Physical penetration testing companies: who offers it
Physical penetration testing tries to enter buildings, rooms or devices without permission, with written authorization from the site owner. Few providers state it on their own pages. The table lists those that do, A to Z, with sources. Settle the authorization letter, the scope and the stop rules before any tester goes on site.
Physical penetration testing companies are rare in generic "top pentest" lists. Most providers test software. The table lists only providers whose own pages state physical testing, in A to Z order with no ranking, checked on 9 November 2026. Where a provider is silent, the table has no row, and that is a gap in what the provider says, not a verdict.
8 of 8 providers shown (67 in the full table). Sorted A to Z, not ranked. Checked up to 9 November 2026.
| Provider | Delivery | Web apps | APIs | Cloud | Network | Mobile | AI apps | Published price | Turnaround | Retest | Sample report |
|---|---|---|---|---|---|---|---|---|---|---|---|
| ClaranetManaged services and cyber security provider | human-led | Yes | Yes | ? | Yes | Yes | ? | Custom quote | Not published | Retesting is included as part of the engagement. | not published |
| Compass SecurityConsultancy, Switzerland | human-led | Yes | Yes | Yes | Yes | Yes | Yes | Custom quote | Not published | Not published | on request |
| JUMPSECConsultancy, United Kingdom | human-led | ? | ? | ? | ? | ? | Yes | Custom quote | Not published | Not stated. The page recommends testing quarterly or semi-annually… | not published |
| Pen Test PartnersConsultancy | human-led | Yes | Yes | Yes | Yes | Yes | Yes | Custom quote | PTaaS: scoped within minutes and can start immediately; results in… | Not published | not published |
| RaxisConsultancy, United States | human-led | Yes | Yes | Yes | Yes | ? | Yes | Custom quote | Quote requests answered usually in one business day; PTaaS findings… | Retesting is built into the PTaaS workflow; Raxis Attack includes… | Public |
| SchellmanConsultancy, United States | human-led | Yes | Yes | Yes | Yes | Yes | Yes | Custom quote | Not published | Not stated on the page. | Public |
| Secure IdeasConsultancy | human-led | Yes | Yes | ? | Yes | Yes | ? | $8,160 per test (flat fee, starting) +4 more | Testing usually starts two to four weeks after contracting; one to… | Not included by default; retesting is listed as a factor that can… | Public |
| StingraiPenetration testing consultancy and platform, Canada | hybrid | Yes | Yes | Yes | Yes | Yes | Yes | US$3,000 per assessment +1 more | Autonomous Pentest: same-day results. | Automated retests are listed on the Autonomous plan; the page says… | Public |
No provider matches every filter. Remove a filter to see more.
"?" means the provider does not say on its public pages. It does not mean "no". Prices use each provider's own unit: a test, a year, a month or credits. Do not compare them as equal units. How we collect and check this data.
What does physical penetration testing cover?#
A physical test checks whether a person can get past doors, locks, badge readers, reception and staff to reach a room, a device or data. Typical tests are tailgating (following someone through a door), badge cloning, after-hours entry, and plugging a test device into a network port. The goal is to find the gap and give you the fix: a door that does not latch, a reader without a lock-out, a policy staff do not follow.
Schellman and Claranet, two of the providers in the table, name physical testing on their own service pages. Provider pages differ on what they include, so read the quote line by line.
Who needs a physical test, and when?#
You need one when something worth protecting sits behind a door: a data center, a lab, a trading floor, medical records, or a network closet in a shared building. Triggers include a move to a new office, a change of access control vendor, a customer audit and a red team exercise that includes entry. If your risk is software only, a physical test is the wrong buy. Start with a web or API pentest.
What should you ask physical pentest providers?#
Ask for these answers in writing before any tester goes on site.
| Question | Why it matters |
|---|---|
| Who signs the authorization letter? | The signer must control the site. A tenant cannot approve a landlord's lobby. |
| Which buildings, floors and hours are in scope? | Vague scope caused the Iowa 2019 arrests. |
| Who is the emergency contact, and are they reachable during the test? | Testers call this person when stopped. |
| What is off limits? | Examples: forced entry, damage to locks, contact with staff outside the plan. |
| What will testers take or leave behind? | Agree on test tokens, marked items and removal of any device. |
| Does the quote include social engineering? | Pretexts to staff are a separate skill and risk. |
The Iowa Judicial Branch statement says the parties "had different interpretations of the scope of the agreement". NIST SP 800-115 says legal advisors should "always be involved for intrusive tests such as penetration testing". Have counsel read the letter and the scope.
What drives the price of a physical test?#
Price follows the number of sites, the days on site, the number of testers, travel, and whether social engineering or a network drop is included. The "Published price" column describes each provider's general pricing, not physical tests, so expect a quote after scoping. See penetration testing cost for sourced ranges on other test types.
How do you read the table?#
A row means the provider's own page lists physical testing, with the source linked from the provider page. The other columns describe the provider as a whole. Web, API, cloud and AI columns do not say anything about physical scope. The Retest column covers digital findings unless the provider says otherwise.
Related lists: red teaming providers and social engineering testing providers.
What scoping mistakes cause trouble?#
The common mistakes are an unsigned or wrongly signed letter, a scope that names a company and not its buildings, no stop rule when staff challenge a tester, and no plan for what happens to a badge or device the tester obtains. Fix each in the scope document, and keep a copy of the letter with every tester.
Questions
Do I need an authorization letter for a physical test?
Yes. Testers carry a signed letter from someone entitled to approve the test, with contact numbers that work at any hour of the test. It is what they show if staff or police stop them. Check who signs: the person must control the site.
Can a physical test go wrong legally?
Yes. In 2019 two Coalfire testers were arrested at an Iowa county courthouse, and the state said the parties had different interpretations of the scope of the agreement. Write scope in plain terms and name every building.
Is a physical test the same as a physical security assessment?
Not always. An assessment can be a walk-through that reviews locks, cameras and policies. A penetration test tries to get in. Ask the provider which one the quote describes.
Do most pentest companies do physical tests?
Few state it on their own pages. The table lists only those that do. A missing row means we found no statement, not that the provider declined to do it.
Sources
- Iowa Judicial Branch: State Court Administration statement (checked 9 November 2026)
- NIST SP 800-115: Technical Guide to Information Security Testing and Assessment (checked 9 November 2026)
- Schellman penetration testing page (physical testing listed) (checked 9 November 2026)
- Claranet penetration testing page (physical testing listed) (checked 9 November 2026)
- PentestCompare methodology (checked 9 November 2026)
Compare like with like
An automated scan, a manual test and annual credits are different units. Check scope, delivery and retest terms before price.