Skip Ribbon Commands
Skip to main content
Home > Services > Profiling > Physical Security Assessment


Physical Security Assessment


Physical Security Assessments are a holistic look into the overall physical security of buildings, facilities and locations. SecureState evaluates all the physical security controls in place at locations that are in scope. For example, our staff evaluates access control systems, security guards, CCTV cameras, access badges, locks, security lighting, fences and much more. The Physical Security Assessment is a non-invasive walkthrough assessment that is guided by the client’s security personnel while on-site. A Physical Attack & Penetration is an invasive assessment in which SecureState consultants attempt to “break-in” to the site or facility that is in scope. The Physical Security Assessment is paired perfectly when combined with a Physical Attack & Penetration Test.

  • Physical Security Assessments review all the physical security controls of a building, facility or location
  • Profiling Team members have years of experience conducting Physical Security Assessments for large and small companies
  • Profiling Team members know the latest technology, Physical Security controls and best practices in the Physical Security industry
Physical Security Assessment


Many organizations never evaluate the physical security controls that are in place at a building or location. Some organizations spend thousands of dollars on physical security controls, but may not have them implemented correctly or according to security best practices. SecureState can determine how easy it might be to circumvent these controls. For example, cameras and alarms may not be in the correct locations and can be easily evaded. SecureState uses a detailed client guided approach to evaluate the available controls and technologies to a company in place for physical security.


The Profiling Team has years of experience in conducting Physical Security Assessments and Physical Attack & Penetration Tests. Many of the Profiling Team members come from a military background and have extensive experience in conducting and building physical security assessment programs for complex organizations. Team members also have professional experience with bypassing locks, alarms and other physical security controls. What makes our Physical Security Assessments so unique is the fact that we’ve exploited many different types of Physical Security controls and know where the vulnerabilities are and how they are implemented. No other security consulting firm can provide this type of expertise.

Did You Know?

  • Physical Security is often overlooked in an organization
  • Physical Security breaches can have as much as an impact as computer breaches
  • Physical Security Assessments should be conducted on high value facilities and locations annually; or when significant changes to controls are implemented
  • Physical Security Assessments should be conducted by qualified personnel with years of experience in the industry

Our Approach and Methodology

The SecureState Profiling Team is well known and highly regarded as experts in Penetration Testing. Our approach follows industry accepted testing methodologies such as PTES, NIST 800-115 and OSSTMM. By following these methodologies, our clients can accurately replicate the testing SecureState has performed in their own environment to accurately mitigate identified vulnerabilities. The Profiling Team also helps identify strategic “root cause” issues through our Penetration Tests. SecureState's Risk Management Team is uniquely positioned to work closely with the Profiling Team in order to assist clients with mitigating these strategic “root cause” issues.

Phase I – Pre-engagement Interactions:

In this phase, SecureState works with the client to establish the rules of engagement as well as the scope; and exchange contact information for both parties. SecureState provides a detailed Project Charter which contains information on scope and everything that will be required to conduct the testing. The Project Charter is discussed during the kickoff call prior to the beginning of the engagement.

Phase II – Remote Intelligence Gathering:

SecureState begins any Physical Security Assessment remotely by conducting an extensive search of open source intelligence on the target company. This research finds out information regarding the target company from public databases, tax records, job openings, social networks, Internet search engines and much more. Our staff then reviews extensive information about the target locations themselves through the use of online mapping tools; which include satellite imagery and street-level views.

Information gathered from this phase is used to determine potential threats to the company and the locations in scope. In addition, this data is used in the report to provide a focused threat assessment specific to the facilities or locations.

Phase III – Guided Walkthrough:

SecureState meets with the client on site to perform a guided walkthrough of the facility or location. Along with the client, SecureState evaluates all Physical Security controls that are in place. The following controls are evaluated for security best practices and implementation:

  • Visitor Entry and Verification Procedures
  • Access Control Systems (including badges)
  • Security Guards and Guard Rotation
  • Data Center Specific Controls
  • Document Destruction
  • CCTV or other Surveillance Cameras
  • Alarms
  • Locks
  • Physical Key Management
  • Security Lighting
  • Fences and Barricades
  • Safety Systems (fire suppression, backup power)

Phase IV – Vulnerability Analysis:

During the vulnerability analysis phase, SecureState attempts to determine what physical vulnerabilities of the evaluated controls are present. Included in this phase are questions for the client regarding recent physical security incidents as well as the client's security concerns. SecureState uses this information to determine if certain controls need to be improved; or if a new technology can assist with mitigating threat agents identified from Phase I.

Phase V – Reporting:

As part of the deliverable, SecureState provides a report which contains a short, graphical summary aimed at senior management, a narrative body which details major findings and a detailed findings section aimed at technical staff. SecureState also provides a closing call and a high-level executive presentation to summarize the penetration test; as well as provide an opportunity to ask questions about the engagement.


What Makes Us Different

  • SecureState has many years of experience conducting Physical Security Assessments
  • Developed Physical Security Assessment programs for several Fortune 500 Financial Institutions
  • Highly involved in the local and national Physical Security community through Physical Security organizations such as ASIS International
  • The Profiling Team founded the first local chapter of TOOOL (The Open Organization Of Lockpickers) in the Cleveland, Ohio area
  • Profiling Team members are frequent speakers at national and worldwide security and hacking conferences such as DEFCON, Black Hat, OWASP AppSec, SANS, ShmooCon, THOTCON, DerbyCon, ToorCon and more
  • Provided a secure, two-factor authentication web portal for access to Penetration Test results
  • Follows industry standard testing methodologies, vulnerability rating systems and uses real attack data collected by SecureState through years of assessments to compare your company to your industry peers from a security perspective

Related Services