Physical intrusion: four patterns we find

The security of a connected system does not end at the network. Part of our work is authorised physical intrusion: attempting to reach a defined asset inside the premises, to show where logical access control is bypassed by a door nobody locked.

Illustrative examples, not client cases. Each scenario is built from scratch out of patterns that recur across the sector. We do not describe the scopes, findings or premises of real clients, and we do not publish intrusion methods. What matters here is the weakness and the fix, not the path.

Telecommunications· Portugal

The shared technical room

The recurring weakness: Critical network equipment in a technical room shared with the building's facilities, whose key circulates among porters, electricians and suppliers with no record of who enters and no separation between the operator's rack and the rest of the room.
Why it matters: Logical access control can be impeccable and the equipment's management ports are still within reach of anyone who gets into a room nobody treats as sensitive.
The fix: Physically separate the critical rack inside the shared room, with its own lock and log; treat physical access to management equipment the way remote access is treated, with an owner and an audit trail.

Agri-industry· Brazil

The greenhouse that talks to the cloud

The recurring weakness: A production site with hundreds of connected sensors and controllers, whose security was designed for the software and the cloud, but whose field cabinets sit in open areas, next to loading zones crossed daily by trucks and external staff.
Why it matters: The easiest attack surface is in the field: the maintenance port of a controller in an unlocked cabinet, within reach of anyone passing by.
The fix: Carry the threat model down to the field cabinet: locks and tamper detection, maintenance ports disabled by default, and per-device identity so a controller compromised in the field is not access to the rest.

Industry· Germany

The badge that opens everything

The recurring weakness: A factory with modern badge access control at the door, but where the same badge, once inside, opens the office, the production line and the server room indistinctly, with no zones and no re-checking of who should be where.
Why it matters: All the control sits at the perimeter: past the gate, the site is a single space. Someone who enters for a legitimate reason reaches systems that have nothing to do with that reason.
The fix: Zone the interior by sensitivity, beyond the perimeter, with least privilege applied to physical access; the room housing the industrial systems is a zone of its own, with its own rule for who enters.

IoT product· United Kingdom

The device you can take home

The recurring weakness: A connected product installed in public or easily accessible spaces, designed assuming nobody opens it. The manufacturing secret is shared across units, and physical access to the board gives access to the firmware and the credentials.
Why it matters: An attacker who can be alone with one unit for a few minutes extracts what they need to impersonate any other unit in the fleet. It is precisely the scenario the CRA requires you to close: a per-unit secret, verified boot, tamper resistance.
The fix: Treat physical possession of the device as part of the threat model from the design stage: unique per-unit identity and secret, sensitive data encrypted at rest, and debug ports closed on the production unit.

The pattern is always the same: you invest in the security you see on screen and forget the one a key reaches. We do this work with written authorisation, a defined scope and rules of engagement, and insurance cover confirmed before every engagement. The full framing is under services.

Do you have a site or a product where physical access is a concern? Write to us: oi@folhas.io