Physical Security

Physical Security Assessment vs Penetration Test: Which Do You Need?

By the FASC editorial team Updated Nov 4, 2026 6 min read

A physical security assessment is a cooperative review: a consultant walks your site with your staff, studies your policies and controls, and tells you where you are exposed and what to fix first. A physical penetration test is an authorized attack: a tester tries to get inside, past your people and barriers, to prove whether a specific weakness can actually be exploited. Most organizations need the assessment first and a penetration test only after the obvious gaps are closed.

Key takeaways: penetration test or assessment

An assessment answers “where are we weak and what should we fix?” A penetration test answers “can someone actually get in?”
Assessments are broad and collaborative. Penetration tests are narrow, adversarial and usually unannounced to most staff.
Testing a site that has never been assessed mostly confirms problems you could have found cheaper with a walkthrough.
Any penetration test needs a signed scope, written authorization from someone with real authority over the property, and clear rules of engagement.
Many mature programs alternate: assess, fix, then test to verify the fixes hold up under pressure.

What is a physical security assessment?

A physical security assessment is a structured evaluation of how well a facility protects its people, assets and operations. A qualified consultant reviews the threats you realistically face, inspects the site, interviews staff and compares what they find against accepted practice for your type of facility.

A typical engagement covers:

Perimeter, parking, lighting and landscaping
Entrances, doors, locks, key control and access control systems
Video surveillance coverage and who actually watches or reviews it
Visitor management, deliveries and contractor access
Security staffing, post orders and patrol routines
Emergency plans, lockdown and evacuation procedures, and training
Policies, incident history and how reports are handled

The deliverable is a written report that ranks findings by risk and gives practical recommendations, ideally with rough cost and priority attached. If you want a deeper look at the method, our guide to what a security vulnerability assessment includes walks through it step by step.

What is a physical penetration test?

A physical penetration test (often called a physical pen test or, in its broader form, a red team exercise) is a controlled attempt to defeat your security the way a real intruder would. The tester has a defined goal, such as reaching a server room, an executive floor or a records area, and tries to get there without being stopped.

Common techniques include tailgating through controlled doors, posing as a vendor or new employee, testing whether badges can be copied, bypassing weak locks or door hardware, and checking whether staff challenge strangers. Good testers document everything with timestamps and photos so you can see exactly where each layer failed.

The value of a penetration test is proof. A report that says “staff do not consistently challenge visitors” is easy to dismiss. A report showing that a tester walked into the finance office with a clipboard and a borrowed lanyard tends to get budget approved.

How do they compare side by side?

Factor	Physical security assessment	Physical penetration test
Core question	Where are we vulnerable and what should we fix?	Can a specific weakness actually be exploited?
Approach	Cooperative, with full access and staff interviews	Adversarial, with limited or no staff awareness
Breadth	Whole site, policies, people and technology	Narrow, focused on defined targets and entry points
Output	Prioritized findings and recommendations	Evidence of what worked, what failed and how
Best timing	First, and on a regular cycle	After major gaps are fixed, to validate controls
Main risk	Recommendations that never get funded	Confusion, police response or legal trouble if poorly scoped

Should you start with an assessment or a penetration test?

For most organizations the answer is the assessment. If your doors are propped open, your cameras do not cover the loading dock and nobody owns visitor management, a penetration tester will get in easily and tell you what a walkthrough would have found anyway.

Start with an assessment if

You have never had an independent review, or the last one is several years old
You recently moved, expanded, renovated or changed how the building is used
You need a prioritized plan to support a budget request or board decision
You are a school, house of worship, clinic or office where the main concern is violence, not espionage

Consider a penetration test if

You have already invested in access control, guards and training and want to know if they work
You protect high value assets: data centers, labs, cash, pharmaceuticals, sensitive records
An auditor, client contract or insurer expects evidence of tested controls
Leadership is skeptical and needs a concrete demonstration before acting

What should a penetration test scope include?

A physical penetration test carries real risk. Testers have been detained and even arrested in the US when the person who hired them turned out not to have authority over the building, or when scope documents were vague about locations and hours. Your contract should settle these points in writing before anyone shows up:

Authorization. A signed letter from someone with legal authority over each property, including landlords or property managers where you lease space.
Exact scope. Addresses, buildings, floors and areas that are in bounds, and those that are off limits.
Allowed techniques. For example, whether lock picking, badge cloning or after hours entry is permitted.
Timing. Dates and hours, plus a plan for what happens if the tester is caught.
Emergency contacts. At least two people reachable around the clock who can confirm the test is legitimate.
Safety limits. No forced entry that damages property, no interference with life safety systems, and an immediate stop if anyone could be hurt.
Evidence handling. How photos, copied credentials and any data seen during the test will be stored and destroyed.

Ask whether the firm carries professional liability insurance and whether the individuals on site have done physical testing before. Cyber penetration testers are not automatically qualified to do physical work.

What do an assessment and a penetration test cost?

Assessment fees depend on the size and number of sites, travel and how much documentation you need. Published price guides from security firms put a single site commercial assessment at roughly $3,500 to $8,500, with multi site programs running from $15,000 to $75,000 or more. Those same guides warn that a very cheap “assessment” is often a camera count or a sales visit, not an independent review. Our physical security assessment cost guide breaks down what drives the price.

Penetration test pricing varies even more because it depends on the number of objectives, locations and testing days. Get a written quote tied to a clear scope, and compare firms on methodology and reporting, not just price.

How do you choose the right consultant?

Whichever service you need, independence matters. A consultant who also sells cameras or access control has a built in reason to recommend hardware. Our article on the difference between a security consultant and a security integrator explains why that matters for your report.

Questions worth asking any candidate:

Can you share a redacted sample report?
Who will actually be on site, and what is their background?
Do you hold credentials such as the ASIS International Physical Security Professional (PSP) certification?
Do you sell or install any products you might recommend?
How do you prioritize findings when the budget is limited?

You can browse independent consultants who specialize in physical security assessments, or look through the full consultant directory by state.

Not sure whether you need an assessment or a test?

Tell us about your facility, what worries you and what you have already put in place. We will match you with independent physical security consultants who can recommend the right starting point and send you proposals at no cost.

Request free proposals

Frequently asked questions

Is a physical penetration test legal?

Yes, when it is properly authorized. The tester must have written permission from someone with legal authority over the property, a defined scope and agreed rules of engagement. Without that paperwork, the same activity can look like trespassing or burglary. If you lease space, involve the landlord or property manager before any testing begins, and keep emergency contacts available throughout.

Should employees be told about a physical penetration test?

Usually only a small group knows: the executive sponsor, someone in security or facilities, and the emergency contacts who can verify the tester if they are stopped. Telling everyone defeats the purpose, because the test measures normal behavior. Afterward, share lessons with staff in a constructive way so the exercise builds awareness instead of embarrassment.

How often should we do a physical security assessment?

Many organizations review on a regular cycle, often every one to three years, and sooner after a serious incident, a move, a renovation or a major change in how the building is used. Higher risk sites tend to review more often. The right interval depends on your threats, your regulators and how quickly your operations change.

Can one firm do both the assessment and the penetration test?

Yes, and some prefer it because the tester can target the weaknesses the assessment identified. Others deliberately use a different firm for testing to get a fresh, unbiased view. Either approach works if the firm is independent of product sales, the scope is clear, and the people doing physical testing have specific experience with it.

Is a red team exercise the same as a penetration test?

They overlap but are not identical. A physical penetration test usually targets defined entry points or objectives. A red team exercise is broader and longer, often combining physical intrusion, social engineering and sometimes cyber techniques to test how the whole organization detects and responds. Red teaming makes the most sense for mature security programs.