For public authorities Access test in the public area
Public offices have a feature that hardly occurs elsewhere: strangers in the building are completely normal. That is exactly what we test.
- The key questionCan someone get from the public area into administrative rooms unnoticed – and what can be reached there?
- Why it mattersWhere public visitors are normal, a stranger doesn't stand out. The usual vigilance doesn't apply here.
- What you have afterwardsFindings with photo evidence and measures that don't hinder public operations.
Access test in the public area
- Entry attempt via the public area during opening hours
- Checking unattended workstations and unlocked screens
- Files and printouts in the counter and printer area
- Testing access cards for copyability
- Report with measures that don't make contact with citizens more difficult
How it works in practice.
Reconnaissance
Opening hours, room layout, how public visits are handled, publicly findable information about the institution.
Access
We enter the building as an ordinary member of the public and test how far we get beyond the public area.
Depth
What can be reached from the first administrative room: workstations, filing cabinets, network sockets, server room.
Evidence
Photo and timestamp for every finding, live in the portal – documented for the file.
We try to get into your building – the way someone with bad intentions would. Not secretly behind your back, but commissioned and agreed in writing. At the end you know how far someone gets and where something stops them.
Simply walking in behind someone who holds the door open. No trick, no technology – just politeness working against you. The most common way into a building.
Many access cards transmit their ID unencrypted. A reader in a bag is enough to read it in passing and write it onto a blank card. The person affected notices nothing.
An inconspicuous device that we plug into a network socket. It establishes a connection to the outside. This answers a question that otherwise remains theory: does your IT even notice a foreign device on the network?
What is included – and what explicitly is not.
Typical scope
One public building with a public area, one to two entry attempts at different times of day.
Duration
One to two days on site, plus reconnaissance and report.
Prerequisite
Written commission, signed Rules of Engagement and a reachable escalation contact.
Not included
No burglary: we damage nothing and do not enter any areas excluded from the scope.
The test doesn't replace structural security consulting. It shows whether the existing organisational measures actually work during public opening hours.
What people ask beforehand.
Our team carries written authorisation, and your named escalation contact can be reached throughout the entire time window and can put the incident into context immediately.
Only the small circle named by you. The test examines real everyday life – that only works without announcement. The evaluation is exclusively anonymous.
Yes. We photograph situations, not people. Where people are unavoidably in the picture, they are made unrecognisable before the image is stored.
More offers for you.
Security assessment for public bodies
A technical assessment whose documentation is structured from the outset to stand up to an audit and a procurement procedure.
Access test in the public area
Public offices have a feature that hardly occurs elsewhere: strangers in the building are completely normal. That is exactly what we test.
Awareness for public employees
Training and simulation tailored to everyday administrative life: official secrecy, record keeping and a public area where strangers are normal.
What we encounter in assessments, before you encounter it.
Not a product newsletter. We write about attack paths that actually worked against Austrian businesses, authorities and schools – and what helps against them.
- About once a month, not every week
- Concrete attack paths from real assessments
- No tracking pixel, no sharing with advertisers
- Unsubscribe with one click in every email