Evidence & Reporting

A physical engagement is easy to sensationalize and easy to under-document. Your report needs to show the route, the failed controls, the minimum proof of impact, and the practical remediation path without drifting into storytelling or naming-and-shaming staff.

Warning

Never photograph employee faces, personal belongings, or screen contents beyond what is needed to prove a control failure. Over-collection creates legal risk and erodes client trust.

What To Carry

Core Kit

• Signed authorization letter and point-of-contact sheet
• Charged phone and secondary note-taking method
• Body camera only if explicitly approved and legally appropriate
• Simple timestamping habit for every transition point

Evidence Rules

• Capture the control failure, not more private data than needed
• Prefer role descriptions over employee names in the final report
• Record exact timing around entry, challenge, and detection
• Keep sensitive photos segregated for sanitization before delivery

Live Timeline Discipline

engagement-timeline.txt

text

08:41 - arrived on exterior perimeter, camera coverage observed on main lobby and garage gate
08:47 - identified side entrance used by smokers, no guard visibility from reception
09:04 - entered via visitor pretext, front desk issued temporary pass without verifying host using trusted number
09:07 - reached elevator bank unescorted
09:12 - arrived on third floor, no challenge from staff despite visible visitor badge
09:16 - photographed open network drop in conference room and returned to public corridor
09:21 - exited without interception

finding logic:
- initial failure: visitor verification
- secondary failure: lack of escort enforcement
- tertiary failure: challenge culture absent on secure floor
- business impact: unauthorized person reached internal workspace and network access point in under 10 minutes
08:41 - arrived on exterior perimeter, camera coverage observed on main lobby and garage gate
08:47 - identified side entrance used by smokers, no guard visibility from reception
09:04 - entered via visitor pretext, front desk issued temporary pass without verifying host using trusted number
09:07 - reached elevator bank unescorted
09:12 - arrived on third floor, no challenge from staff despite visible visitor badge
09:16 - photographed open network drop in conference room and returned to public corridor
09:21 - exited without interception

finding logic:
- initial failure: visitor verification
- secondary failure: lack of escort enforcement
- tertiary failure: challenge culture absent on secure floor
- business impact: unauthorized person reached internal workspace and network access point in under 10 minutes

Photo and Evidence Targets

Capture	Why	Sanitization Note
Door, badge reader, or latch bypass point	Shows the specific control that failed	Avoid capturing unrelated people where possible
Camera blind spot or poor approach coverage	Turns a route description into an observable design flaw	No need to reveal full camera management UI if one photo proves the point
Sensitive room or exposed network drop	Demonstrates business impact without live exploitation	Blur asset names or labels if the client prefers sanitized output

Suggested Severity Factors

• Depth reached: lobby, workspace, restricted room, or critical infrastructure zone
• Control chain failure: one weak control or repeated failures across people, process, and hardware
• Objective proximity: could the route reasonably lead to data, network, equipment, or executive space?
• Detection quality: challenged immediately, challenged late, or not challenged at all

Finding Structure

physical-finding-template.txt

text

Title: Visitors could access staff floors without trusted host verification or escort enforcement

Summary:
During a daytime engagement, a tester received a temporary visitor badge after providing a believable contractor pretext. Reception did not verify the host via a trusted contact path, and no escort was provided. The tester reached an internal workspace and observed live network connectivity options within 10 minutes.

Why this matters:
This converts a weak reception workflow into unauthorized physical and internal access. If combined with a rogue device or unattended workstation, the issue becomes a direct bridge into technical compromise.

Evidence:
- Timeline of route and interaction points
- Photo of visitor badge and arrival on staff floor
- Photo of exposed network drop in conference area

Recommendations:
1. Require trusted host verification before issuing access
2. Enforce escort rules for all visitor badges beyond reception
3. Add challenge training for staff floors and camera coverage on elevator exits
4. Review whether conference-room network drops should remain active without local controls
Title: Visitors could access staff floors without trusted host verification or escort enforcement

Summary:
During a daytime engagement, a tester received a temporary visitor badge after providing a believable contractor pretext. Reception did not verify the host via a trusted contact path, and no escort was provided. The tester reached an internal workspace and observed live network connectivity options within 10 minutes.

Why this matters:
This converts a weak reception workflow into unauthorized physical and internal access. If combined with a rogue device or unattended workstation, the issue becomes a direct bridge into technical compromise.

Evidence:
- Timeline of route and interaction points
- Photo of visitor badge and arrival on staff floor
- Photo of exposed network drop in conference area

Recommendations:
1. Require trusted host verification before issuing access
2. Enforce escort rules for all visitor badges beyond reception
3. Add challenge training for staff floors and camera coverage on elevator exits
4. Review whether conference-room network drops should remain active without local controls

Professional Exit Discipline

Always have a burned-exit plan. If challenged, de-escalate immediately, present authorization, and move the interaction toward the approved point of contact. Your best report does not come from “winning” an argument with local security.

🛠️ Recommended Tools

📹

Body Cameras

Discreet 1080p body cameras for evidence capture during physical engagements. Always get explicit written approval before recording.

📸

Timestamp Cameras

GPS-synced timestamp cameras ensure photographic evidence has accurate, verifiable time metadata for your engagement timeline.