Skip to content

How NOT to Perform Covert Entry Assessments

Brent WhiteTim Roberts

Shares hard-learned lessons and busted myths from physical penetration tests, covering site surveys, social engineering, and real-time contingency handling.

Summary

Realities of Covert Entry Operations

Covert physical entry assessments require meticulous planning, calm decision-making, and disciplined operational tradecraft. Relying on cinematic tropes or aggressive improvisations frequently leads to compromised engagements and safety hazards.

Physical Site Surveys and Reconnaissance

Effective assessments begin with discreet reconnaissance of physical security perimeters, camera coverage, guard rotations, and electronic badge readers. Rushing into an engagement without thorough surveillance increases the likelihood of premature detection.

Human-Layer Social Engineering and Pretexting

Face-to-face social engineering requires credible pretexting tailored to the target facility. Operators must manage interpersonal interactions smoothly, avoiding high-friction confrontations that trigger security escalations.

Troubleshooting When Operations Go Sideways

When unexpected challenges occur—such as encountering altered floor plans, malfunctioning bypass tools, or curious employees—operators must rely on established fallback protocols and de-escalation strategies to maintain safety and compliance.

Related talks

Creator Stage·57 min

  • DEF CON
  • Red Team
  • Date: Aug 2025
  • Location: Las Vegas

Karen Ng · Matthew Cancilla

Explores non-destructive entry techniques that bypass doors and access control hardware without picking locks, alongside defensive hardening measures.

physical-securityaccess-controllocks+2

Creator Stage·37 min

  • DEF CON
  • Red Team
  • Date: Aug 2025
  • Location: Las Vegas

Bobby Graydon · Ege Feyzioglu

Explains how elevator floor lockouts function and how improperly configured elevator controllers and hoistways can be bypassed to access restricted floors.

physical-securityaccess-controlelevator+2