Practical Validation - Controlled Testing
Walk-in Test
Cocoon tests whether an unauthorized individual can move unnoticed through your premises, past reception, workspaces, and restricted areas.
- Realistic attempt to move unseen throughout the entire location, conducted within pre-agreed parameters
- Assessment of social control, employee vigilance, and physical barriers throughout the premises
- Report with concrete recommendations for behavior, zoning, and procedures
What is a Walk-Through Test?
A walk-through test is a practical assessment where a Cocoon tester, with the client’s permission, attempts to move unseen and without authorization through your premises: past the reception, through hallways and open workspaces, up to restricted areas. The test not only measures whether someone gains entry but, more importantly, how far they can proceed unnoticed.
This service is relevant for organizations with relatively open office environments, multiple departments, or shared locations, where access at the front door does not automatically mean the rest of the premises is secured. A walk-through test is often deployed after the introduction of flexible workstations or an open office concept, when there are doubts about social control between departments, or as a follow-up to a Mystery Visit that was limited to initial access.
How Cocoon Conducts a Walk-Through Test
With many alternatives, a walk-through test stops at the front door: can someone get in, yes or no. What happens afterward often remains out of scope, even though the freedom of movement *after* entry truly indicates the maturity of the security. Cocoon therefore tests the entire journey, from initial access to the most sensitive areas.
A walk-through test also follows our established methodology. During preparation, we define the scenario and scope: which areas are relevant, which departments will participate, and what boundaries apply. During execution, our tester moves through the premises without aids or prior announcement, observing how employees, reception, and security react to an unfamiliar face.
Afterward, you will receive a report with a timeline of each step: where the tester could proceed unhindered, where they were approached, and which areas proved accessible or inaccessible. Would you like to discuss the findings immediately? We can schedule a consultation upon request.
Why choose Cocoon
For Cocoon, a walk-through test reveals what an initial access test alone cannot: how far someone gets once they are inside. We do not assess security measures we have provided ourselves, which makes our findings objective. Especially in open office environments, social control often proves to be the weakest link, not the locks or access cards at the front door.
A locked front door says nothing about what can happen inside.
Based on the results of a walk-through test, we are happy to determine the next step together: targeted security awareness for specific departments, a physical penetration test for a deeper investigation, or a repeat walk-through test to measure improvement.
- Independent validation, separate from provided security systems
- Test the entire journey within the premises, not just initial access
- Practical insight into social control between departments
Please note: under NIS2 and the General Security Requirements for Central Government Commissions (ABRO), actual testing of security measures is required.
Conducting a walk-through test helps meet the requirements of NIS 2 and ABRO.
Cocoon works for renowned (publicly) listed companies in profit and non-profit environments; references are available upon request.
Frequently asked questions
What does a physical penetration test cost?
The cost of a physical penetration test depends on the size of the location, the number of departments, and the complexity of the scope. After a brief intake, you will receive a customized quote tailored to your premises and threat profile.
How Long Does a Penetration Test Take?
A penetration test typically takes one to two weeks, from initial consultation to final report, including an on-site visit of a few hours. Should you wish to review the findings immediately, we can schedule a brief consultation upon request.
Is a penetration test legal?
Yes. A penetration test is exclusively conducted with the client’s written consent, within pre-agreed Rules of Engagement. These frameworks ensure the test proceeds lawfully and in a controlled manner.
What is the difference between a Physical Penetration Test and a Mystery Visit?
A Mystery Visit focuses on a single scenario, typically initial access and the reception area. A Physical Penetration Test goes further: it examines whether an unauthorized person can subsequently move unnoticed through the rest of the building, past multiple departments and workstations.
What is the difference between a walk-in test and a physical penetration test?
A walk-in test focuses specifically on freedom of movement within the building after initial entry. A physical penetration test is broader: it also evaluates key and badge management, technical measures, and multiple scenarios simultaneously, providing more extensive reporting.
Does a physical penetration test disrupt daily business operations?
No. The test is coordinated in advance within clear Rules of Engagement, ensuring that the impact on your employees and processes remains limited. Cocoon operates in a controlled and proportionate manner.
Are employees aware that a physical penetration test is taking place?
No, and that is intentional. Employees are not informed in advance, so that the test measures their actual behavior and alertness. The client is, however, informed internally beforehand about what will happen and when.