Technical exploits get the attention, but most real intrusions begin with a person: someone clicks, someone holds a door, someone reads a badge number aloud. Initial access through social engineering and physical entry is the phase where red teams most closely resemble the adversaries they emulate, and it is also the phase most likely to go wrong legally and ethically if it is run carelessly. Done right, it tells an organization something no vulnerability scan can: whether its people and premises hold up under a deliberate, human-driven attack.
This is not the defensive phishing-awareness conversation. It is the operator's side of the table, where the deliverable is a documented account of how a trained team obtained a foothold, and the hardest engineering is not technical at all. It is designing an operation that is realistic enough to be useful and constrained enough to be safe, lawful, and reversible.
Scoping and authorization come first
Nothing else matters if the paperwork is wrong. A physical or social engineering engagement without airtight authorization is not a red team, it is a crime.
- ▸Signed authorization: A written scope, signed by someone with genuine authority over the target sites and staff, defines exactly what is permitted.
- ▸Get-out-of-jail letter: Operators carry signed proof of authorization to present if detained, with a live contact who can verify it at any hour.
- ▸Defined boundaries: Named buildings, permitted pretexts, prohibited targets, and hard limits on data handling are all agreed in advance.
The human attack surface
Social engineering succeeds because it targets normal, helpful behavior rather than a flaw. Operators build pretexts from open-source intelligence, an org chart here, a vendor relationship there, a photo of a lanyard on social media, and then choose a channel.
- ▸Spear-phishing for a foothold: A tailored message that lands a credential or an authorized-payload execution, tracked carefully so only consenting scope is touched.
- ▸Vishing and pretexting: A phone call impersonating IT or a vendor to extract a credential, a callback, or a multifactor approval.
- ▸MFA fatigue and consent phishing: Techniques that abuse push-approval and OAuth consent, both catalogued in MITRE ATT&CK, to bypass the assumption that a second factor ends the conversation.
Physical entry as an objective
When scope permits, physical red teaming tests the assumption that the building itself is a control. Tailgating through a badge door, cloning a proximity card read from a few feet away, or simply wearing a high-visibility vest and carrying a ladder gets operators further than most facilities managers expect. The objective is rarely theft; it is proving reachability, a rogue device on the network, access to an unlocked workstation, or a photograph of a server room, all documented and left in place.
Rules of engagement that keep it safe
1. Define the objective precisely: what constitutes success and what access proves it. 2. Enumerate prohibited actions: no accessing personal accounts, no touching safety or medical systems, no coercion of staff. 3. Set a de-confliction contact who knows the operation is live and can pause it instantly. 4. Handle evidence minimally: capture proof of access without collecting real sensitive data. 5. Log every action with timestamps so the client can reconcile the timeline afterward. 6. Debrief the people involved constructively, framing findings as process gaps rather than individual failure.
Turning exposure into resilience
The finding that a receptionist held a door or an engineer approved a push is not an indictment of those individuals; it is evidence about the system that put them in that position without support. The valuable output of an initial-access engagement is a set of process and control changes: visitor verification that does not rely on goodwill, phishing-resistant authentication such as FIDO2 hardware keys that cannot be fatigued or relayed, and a reporting culture where flagging a suspicious call is rewarded rather than second-guessed.
For a business, this is where security stops being purely a technology problem. Regulations like NIS2 explicitly treat human and physical security as in-scope for essential entities, and boards increasingly want evidence that the organization is resilient to the vectors attackers actually use first. An authorized team that tests those vectors under strict rules of engagement, and hands back a concrete hardening plan, converts the most uncomfortable part of security, human fallibility, into a managed, measurable, and improvable control.