Cocoon - Independent security validation

A physical penetration test is a controlled attempt to gain unauthorized access to a building, department, system, or confidential information. The test is conducted by trained specialists who operate based on a realistic threat actor profile, within predefined parameters, and in coordination with the client. The goal is not to catch employees, but to identify vulnerabilities in access control, procedures, and human behavior before a real attacker does.

A physical penetration test focuses on a specific objective: can someone gain access to a building, area, or system? A red team is broader and more complex. In this scenario, a multidisciplinary team simulates a complete attack chain, including preparation, observation, social engineering, physical intrusion, and achieving protected assets such as critical systems or confidential information. A red team provides a more realistic picture of how a motivated and prepared adversary operates. A physical pentest is a targeted assessment of a specific security component.

A mystery visit is a low-barrier practical assessment where an unannounced visitor checks whether security procedures are actually being followed. For example: Is identification requested? Is the visitor escorted? Does the reception desk respond adequately to unusual situations? A mystery visit focuses on the first point of contact and visible procedures. It is an accessible first step in testing physical security and is often combined with a broader audit or penetration test.

Social engineering is the manipulation of people to gain access to buildings, systems, or information, without using technical means. Attackers exploit trust, authority, helpfulness, or time pressure to induce employees to perform actions they would not consciously undertake. Cocoon tests social engineering through realistic scenarios: impersonation of technicians or auditors, pretexting calls, tailgating, and authority spoofing. The findings demonstrate how far a prepared attacker can get in practice and where awareness and procedures require improvement.

An audit assesses whether security measures are in place and documented. A physical penetration test verifies if those measures actually hold up when someone puts them under pressure. An audit provides an assessment of policy and design. A pentest provides evidence of operation and effectiveness. Both are valuable, but they answer different questions. Organizations that only audit know whether they have measures in place. Organizations that also test know whether those measures work.

Yes, a physical penetration test is legal when performed with the explicit consent of the authorized client. Cocoon always operates on the basis of a written assignment, established objectives, and clear Rules of Engagement. These specify what is and is not permitted, which locations and scenarios are being tested, and how any potential incidents will be handled. During a test, Cocoon employees carry legal indemnity specifically drafted for that assignment. No test is conducted without this documentation.

Each assignment is carefully tailored in advance to the client’s specific business context. The Rules of Engagement define the boundaries: which time windows apply, which departments or processes are out of scope, how to proceed if a situation threatens to escalate, and who the point of contact is in unforeseen circumstances. Cocoon operates in a structured and proportional manner. The goal is insight, not disruption. In practice, the organization will notice little of an ongoing test, unless an employee actively contacts the designated point of contact.

This is determined in advance in consultation with the client. In most cases, a small circle of trusted individuals is aware: the client themselves, a legal or compliance officer, and potentially management. Employees are generally not informed, as this directly reduces the realism of the test. Afterward, the organization is fully briefed. How communication with employees proceeds is jointly determined during the reporting and delivery phase.

The turnaround time varies depending on the type of test and scope. A targeted mystery visit or walk-in test can be completed within a day. A full physical penetration test, including preparation, observation, and execution, typically takes two to five days. A red team engagement, in which multiple scenarios and attack paths are investigated, often spans two to four weeks, including reporting. The exact schedule is determined during the intake, based on objectives, locations, and the desired level of realism.

A Cocoon report includes an executive summary for management and the board, a detailed overview of findings with supporting evidence, a risk assessment for each finding, an impact analysis, and concrete improvement measures. The emphasis is on practical improvement, not on tallying errors. Findings are always linked to a recommendation. The report is suitable for use as substantiation for regulatory authorities, as input for an improvement plan, and as a baseline assessment for periodic re-testing.

A physical penetration test is useful when an organization wants to know if its security measures actually work in practice. Specific triggers include: following a security investment that has not yet been validated, after a relocation or renovation, when there are doubts about the effectiveness of security personnel or procedures, after an incident or near-miss, in response to new laws and regulations such as NIS2 or the Wwke, or as periodic validation within a mature security program. Organizations that wait for an incident to learn where their security fails pay a high price for that knowledge.

NIS2 and the Critical Entities Resilience Act (Wwke) require organizations in critical sectors to implement demonstrable security measures and perform periodic validation of those measures. A physical penetration test fulfills that validation obligation: it demonstrates that security measures are not only present but also genuinely effective. The reporting provides concrete substantiation for regulators and the board. Cocoon can align the setup of a test with the specific requirements and scope of NIS2 or the Wwke, including the link to a risk analysis and resilience plan.

Physical penetration testing is relevant for any organization that handles sensitive information, critical processes, or valuable assets that must be protected against unauthorized access. This is particularly true for organizations in critical infrastructure (energy, water, transportation, healthcare), government organizations, financial institutions, industrial environments with OT systems, healthcare organizations, data centers, and companies that handle classified or confidential information. Testing is also valuable for organizations with an open, publicly accessible environment, precisely because the barrier to unauthorized access is lower there.