Breaking In, Evil Style - A Guide to Scaring Your CEO

The talk opens with a problem many testers recognize: physical weaknesses are expensive to fix, and technical findings alone rarely get budget approved. The speaker walks through a fictionalized physical red team engagement. It covers impersonating IT staff, planting devices on workstations and the network, cloning badges from a captured card serial number, and sabotaging a strike plate so the door can be slipped at night for persistence. The operation ends with a late-night theft of a master key, prototypes, schematics, and a freight carrier list hidden in a recycling bin.

The middle section focuses on the readout rather than the operation. The speaker argues that each finding needs two things: evidence that real attackers do this, and a credible monetary impact. Examples include a ransomware group that sent people to law offices to plug devices into laptops, a cellular Raspberry Pi used to breach an ATM network, and the replacement costs of a lost master key or a compromised badge encryption key. Freight theft is presented as the highest-impact case, since fake pickups have led to large losses across several industries.

The closing takeaway is to rank findings by realistic impact and likelihood instead of by how clever the exploit is, and to find the industry-specific threats that matter most to the organization. Reports can hold the technical detail, while presentations to executives should lead with precedent and loss figures. The Q&A touched on handling operations that get interrupted by guards and on how public sector work may need compliance-based arguments.