OSINT of Facilities by Physical Recon

Physical security consultant Bill Graydon presents an architectural reconnaissance methodology for physical red teams, demonstrating how to extract extensive intelligence about a target facility solely through external visual inspection and open-source intelligence (OSINT) [00:00]. Graydon emphasizes that before attempting physical entry, an evaluator can accurately infer building layouts, structural functions, and security controls by observing exterior massing, fenestration patterns, and utility infrastructure [08:03].

The presentation covers key architectural signatures that reveal internal space utilization. Graydon explains how elevator penthouses and roofline structures distinguish hydraulic elevators (low-rise, basement pump units) from traction cable elevators (requiring rooftop or upper-level machine rooms) [20:04]. He illustrates how structural shafts, plumbing stacks, and fire safety plans visible in exterior Knox boxes help map interior riser shafts, stairwells, and secure telecom rooms [12:00, 16:01]. Furthermore, he demonstrates how identifying exterior telephone drops, fiber conduits, and clustered utility meters reveals tenant partitions and server room locations [23:54].

Graydon also analyzes facility support infrastructure, showing how diesel generator fill pipes, exhaust louvers, and fuel storage access indicate emergency backup systems [27:50]. External waste streams provide further intelligence, such as commercial cooking oil bins indicating restaurant occupancy [03:56] or secure shredding bins signaling financial or legal operations. The talk concludes with methods for combining on-site physical observations with municipal GIS data, satellite imagery, and municipal zoning filings to prepare flawless physical penetration testing plans [31:57].

(AI summary — Gemini Flash)