A council office has to let the public in. A water treatment works may sit at the end of a country lane with nobody on site overnight. A transport control room depends on contractors who change every few months. When the organisations that run essential services are breached, the consequences reach well beyond their own walls, to the communities that rely on them.
Open by design, secure by necessity
Public sector buildings face a particular challenge: they must be accessible to citizens while protecting staff, records and systems. We test where public areas end and protected areas begin, and whether that line holds when someone confident and plausible tries to cross it.
Remote and unstaffed sites
Much critical infrastructure is dispersed across many small sites, often unstaffed and monitored remotely. We look at how quickly an intrusion at one of those sites would be detected, how long a response would take and what an intruder could do in the meantime.
Regulation and resilience
Operators of essential services in sectors such as water, transport and digital infrastructure have security duties under the Network and Information Systems Regulations 2018. Physical testing provides evidence that controls protecting those systems work in practice, not only on paper.
Planned around operations
Tests are scheduled and scoped with your security and operations teams so that services and the public are never put at risk.
For organisations reviewing their wider exposure, a threat analysis is a sensible starting point. Talk to our team.
