Security improvement - training
Advanced X-Ray Training
Cocoon trains screening lane operators to effectively identify suspicious and prohibited items on X-ray images.
- Hands-on training with real training materials within the screening lane itself
- Expanding the frame of reference for suspicious objects and explosives
- Including search procedures and the correct protocol upon discovery
Advanced X-Ray Training at Cocoon
Advanced X-Ray Training consists of practical courses for personnel working with screening equipment. Participants deepen their knowledge of X-ray and screening lane operations, expand their frame of reference for identifying (components of) suspicious or prohibited items and explosives, and gain insight into the potential methods of operation used by malicious actors.
Additionally, the training covers search procedures, exceptional situations, and gray areas such as plastic weapons, as well as the correct protocol for encountering a suspicious object, including the involvement of court security officers. Instructors provide real training materials, allowing students to learn how explosives and other suspicious items are actually constructed, followed by practical training with these objects in the screening lane itself.
The result is a broader and sharper frame of reference for identifying suspicious objects on X-ray images, better insight into the methods of malicious actors, and confidence in the correct protocol upon discovery, including situational awareness and security questioning during the screening process itself.
Who is this training intended for?
The training is designed for screening operators and security personnel who operate X-ray equipment, typically at locations with mandatory security checks such as courthouses and high-security buildings. This field differs from aviation or cargo security; those sectors require specific, legally mandated certifications such as BAST and X-Ray Controller, for which Cocoon’s training is not a substitute.
Advanced X-Ray Training is often utilized for new screening operators, when there are concerns regarding the proficiency of existing staff, or as a periodic refresher to ensure the frame of reference remains current.
Why choose Cocoon
Cocoon uses real training materials rather than just theory or photographs: participants see and recognize how suspicious objects are actually constructed and then practice with these items in the screening lane itself. This makes the frame of reference concrete rather than abstract.
Recognizing an image in a photograph is quite different from identifying it under time pressure with a line of people waiting behind the screening lane.
Advanced X-Ray Training pairs well with Identifying Letter Bombs, ensuring that mailroom and screening lane procedures are aligned within the same organization.
- Training with real materials, not just theory or images
- Hands-on training directly in your own screening lane
- Focus on gray areas and the correct protocol upon discovery, including court security
Case Study: How the training works in practice
In the basic screening lane/hazard management training, participants first deepen their knowledge by “red teaming” one another: they attempt to smuggle suspicious items past each other. In the afternoon, they practice with actual suspicious and prohibited items in the screening lane, followed by training on conduct and behavior during escalation.
Frequently asked questions
What is a Physical Penetration Test?
A physical penetration test is a controlled attempt to gain unauthorized access to a building, department, system, or confidential information. The test is conducted by trained specialists who operate based on a realistic threat actor profile, within predefined parameters, and in coordination with the client. The goal is not to catch employees, but to identify vulnerabilities in access control, procedures, and human behavior before a real attacker does.
What is the difference between a physical pentest and a red team?
A physical penetration test focuses on a specific objective: can someone gain access to a building, area, or system? A red team is broader and more complex. In this scenario, a multidisciplinary team simulates a complete attack chain, including preparation, observation, social engineering, physical intrusion, and achieving protected assets such as critical systems or confidential information. A red team provides a more realistic picture of how a motivated and prepared adversary operates. A physical pentest is a targeted assessment of a specific security component.
What is a Security Mystery Visit?
A mystery visit is a low-barrier practical assessment where an unannounced visitor checks whether security procedures are actually being followed. For example: Is identification requested? Is the visitor escorted? Does the reception desk respond adequately to unusual situations? A mystery visit focuses on the first point of contact and visible procedures. It is an accessible first step in testing physical security and is often combined with a broader audit or penetration test.
What is Social Engineering and How Is It Tested?
Social engineering is the manipulation of people to gain access to buildings, systems, or information, without using technical means. Attackers exploit trust, authority, helpfulness, or time pressure to induce employees to perform actions they would not consciously undertake. Cocoon tests social engineering through realistic scenarios: impersonation of technicians or auditors, pretexting calls, tailgating, and authority spoofing. The findings demonstrate how far a prepared attacker can get in practice and where awareness and procedures require improvement.
What is the difference between an audit and a physical penetration test?
An audit assesses whether security measures are in place and documented. A physical penetration test verifies if those measures actually hold up when someone puts them under pressure. An audit provides an assessment of policy and design. A pentest provides evidence of operation and effectiveness. Both are valuable, but they answer different questions. Organizations that only audit know whether they have measures in place. Organizations that also test know whether those measures work.
Is a physical penetration test legal?
Yes, a physical penetration test is legal when performed with the explicit consent of the authorized client. Cocoon always operates on the basis of a written assignment, established objectives, and clear Rules of Engagement. These specify what is and is not permitted, which locations and scenarios are being tested, and how any potential incidents will be handled. During a test, Cocoon employees carry legal indemnity specifically drafted for that assignment. No test is conducted without this documentation.
How Does Cocoon Prevent Business Disruption During a Test?
Each assignment is carefully tailored in advance to the client’s specific business context. The Rules of Engagement define the boundaries: which time windows apply, which departments or processes are out of scope, how to proceed if a situation threatens to escalate, and who the point of contact is in unforeseen circumstances. Cocoon operates in a structured and proportional manner. The goal is insight, not disruption. In practice, the organization will notice little of an ongoing test, unless an employee actively contacts the designated point of contact.
Who within the organization is aware of a physical penetration test?
This is determined in advance in consultation with the client. In most cases, a small circle of trusted individuals is aware: the client themselves, a legal or compliance officer, and potentially management. Employees are generally not informed, as this directly reduces the realism of the test. Afterward, the organization is fully briefed. How communication with employees proceeds is jointly determined during the reporting and delivery phase.
How long does a physical penetration test take?
The turnaround time varies depending on the type of test and scope. A targeted mystery visit or walk-in test can be completed within a day. A full physical penetration test, including preparation, observation, and execution, typically takes two to five days. A red team engagement, in which multiple scenarios and attack paths are investigated, often spans two to four weeks, including reporting. The exact schedule is determined during the intake, based on objectives, locations, and the desired level of realism.
What is included in a physical penetration test report?
A Cocoon report includes an executive summary for management and the board, a detailed overview of findings with supporting evidence, a risk assessment for each finding, an impact analysis, and concrete improvement measures. The emphasis is on practical improvement, not on tallying errors. Findings are always linked to a recommendation. The report is suitable for use as substantiation for regulatory authorities, as input for an improvement plan, and as a baseline assessment for periodic re-testing.
When is a physical penetration test useful?
A physical penetration test is useful when an organization wants to know if its security measures actually work in practice. Specific triggers include: following a security investment that has not yet been validated, after a relocation or renovation, when there are doubts about the effectiveness of security personnel or procedures, after an incident or near-miss, in response to new laws and regulations such as NIS2 or the Wwke, or as periodic validation within a mature security program. Organizations that wait for an incident to learn where their security fails pay a high price for that knowledge.
Does a physical penetration test meet the requirements of NIS2 or the Wwke?
NIS2 and the Critical Entities Resilience Act (Wwke) require organizations in critical sectors to implement demonstrable security measures and perform periodic validation of those measures. A physical penetration test fulfills that validation obligation: it demonstrates that security measures are not only present but also genuinely effective. The reporting provides concrete substantiation for regulators and the board. Cocoon can align the setup of a test with the specific requirements and scope of NIS2 or the Wwke, including the link to a risk analysis and resilience plan.
For Which Organizations Is Physical Security Testing Relevant?
Physical penetration testing is relevant for any organization that handles sensitive information, critical processes, or valuable assets that must be protected against unauthorized access. This is particularly true for organizations in critical infrastructure (energy, water, transportation, healthcare), government organizations, financial institutions, industrial environments with OT systems, healthcare organizations, data centers, and companies that handle classified or confidential information. Testing is also valuable for organizations with an open, publicly accessible environment, precisely because the barrier to unauthorized access is lower there.
What are the costs for the Advanced X-Ray Training sessions?
The costs depend on the group size, duration, and the availability of your own scanning lane for the practical exercise. You will receive a customized quote following a brief intake.
Does This Training Replace the Mandatory BAST or Controller X-Ray Training?
No. Those trainings are legally mandatory for aviation and cargo security and are outside Cocoon’s offerings. Advanced X-Ray Training is intended for scanner operators at courthouses and secured buildings.
Is real practice conducted with suspicious objects?
Yes. Instructors bring actual training materials, including dummy explosives and suspicious objects, and the practical exercise takes place in your own screening lane.
Is there a certificate associated with the training?
Cocoon primarily focuses the training on practical application within your own organization, rather than on external certification.
Who is this training for?
For security screening operators and security personnel who operate X-ray equipment, typically at locations with mandatory security checkpoints such as courthouses and high-security buildings.
What is the Difference Between Advanced X-Ray Training and Letter Bomb Recognition?
Advanced X-Ray Training focuses on identifying suspicious objects in X-ray images within the scanning lane. Letter Bomb Recognition focuses on the physical and behavioral characteristics of suspicious mail items, often without scanning equipment. Both are complementary in content.