Confidential physical penetration testing for UK sites
We test your building the way a real intruder would, quietly and under a written agreement. Then we show you every way in and how to close it. We have worked in security across the UK since 1998.
Free and with no obligation.
- Vetted testers
- Operating since 1998
- 4.9 on Google
- 020 3794 8182
What a physical penetration test covers, start to finish
Physical penetration testing, or physical pentesting, is a planned and authorised attempt to get into your building as an intruder would. Testers try your doors, passes and people. Across the UK, Double Check Security Group runs these tests under a written agreement, ranks every way in by risk, and has worked in security since 1998.
Physical security testing starts where people really walk in
Most businesses expect an intruder to try the front desk. In fact, reception is often the best-guarded part of a building, and reception security testing tends to show those staff stop strangers well. The easy ways in are usually the side door, the loading bay, the smoking shelter and the fire exit left open on a warm day.
Most intruders get in past a helpful person, not a lock. Someone holds a door for a visitor carrying boxes, and the visitor is in. The Verizon 2025 Data Breach Investigations Report (opens in a new tab) found that 60% of breaches involved a human element. A physical test shows you that human side in your own building, and you can read more about the physical threats UK businesses face most.
What a physical pen test checks, from fire exits to bins
A physical pen test checks your perimeter, your ways in, your people and what an intruder could reach once inside. Perimeter security testing comes first, then the test moves inward. Each test is scoped to your site and can include:
- Perimeter and doors
- Fences, gates, fire exits, loading bays and doors that should lock but stay open.
- Passes and locks
- Cloned RFID access cards, master keys and locks that open with simple tools.
- People
- Tailgating, posing as a contractor or courier, and watching people type at screens and keypads.
- Inside the building
- Meeting rooms, server and comms rooms, open network ports, desks and confidential waste bins.
You choose which of these are in scope, and testers stay inside what you agree.
A typical test route, from smoking shelter to comms room
Here is how a test can unfold on an ordinary office site. It is a typical pattern built from how buildings are used day to day, with no client details in it.
-
Smoking shelter8.40am
A tester arrives at 8.40am in a hi-vis jacket and waits by the smoking shelter at the back.
-
Side door
When a member of staff heads back in, the tester follows through the side door and thanks them for holding it.
-
Meeting room
Inside, an empty meeting room has a live network port and a laptop left unlocked.
-
Second floor and comms room
On the second floor, a cleaner's cupboard opens with a common key, and the comms room next door is propped open for a contractor.
What people say about us on Google
These reviews come straight from our Google profile. They cover our wider security work, because pen test clients stay private.
4.9on Google
Every test is agreed in writing before anyone tries a door
Every test runs to a written agreement made with you before it starts. No two sites are the same, so the timing, depth and methods are set in that agreement. This keeps the test lawful, controlled and safe for your day-to-day work.
Very little preparation is needed on your side. The fewer people who know, the more true to life the result.
Scoping call
We talk through your site, your concerns and what you want to learn.
Written agreement
It sets the scope, the areas that are off limits, the dates, who on your side knows, and who to call if a tester is challenged. Where testing may touch computers, it says so, in line with the Computer Misuse Act 1990 (opens in a new tab).
Quiet planning
Testers study the site as an outsider would, using what anyone can see or find.
The test
Testers try the agreed routes in and record what happened, with times and evidence.
The report
You receive the findings, ranked by risk.
Vetted testers who keep your findings private
Every physical pen tester we send is vetted before they set foot on a client site. Checks cover identity, criminal record and a five-year work history, and the same checks apply to anyone who joins through our careers page. Our testers come from a range of security backgrounds, so we match the right specialist to your site and your brief.
Your results stay between you and us. We keep client names, case studies and findings off our website and out of our sales material, which is why this page shows none. That discretion is part of how we have worked since 1998, and your report gets the same care.
A physical security penetration testing report your board can use
A physical penetration test report from us shows what was tried, what worked and what to fix first. It is written in plain English, so a facilities manager and a board member can both act on it.
Each report covers:
- An executive summary at the front, which gives senior managers the headline fast.
- What testers learned while planning.
- Each step they took and what happened.
- Evidence for every finding, such as photos and times, plus a risk score and a clear next step.
- A risk ranking that shows which fix buys the most security for the least spend, so your budget goes where it counts.
Areas Covered
Where Do We Provide Corporate Security?
We cover buildings nationwide, including major cities across England, Scotland and Wales. Wherever your offices sit, we can put trained officers at the door.
Explore the areas we cover across the UK or speak with our London security teams.
Assessments are free, with no obligation to proceed.
Not sure whether we cover your building's location? Get in touch. We can confirm cover for your city or region before you book.
Findings you can act on with guarding and 24/7 monitoring
We also run security guarding, CCTV monitoring and key holding, so the fixes in your report are work we do every day. Our control centre runs 24 hours a day, 365 days a year. If your report points to slow alarm response or cameras nobody watches, the answer is under the same roof.
Many fixes are about habits, not new kit. Think of staff who ask strangers who they are, visitors who are escorted, and clear rules for contractors and cleaners who hold keys after hours. We run cleaning and facilities management too, so we know those after-hours routes well. You are free to use your own teams for any fix, and you can also review how your current guarding performs.
Physical penetration testing services that support ISO 27001 audits
Physical penetration testing gives you real evidence for the physical controls in ISO 27001. The 2022 version lists 14 of them in Annex A, from secure perimeters to clear desks. Control 7.4, physical security monitoring, was new in 2022. A test shows whether your monitoring spots an intruder in real life.
We test
- Offices
- Financial firms
- Data centres
- Shared office buildings
- Shops
- Factories
- Schools
- Universities
- Public buildings
Most clients book after a move, a refit, a new access system or an incident, or as a yearly check.
How much does a physical penetration test cost?
The cost of a physical penetration test depends on your site and your brief, so we price each one after a free scoping call. The main things that shape the price are:
- Sites
- The number of sites and their size.
- Scope
- How much is in scope, from the perimeter alone to people and inside access.
- Timing
- Day, night or weekend testing.
- Team
- How many testers and days the brief needs.
- Report
- How much detail the report needs.
You get a clear quote before anything is agreed, and you are free to decide in your own time.
Common questions
Questions buyers ask about physical pen testing
Clear answers on the law, disruption, how often to test and where we work.
020 3794 8182Is physical penetration testing legal in the UK?
Yes, when it is authorised. Every test runs under a written agreement with your organisation that sets the scope, the dates and who to call if a tester is challenged. Where testing touches computers, the agreement covers that too.
Will a test disrupt our staff or our building?
Tests are planned to be quiet. Testers follow the rules in the agreement, including any areas or methods you want left alone, and normal work carries on around them. Most staff only hear about the test when you choose to share the results.
How often should we run a physical pen test?
Once a year is a sensible baseline for most sites. Test again after any big change, such as a move, a refit, new access control or new reception staff, because each one changes how people come and go.
How is physical testing different from cyber penetration testing?
A cyber penetration test attacks your systems and networks from outside. A physical test checks whether someone can walk in and reach those systems in person, through doors, passes and people. Many organisations run both, because a stranger at an unlocked desk sits behind most online defences.
Do you run physical red team exercises?
Yes. A red team exercise is a longer test built around a goal, such as reaching a named room or a server, using a mix of agreed methods. We scope it in the same written agreement as any other test.
Do you test sites in London and across the UK?
Yes. We test sites in London, where our head office is, and in towns and cities across England, Scotland, Wales and Northern Ireland. Tests across several sites can run under one agreement.
Request a call back about a pen test.
