Practical Validation - Controlled Testing
Hybrid Penetration Test
A combined test of physical and digital security, executed as one cohesive process instead of two separate investigations.
- Physical and digital access tested in conjunction
- One report, one risk profile
- Executed proportionally and in a controlled manner
What is a hybrid penetration test?
A hybrid penetration test, also known as a hybrid pentest, is a combined investigation in which Cocoon tests both the physical security and the digital systems of an organization within a single engagement. While a physical penetration test and a digital penetration test each assess their own domain separately, the hybrid pentest brings these two together to demonstrate how an attacker can use one route to reach the other.
This approach is relevant for organizations where physical and digital security appear to be well-managed separately but have never been tested in conjunction. A common trigger is the observation that access to a building can also mean access to the network—for example, via an unattended workstation or an unlocked server room. New regulations such as NIS2, which require demonstrable resilience across multiple domains, are also a reason for many organizations to conduct this test.
How a hybrid penetration test works at Cocoon
Separate audits of physical security or IT systems often reveal a blind spot: the point where one domain touches the other. A door that opens sometimes provides direct access to a network connection. A pentest that only looks at the network misses that.
Prior to the test, Cocoon establishes the Rules of Engagement together with the client: which buildings, systems, and scenarios fall within scope, what level of disruption is acceptable, and how communication will be handled during execution. The test itself is conducted in a structured and proportional manner, with predetermined boundaries for both the physical and digital components.
Afterward, a report follows that describes both domains in conjunction: which physical vulnerabilities were found, what digital consequences resulted from them, and what combined picture of improvement measures this yields.
Why choose Cocoon
At its core, Cocoon is a physical security partner. We offer our hybrid penetration test because security does not stop at the front door: those who have physical and digital vulnerabilities tested together receive a more complete picture than through separate processes with different parties.
Not a vendor of individual tests, but your long-term partner in security awareness.
We never assess security measures we’ve implemented ourselves, ensuring our findings remain independent and objective.
- Proportional testing with clear Rules of Engagement
- Focus on improvement, not on sensation
- Independent validation, not a supplier of security systems
Please note: under NIS2 and the General Security Requirements for Central Government Commissions (ABRO), actual testing of security measures is required.
Performing a hybrid penetration test helps meet the requirements of NIS2 and ABRO.
Our clients include established publicly traded companies and organisations across both the private and non-profit sectors. References are available upon request.
Frequently asked questions
What Does a Hybrid Penetration Test Cost?
The cost of a hybrid penetration test depends on the number of locations, the size of the IT environment, and the desired scope. Cocoon first assesses the situation and then provides a substantiated quotation.
How long does a hybrid penetration test take?
The lead time varies per organization, but typically takes several weeks from intake to reporting. The scope of both the physical and digital components determines the schedule.
Is a hybrid penetration test legal?
A hybrid penetration test is always performed with the client’s written consent and within predefined Rules of Engagement. Without such consent, the same actions would be punishable by law.
What is the difference between a hybrid penetration test and Red Teaming?
A hybrid penetration test assesses physical and digital security within a predefined scope. Red Teaming is an open, goal-oriented attack simulation conducted over an extended period, where hybrid scenarios are one of the possible methods, not the starting point.