Physical Penetration Testing: When Human Trust Bypasses Layers of Security with a Simple Pretext
Sophos, Thursday, October 29th, 2026
Sophos describes a physical penetration test where a simple pretext got testers past badge readers, gates, mantraps and guards.
The test target had layered controls: badge readers, PIN pads, gates, mantraps, reception, guards and cameras.
The first plan was to capture a badge at the entrance, but the team lacked the right antenna for the legacy badge type and hours of loitering failed.
They then observed the building's rhythms and turned to social engineering, where a pretext exploited human trust.
The article, part of a Sophos MDR specialist series, concludes that people's confidence in layered controls was the real vulnerability.