How a penetration test identifies vulnerabilities

A security penetration test often begins inconspicuously. At the entrance to a client’s premises, a man in a yellow vest walks behind a truck. His stride is relaxed, as if he walks around here every day. The driver checks in with the security guard as usual; the guard recognizes him and exchanges a few words. In that brief moment, the man behind him slips inside almost automatically. No badge, no check-in, and no official business on the premises. Just a demeanor that cleverly takes advantage of the morning rush.

Situations like these rarely stand out. They are part of the daily hustle and bustle of a workday where many things happen at once. As visitors check in, suppliers arrive, and employees coordinate with one another, there are brief moments when an unauthorized person might try to slip in. It is precisely these moments that reveal just how vigilant security is in its day-to-day operations.

Tailgating—following an authorized person—is one of the most common forms of unauthorized access. It occurs in offices, distribution centers, port areas, and municipal buildings. A visitor who has forgotten their badge, a technician who says they “just need to check something,” or an employee who holds a side door open a little longer than is prudent. These incidents may seem minor, but they require vigilance—especially when events unfold rapidly.

Organizations want to know how their security systems respond when an unexpected situation arises—not in a training room, but in the middle of a workday. Penetration tests provide insight into that moment. They show how processes behave when a scenario doesn’t go according to plan and how security personnel respond when someone unexpectedly tries to gain access.

SERIS conducts approximately 50 of these tests each year. We perform them at locations where we provide security personnel ourselves, as well as at organizations that work with other security providers. The latter category is no exception. After all, a client who wants to have their own security partner evaluated benefits from an independent perspective. The butcher doesn’t inspect his own meat. SERIS can fulfill that role: with no stake in the outcome, focused purely on what the site reveals.

The test focuses on security as a whole, not on the individual. It examines how processes work, how people act, and how quickly anomalies are detected. The results are immediately actionable. A penetration test reveals where security is strong and where there is room for improvement. Sometimes it comes down to details in behavior. Sometimes it involves structural elements in the security protocol. In all cases, the client gains a clear picture of the current reality.

An effective penetration test begins with understanding the target. SERIS examines the daily activities at a location: how employees enter the premises, when visitor traffic peaks, which entrances are frequently used in practice, and where routines develop that could create vulnerabilities. Based on this analysis, we determine which scenario makes sense and is therefore realistic to test.

No two tests are the same. Each scenario is tailored to the specific situation at the location and the associated risks. This could be a classic tailgating scenario, in which a tester slips in behind a group of employees during the morning rush hour. It could also involve a fake technician who tells the receptionist that he was called in for a malfunction and politely asks if he can come in. In other cases, we test how a location responds when someone presents an ID that’s just slightly off but confidently states that the rest of the group is already inside. Or an evening scenario where we assess how vigilant security remains when visitor traffic is low but attention levels also drop. Sometimes it’s purely social manipulation: a convincing story, the right tone, and a seemingly logical context through which someone tries to pass through an entrance without anyone really giving it a second thought.

This variation is intentional. Security measures that always anticipate the same type of situation have, in effect, only learned to respond to that one pattern. By structuring each scenario differently, even the less obvious vulnerabilities become apparent.

Some clients choose to discuss the scenario in advance. This is valuable, especially when a test is part of a broader training cycle. More often, however, the test itself comes as a surprise—and not just the scenario. The timing of the test is also a surprise. It could take place early in the morning, in the middle of a busy delivery period, or on a quiet Wednesday afternoon. After all, in real life, a genuine threat doesn’t give itself away in advance.

After each penetration test, the tester and the security professional involved hold a discussion. This discussion takes place immediately, while the situation is still fresh in everyone’s mind. They discuss what was observed, what raised concerns, and why certain decisions were made. The discussion is professional and aimed at enhancing professional expertise.

Security guards, whether they work for SERIS or another security organization, often say that these are valuable moments. They can see exactly how they reacted, which cues they did or did not pick up on, and where their strengths lie. The differences often lie in small details: a glance, a posture, a phrase that doesn’t quite fit with the visitor’s story. By discussing these details, insight into one’s own actions grows.

This also benefits clients. They gain a clear understanding of the extent to which security guards reflect on their work, ask questions, and contribute ideas for improvement. That attitude plays a major role in determining the effectiveness of the security process.