In a multi-tenant tower, the first layer of security belongs to the landlord, not to you. What a San Francisco penetration test actually probes, who has to authorize it, and what to ask for in the report.
Most physical penetration tests fail or succeed at the same place: the boundary between public space and private space. In San Francisco, that boundary is rarely yours. The city's office stock is dominated by multi-tenant towers, where the lobby, elevators, loading dock, and stairwells belong to the landlord and only the suite belongs to you. That split changes what a test looks like and who has to authorize it.
In a single-tenant building, the front door is your front door. In a San Francisco tower, the first layer of security is the building's, not yours: a lobby guard you did not hire, turnstiles you do not control, elevator banks shared with a dozen other companies. A tester does not need to beat your badge reader if they can ride the elevator to your floor and walk up to your suite door.
The seams a test actually probes are predictable. Tailgating behind a badge holder at the turnstiles during the morning rush. Elevators that let anyone select any floor, with badge control starting only at the suite. A loading dock where a clipboard and a hi-vis vest get waved through. Stairwell doors that lock from the floor side but open from the stair side on every level. None of these are exotic. They are the normal state of a shared building.
A useful test maps each path from the sidewalk to your suite and probes them at different times: lobby approach at 8:45am when the turnstiles are busiest, midday when the lobby is quiet and a lone visitor stands out, the loading dock during delivery hours, and after-hours re-entry when the building shifts to a different security posture. Each path ends at a different control: the turnstile, the elevator, the stairwell door, your reception desk, your suite lock.
Because the test crosses landlord territory, authorization has to as well. Your signature covers your suite. The property manager's covers the lobby, dock, and common floors. A test run without both is not authorized, full stop. Our post on rules of engagement covers the paperwork side in detail; the San Francisco wrinkle is simply that there are two signatures to collect instead of one.
San Francisco's offices still have many floors sitting empty, a hangover from 2020 that has not closed. For a tester, an empty floor means fewer witnesses and more places to pause unobserved. For you, it means the building's natural surveillance, other tenants seeing a stranger, is weaker than it used to be. It also means more construction: tenant-improvement work brings propped doors, unlocked suites under buildout, and workers who are legitimately unfamiliar to everyone. A good test includes the construction floor scenario, because it is the one that works most often.
The most useful deliverable for a tower test separates findings by who can fix them. Landlord-side findings, turnstile policy, lobby guard procedure, dock access, go to the property manager, and your leverage there is as a tenant, not an owner. Tenant-side findings, suite door policy, reception challenge procedure, visitor handling, after-hours access, are yours to fix this week. A report that lumps them together leaves you negotiating with a landlord about problems you could have solved internally.
When you scope a test, ask how the findings will be split, and ask which scenarios are planned for your building's specific layout. A tester who has not asked for your floor plan is planning a generic test.
Braav runs authorized physical penetration tests for offices across California, including multi-tenant towers in San Francisco, always with written rules of engagement from every party whose space the test touches. See how we work on our San Francisco physical penetration testing page, or book a consultation to scope a test for your building.