Physical Intrusion

Physical intrusion uses social engineering to enter, move through, observe, or interact with a physical environment without proper authorisation. Attackers may present a legitimate purpose, exploit weak visitor processes, or use social pressure to reduce scrutiny at an access point.

Apparent legitimacy often comes from confidence, routine, clothing, equipment, or knowledge of the site. Face-to-face interactions can also make challenge more difficult when the person appears senior, claims urgency, or behaves as though verification is an unreasonable delay.

A convincing intrusion attempt may use details learned through prior observation or public information. Where presence is accepted from appearance or context, visitor, sign-in, escort, and access controls become discretionary.

How it appears

Physical intrusion can be adapted to a site’s access processes, delivery routes, visitor workflow, and normal movement patterns. An attempt may present as a delivery or maintenance visit, with the claimed purpose adjusted to the location and the access sought.

Attempts usually pair a claimed purpose with an access or movement request. A justification for skipping, softening, or accelerating normal process often supports the pretext, and uniforms, tools, work orders, staff names, or site terminology add apparent legitimacy.

Element	What it means	Examples
Claimed purpose	The stated reason for being on site.	Delivery, inspection, maintenance task, IT support visit, meeting, audit, emergency check.
Claimed identity	The person or role presented during the interaction.	Contractor, cleaner, supplier, visitor, new starter, courier, facilities worker, support technician.
Requested access	The movement, entry, or assistance sought.	Open a door, badge a person in, allow waiting inside, provide directions, grant room access.
Apparent legitimacy	The details that make the person or purpose appear credible.	Uniform, tools, parcel, badge, lanyard, clipboard, work order, site language, real staff names.
Pressure or influence	The manipulation used to make challenge or delay less likely.	Urgency, frustration, authority, confidence, politeness, embarrassment, concern about appearing obstructive.
Process bypass	The explanation used to avoid expected access controls.	“I already signed in,” “someone is expecting me,” “I forgot my badge,” “I just need two minutes.”

Indicators

Physical intrusion often presents through small access, behavioural, or process inconsistencies. Confidence and apparent familiarity prove nothing about authorisation.

Indicator	What to look for
Unverified presence	A person is present in a staff-only, restricted, operational, or sensitive area without confirmed authorisation.
Missing access process	Reception, visitor registration, host confirmation, badge collection, or site induction steps have been avoided or left incomplete.
Authorisation mismatch	Required identification, visitor pass, contractor credential, escort, or access token is missing, inconsistent, or unsuitable for the area entered.
Escort mismatch	A visitor, contractor, or support person moves through the site alone where escorting is normally required.
Access pressure	Staff are pressed to hold a door, open a gate, share controlled entry, or make an exception to the access process.
Story and route inconsistency	The stated purpose changes when questioned or does not align with the location, route, equipment, or area being accessed.
Operational probing	Questions focus on staff movements, rosters, access paths, security routines, room functions, deliveries, or internal processes beyond the stated purpose.
Process resistance	Requests to wait, sign in, verify identity, or contact a host produce impatience, dismissal, defensiveness, or excessive familiarity.
Unexplained items or placement	Unknown devices, USB drives, QR codes, parcels, papers, or equipment appear in shared, restricted, or unattended areas.