Practical Validation - Controlled Testing
Mystery Visit
Cocoon dispatches an inconspicuous visitor to test whether your reception, security personnel, and procedures respond alertly.
- Inconspicuous visit by a trained tester, conducted within pre-agreed parameters.
- Assessment of initial access, reception processes, and social control.
- Report with concrete recommendations for behavior, procedures, and the effectiveness of security measures.
What is a Mystery Visit,
also known as a mystery guest in the industry?
A Mystery Visit is an accessible practical test where an inconspicuous Cocoon tester poses as a visitor, supplier, or new employee to assess whether security procedures, reception processes, and employee alertness are truly effective in practice.
This service is suitable for organizations seeking an initial, accessible assessment of their access and reception processes, for example, after implementing a new visitor policy, when there are doubts about employee alertness, or as part of a broader security awareness program. A Mystery Visit is often used as a stepping stone to a more extensive physical penetration test or walk-through test.
How Cocoon's Mystery Visit Works
Many alternatives treat a mystery visit as a standalone, one-off trick without follow-up, primarily known from the retail sector. Cocoon explicitly positions a Mystery Visit as serious security validation, linked to security awareness, security culture, and broader audit processes, not as an isolated tool. A Mystery Visit is also used to monitor the performance of manned guarding as part of contract management.
Even a Mystery Visit follows our standard setup, though more compact than a more extensive test. During preparation, we jointly define the scenario and scope and gather necessary information, such as security plans and protocols. During execution, one of our specialists inconspicuously visits your location, without additional tools, and observes how employees, reception, and security react.
Afterward, you will receive a concise, clear report. If you wish to review the findings immediately and discuss what you can learn from them, we can schedule a consultation upon request. This is a valuable step, just like with our other services, to reduce resistance and increase insight.
Why choose Cocoon
For Cocoon, a Mystery Visit is often the accessible starting point for a broader trajectory: a first, quick impression of how alert your organization truly is before you decide how deeply you want to test further. We do not evaluate security measures we have provided ourselves, which makes our findings objective.
Your security works. Until someone truly tests it.
Based on that initial impression, we are happy to determine the next step with you: a more extensive physical penetration test, targeted security awareness, or a subsequent Mystery Visit to measure improvement.
- Independent validation, separate from provided security systems
- Direct link to security awareness and security culture
- Accessible starting point for a broader improvement process
Please note: under NIS2 and the General Security Requirements for Central Government Commissions (ABRO), actual testing of security measures is required.
Conducting a Mystery Visit helps meet the requirements of NIS 2 and ABRO.
Cocoon works for renowned (publicly) listed companies in profit and non-profit environments; references are available upon request.
Frequently asked questions
What Does a Mystery Visit Cost?
The cost of a Mystery Visit is typically lower than a comprehensive physical penetration test, as its scope is more limited. Following a brief consultation, you will receive a customized quote, tailored to your desired scenario and number of visits.
How long does a Mystery Visit take?
A Mystery Visit is one of Cocoon’s fastest services. From intake to reporting, the process typically takes one to two weeks, with a visit lasting several hours. Would you like to review the results immediately? We can schedule a brief consultation upon request.
Is a Mystery Visit Legal?
Yes. A Mystery Visit is exclusively conducted with the client’s written consent, within pre-agreed Rules of Engagement. These parameters ensure the test proceeds lawfully and in a controlled manner.
What is the Difference Between a Mystery Visit and a Physical Penetration Test?
A Mystery Visit is performed by one specialist, without tools, focusing on a single scenario such as initial access or reception, and includes a brief report. A Physical Penetration Test is more in-depth: one auditor or a team of two experts tests multiple components of your security, utilizing tools and providing a more extensive report.
What is the Difference Between a Mystery Visit and a Mystery Guest?
Mystery guest is a commonly used alternative term for the same type of test. Cocoon uses the term Mystery Visit, but the approach and objective—testing access, procedures, and alertness—are comparable to what other parties refer to as a mystery guest assessment.
What is the difference between a Mystery Visit and a Physical Infiltration Test?
A Mystery Visit focuses on a single visit with a specific scenario, such as a visitor or supplier. A Physical Infiltration Test is broader and investigates whether unauthorized individuals can move unnoticed throughout the entire organization, often in relatively open office environments.