Badge readers work. The habits they create are what fail. What a physical penetration test measures on a badge-controlled San Diego campus.
San Diego runs on badge readers. The defense contractors, shipyards, and engineering firms that anchor the region's economy work behind fences, turnstiles, and badge-controlled doors. Employees badge in so many times a day they stop seeing the system at all.
That is exactly what a physical penetration tester counts on.
A badge-controlled campus builds a habit: the door opens for people who belong. After enough repetitions, belonging stops being checked. The person behind you at the turnstile gets a held door. The visitor without a badge gets pointed to the lobby rather than walked there. The propped side gate during a delivery goes unmentioned because it is convenient for everyone.
None of this is a technology failure. The readers work. The failure is that a well-run access system teaches people to trust it, and a test measures whether that trust holds.
A physical penetration test on a badge-controlled site is less about defeating hardware and more about using the culture the hardware created. Following an employee through a door they opened. Wearing the vendor badge from yesterday's visit. Arriving at shift change, when a hundred people funnel through and nobody looks at anybody. Asking the receptionist for the person whose name is on the directory in the lobby.
Each attempt answers a specific question the client asked for: can someone get past the perimeter, past the lobby, to the floor, to the server room? Every step is agreed in advance, in writing, before anyone tries a door.
The value is not the story of how the tester got in. It is the map of where the habits break: which door, which hour, which role held it open. A good report names each gap, pairs it with a fix that fits the site, and gives security leadership something they can act on Monday morning.
Retesting after the fixes is what turns one physical penetration test into a program.
Braav runs physical penetration tests for San Diego's defense-adjacent campuses, engineering firms, and offices, with rules of engagement set in writing before anyone approaches a door. If your site badges everyone in and you want to know whether that holds, book a consultation.