Start a Social Engineering and Physical Penetration Testing Firm

1. 1

   Get authorization that covers people and premises

   Human and physical testing raises the authorization bar far above network testing. You need explicit written permission from someone with authority over the premises and staff, a detailed rules-of-engagement document, agreed targets and off-limits areas, and physical authorization letters that operators carry in the field to prove the activity is sanctioned if they are stopped. Without this, tailgating and physical entry are trespassing or worse, not a service. Legal precision is non-negotiable.

2. 2

   Scope the human and physical attack surface

   Define what you will test: pretext phone calls and targeted email against staff and help desks, tailgating and piggybacking at entrances, badge and access-control testing, drop-device and USB tests, and controlled attempts to reach sensitive areas. Agree objectives (reach the server room, obtain a live credential) and hard safety boundaries. Bespoke, objective-based scoping is what distinguishes this from a generic phishing tool.

3. 3

   Operate safely and ethically in the field

   Field work demands discipline: never endanger people, never damage property, de-escalate immediately if confronted and present your authorization, and respect the humans you test, since the goal is to strengthen the organization, not humiliate staff. Document everything. Your professionalism in the field protects the client, the employees, your operators, and your firm's reputation, which is the whole asset.

4. 4

   Build the toolkit and tradecraft

   Assemble the practical kit (covert cameras where authorized, access-control and RFID testing tools, lock-and-bypass gear used only within scope, pretext materials) and the soft skills that matter most: believable pretexts, calm improvisation, and reading people. Much of the value is human tradecraft, not gadgets. Train relentlessly and, where useful, hold relevant credentials that build client trust.

5. 5

   Deliver findings that fix people and processes

   The report should show the attack path, what worked and why, and concrete fixes: staff training, help-desk verification procedures, access-control improvements, and policy changes. Frame findings constructively so the client improves rather than punishes employees. Pair with security-awareness recommendations, and note that ongoing awareness training is a related but separate offering (the existing phishing-simulation-training card).

6. 6

   Sell to security-mature buyers and protect the firm

   Your buyers are organizations that already test their networks and realize their people and doors are untested: financial services, healthcare, data-center and critical-facility operators, and enterprises. Carry robust professional liability and general liability insurance, use ironclad contracts, and vet each engagement's legality carefully. Reputation and demonstrated discipline win the work, so one careful reference client opens the sector.

Do not take our word for the money. Put your own numbers in and see what this idea has to earn before it works. Free, instant, no account needed.

Best for: Offensive-security professionals comfortable with people, pretext, and disciplined field operations

Not for: Not for anyone who would cut corners on authorization or safety; the legal and physical stakes are real and unforgiving. It is distinct from the automated phishing-simulation-training card in the bank (bespoke in-person work versus a training product) and complements the red-team-consultancy card in this file.