Back To The Failure: Did Your Physical Security Evolve In The Last 40 Years?

Simon Geusebroek, a physical penetration tester, opens by asking whether physical security has really improved over the past four decades. He contrasts classic heist and social engineering scenes from films with what his team still manages to do during assessments of data centers, industrial sites and offices, arguing that many decades-old tactics still work today.

The middle of the talk walks through recurring weaknesses. Doors that look like exits but are never assessed as entry points, leftover default locks whose keys are widely sold, and gaps already opened in perimeter fences all give easy routes in. A certified armored door with biometric authentication was defeated because a worn deadlatch went unnoticed, something no visual inspection or certificate would reveal. Adding more devices does not fix weak points, and cameras mostly serve as forensic evidence rather than detection. Several anecdotes show guards and managers dismissing intruders or closing alerts without investigation, and a casual disguise such as a picnic or a high-visibility vest can make an intruder look legitimate.

The closing takeaway is that physical security should follow the same practices as cybersecurity: test controls instead of assuming they work, find the weakest point, fix it, and retest in a continuous loop. Organizations should also be wary of handing security entirely to a contractor and relying on insurance, since that protects neither reputation nor intellectual property.