Testing & exercises
Physical penetration testing & full-scale exercises
Designing a system is not enough: it must be tested. We test the real resistance of your site and the coordination of your teams - to reveal weaknesses before they are exploited.
The challenge
A system is only worth what it delivers on the day it is attacked
Cameras, badges, procedures, guards: on paper, everything seems in place. The real question lies elsewhere - what happens when someone actually tries to get in? A physical penetration test answers this with facts, not assumptions. It reveals the gap between the intended system and its real robustness.
Our approach
How we test your security
Scoping & objectives
We define the scope, realistic threat scenarios and rules of engagement: what is tested, what is not, and the safety guardrails.
Scenario design
We build credible scenarios from your real context: tailgating, borrowed badge, diverted delivery, forgotten service entrance - what a malicious actor would really attempt.
Execution under real conditions
Our team tests the set-up on the ground, discreetly and safely, to measure what your technical, human and organisational measures can actually stop.
Debrief & action plan
You receive a clear report: the weaknesses exploited, ranked by severity, and concrete recommendations - organisational as much as technical - to fix what matters.
What you get
A report that drives decisions
A penetration test does not stop at the finding. We link each weakness to what it would actually allow, then we prioritise - so you know what to fix first, and how.
- Detailed, confidential test report
- Weaknesses ranked by severity and remediation effort
- Concrete, actionable recommendations
- Oral debrief to management
- Checkpoints to verify remediation
Under real conditions
A full-scale exercise of close to 400 responders
Before the 2025 UEFA Women's Euro, DBA Sécurité ran a simulation exercise at the Stade de Genève mobilising police, emergency services and private security, to test the coordination of actors and the response protocols before the competition. Testing a system before the event is exactly our business.
FAQ
The questions we are asked
Is it the same as an IT penetration test (pentest)?
No. An IT pentest targets systems and networks. A physical penetration test challenges the real access to your premises and sensitive areas: access control, badges, tailgating, guard reaction, procedures. The two are complementary, but they are distinct disciplines.
Is it legal and risk-free?
Yes, as long as the test is framed. It relies on a written mandate, a defined scope, rules of engagement and safety guardrails agreed in advance. Nothing is left to chance: the goal is to reveal weaknesses, not to create an incident.
Should the teams be warned?
It depends on the objective. A test without the teams' knowledge measures their real reaction; an announced test validates specific procedures. We decide together during scoping, always with respect for people.
And a full-scale exercise, is it different?
Yes. The penetration test challenges the resistance of a site; the full-scale exercise tests the coordination of all actors (private security, police, emergency services) against a major scenario. We carry out both, depending on your challenges.
Ready to test your set-up?
Let's talk about your site, your challenges and the most useful scenario to test.
Contact us