Physical penetration testing
Physical penetration testing checks whether someone can get into your offices, data rooms or signing locations in person, and what they could do once inside. HYDN tests access controls, reception and visitor processes, tailgating, unattended devices and network ports, and the security of hardware used to sign transactions, all under agreed rules of engagement.
What we test
- Perimeter and entry. Doors, locks, badges and alarms, and whether they can be bypassed.
- People and process. Reception, visitor sign-in, deliveries and whether staff challenge strangers or hold doors (tailgating).
- Inside the building. Unattended laptops, unlocked screens, documents left out, and live network ports.
- Signing and key material. Where hardware wallets, HSMs, seed backups and signing laptops are kept, and who can reach them.
- Devices. Whether a planted device could give remote access to your network.
How it fits a red team
Physical access is one route among several in a full spectrum red team engagement, alongside technical attacks and social engineering. It can also be run on its own for a specific site.
Frequently asked questions
Is physical testing legal?
Yes, with written authorisation from someone entitled to give it for each site, agreed scope and rules of engagement. Testers carry an authorisation letter and an emergency contact in case they are challenged or stopped.
Why would a crypto company need physical testing?
Because keys and signing devices live in physical places. A hardware wallet in an unlocked drawer or a laptop left logged in undoes technical controls. It is rare in web3 security offerings and very revealing.
Published Updated