getting into a commercial building is rarely hard. What matters is everything that happened, and did not happen, between the sidewalk and the server room.
If you are hiring a team for physical penetration testing in Los Angeles, these are the measurements that make the test worth its cost.
The first number that matters is how long the tester operated before anyone noticed. Not whether someone eventually noticed, but when. Five minutes after entry is a different security posture than ninety minutes. A good report logs the timeline: entry, movement between floors, time on the target floor, and the moment of first contact with an employee or guard, if it ever came.
Compare that timeline to your own assumptions. If your response plan assumes an intruder is confronted within minutes, and the tester sat in a stairwell for forty, you have a specific gap to close rather than a vague feeling of failure.
Every successful test has a first failure, and it is almost never the door with the badge reader. It is the stairwell door that does not latch, the freight corridor that connects the dock to the elevator bank, the tailgate through a lobby turnstile at 8:45 in the morning when nobody wants to be rude. The report should reconstruct the full path and name the earliest point where a working control would have stopped the attempt.
That ordering matters because fixing the first failure is cheap and fixing the last one is expensive. A door closer costs less than a camera analytics platform.
Count how many people walked past the tester and how many asked a question. In most office tests, the answer is zero questions, and that is not a hardware finding. It is a culture finding. Employees in Los Angeles offices are not careless; they are polite, and politeness is what tailgating runs on.
The useful version of this metric feeds training. If nobody challenges an unfamiliar face, the fix is not more badges. It is giving staff a script and permission to use it: a friendly "can I help you find someone" is a real control.
A test exposes the difference between camera coverage and camera value. The tester should note which parts of their path were on camera at all, and your team should check afterward whether anyone or anything flagged the footage in real time. Recorded video of an intruder is evidence. Noticed video of an intruder is a response. Most buildings have the first and believe they have the second.
Los Angeles buildings run on vendor labor: cleaning crews, plant service, elevator maintenance, catering. The after-hours window, when a tower full of tenants is empty but the service elevator is busy, is often the easiest entry and the least tested. A daytime walk-in test tells you about your lobby. An evening test tells you about your building. Ask for both, or at least know which one you bought.
A test without a retest is documentation of a problem you may or may not have fixed. The value closes the loop: the same paths attempted again after the latch is repaired, the dock procedure changes, and the staff training happens. A firm that does not talk about retesting before the first test starts is selling you a story, not a control.
Ask how the report handles timeline and first-failure analysis. Ask whether the test covers after-hours and vendor paths. Ask what the retest looks like and what it costs. The answers tell you whether you are buying measurement or theater.
Braav runs physical penetration testing in Los Angeles built around these measurements, including the retest. Book a call to scope a test for your building.