Physical penetration testing in Canada

This is the engagement where a stranger walks into your building and tries to reach the server room. It is also the engagement most likely to be commissioned by someone who does not have the authority to commission it.

Last reviewed 2026-09-01Written by Jacob Masse, TrazTech Inc.

A physical penetration test in Canada costs between $8,000 and $25,000 CAD plus travel and runs three to six tester days across reconnaissance, entry attempts and reporting. If you rent an office in a multi-tenant building and everything of value lives in a cloud tenancy, you probably cannot lawfully authorise most of this test, and it would not tell you much if you could. The organisations for which it is worth the money own their premises, or keep something in them that matters more than a laptop.

3 to 6 days Tester days, of which one to two are reconnaissance before anyone approaches the building

What is actually being tested

The target is rarely a lock. It is the set of assumptions your building makes about who belongs in it, and almost every one of those assumptions is enforced by a person rather than by hardware.

Access control and credentials

Whether a badge can be copied, whether a copied badge works, whether the system notices two uses of the same credential in different places, and whether anybody reviews the logs. The technology in the badge decides how hard the first question is, and the spread between the common options is enormous.

125 kHz proximity cards

The beige legacy cards still on thousands of Canadian doors. They broadcast a fixed number with no encryption and no challenge. A reader in a bag copies one from a pocket at conversational distance, and a blank card is written in seconds. If this is what you issue, assume every badge is copyable and treat the finding as an estate replacement project rather than a surprise.

13.56 MHz MIFARE Classic

Higher frequency and a real cryptographic scheme, but one that was broken publicly years ago and stays broken. Practically closer to the legacy cards than to modern ones.

Modern encrypted credentials

Current generation cards that use properly implemented cryptography and mutual authentication with the reader. Cloning stops being the route. Findings move to the enrolment process, the visitor badges, and the reader wiring, which is often still an unencrypted protocol running through a ceiling.

Mobile credentials

A phone rather than a card. Strong against copying, and it moves the question to whether the enrolment link can be obtained by asking, which is a social engineering problem covered on social engineering testing.

Entry without a credential at all

Tailgating behind an employee, which works in most buildings on most days. Under-door tools that reach a lever handle or a motion sensor on the inside. Latch shimming on doors whose deadbolt is never thrown. Loading bays and smoking-area doors propped open. Ceiling voids above walls that stop at the suspended tile. None of it requires expensive equipment, and the fix is usually procedural rather than capital.

What happens after entry

Reaching a desk is not a finding. Reaching a desk, plugging into a live network port in a meeting room and getting a DHCP address on the corporate network is a finding, and it turns into the lateral movement work described on network penetration testing. Other targets worth scoping: the server room or comms cupboard, unlocked workstations, printed material left on desks and in bins, and whether an unattended laptop can be taken out of the building past reception.

The paperwork, which is not optional

Physical testing is the one engagement where getting the authorisation wrong can end with a tester in the back of a police car and your company explaining itself to a landlord. The letter the tester carries, usually called an authorisation letter, is the document that stops that. Work through this order before anyone books a flight.

1. Confirm you have the legal right to authorise entry to every area in scope. If you lease, you almost certainly do not have that right for lobbies, lifts, stairwells, parking or loading bays.
2. Get written landlord or property manager agreement for any common area you want tested, naming the dates and the firm.
3. Have the authorisation letter signed by an officer of the company, not by the IT manager. It needs to be from someone whose authority a police officer will accept at face value.
4. Put the specifics in it: the tester's legal name, the client's legal name and address, the exact addresses in scope, the exact dates and hours, and what techniques are authorised.
5. Name two internal contacts with mobile numbers, reachable at any hour, who can confirm the engagement is real.
6. Brief building security and your own physical security lead, in writing, and keep them out of the tested population if the point is to test the guards.
7. Agree the stop condition in advance: what ends the test immediately, and what the tester does the moment they are challenged by police rather than by staff.

Comparing firms for this? Tell us what you need and it goes to the ones in the directory that do this work. No charge, and no phone number required.

If you lease, read this before you buy

Most Canadian companies buying a physical test are tenants in a multi-tenant building. Tenancy is a constraint, not a formality. You can authorise testing of your own demised premises: your suite, your doors, your server cupboard if it is inside your suite. You cannot authorise testing of the lobby, the security desk, the lift, the fire stairs or the loading dock, because they are not yours and the people working in them do not work for you.

That matters because the interesting part of the attack path usually runs through exactly those areas. A test scoped only to your own suite door, starting from inside a lobby the tester was escorted into, answers a much smaller question than the one you were asking. Either negotiate landlord participation, which is slow and often refused, or accept the narrower scope and price it accordingly. Firms that quote a full building engagement without asking who owns the building have not thought about it, which is one of the checks on questions to ask a vendor.

What it costs

Two testers rather than one is worth paying for on anything past the smallest scope. Entry attempts are safer and more effective in pairs, and one person can hold a conversation while the other works. Travel is billed on top in every case, and how it is billed differs by firm, so compare that line specifically. The general arithmetic behind day rates is on penetration testing cost in Canada.

Who should not buy this

A software company with fifty staff, a leased floor, laptops that are encrypted and a product that runs entirely in a cloud account should not buy a physical penetration test. The plausible outcome is a report saying somebody tailgated through your suite door and photographed a whiteboard, which is true, costs $10,000 CAD to learn, and is fixed by a conversation about badge discipline. The same money spent on an authenticated test of your product finds the flaws that would actually lose customer data, which is the argument made on web application security testing.

The cases where it earns its price are specific. You operate your own data centre or a colocation cage. You hold physical assets that matter: cash, pharmaceuticals, controlled equipment, evidence, original records. You run manufacturing or utilities where reaching a control panel is reaching the process. You are a public body with a statutory duty over records held on premises. Or a customer contract or an insurer has asked for it by name, which happens more often in financial services and defence supply chains than elsewhere. Check whether what your insurer is asking for is really this engagement.

Common questions