- What exactly is a physical red team?A controlled, intelligence-driven exercise where operator teams use social engineering, delivery pretexts, tailgating, lock/credential bypass, and other real-world tactics to attempt access to facilities and assets — all under agreed Rules of Engagement (ROE).
- Will this disrupt our operations or put staff at risk?
No. Every engagement includes safety controls, escalation procedures, and non-disruptive tactics. We run under strict ROE and contingency plans to avoid operational impact or endangering personnel.
- How do you handle legality, contracts, and insurance?
We operate only under signed contracts and NDAs, with full proof of insurance and documented legal authority. Scope, permitted targets, and escalation paths are agreed before any action.
- Do you test vendor, contractor, and third-party access?Yes — vendor/contractor onboarding and lifecycle controls are a common focus. Tests are scoped to avoid breaching contractual obligations; we simulate realistic pretexts to reveal gaps.
- Will you expose or handle sensitive data or PII?
We avoid unnecessary exposure. Any handling of sensitive information is pre-authorized in scope and handled under strict evidence-handling procedures; PII access is minimized and redacted in deliverables.
- How long does an engagement take and what resources do you need from us?Typical physical engagements run 2–5 weeks (scoping → ops → reporting). We usually request a single technical/security liaison, legal point-of-contact, and a small subset of operational context (shift times, vendor lists) during scoping.
- Can you combine physical testing with cyber/red-team ops?Absolutely. Our hybrid engagements demonstrate how physical access can lead to network compromise — we coordinate with your cyber team or run controlled pivots to validate cross-domain risk.
