Your network assumes the attacker comes through the firewall. A red team with a thirty-dollar badge cloner starts inside, as a trusted employee.

THE ATTACKER DOESN'T ALWAYS COME THROUGH THE FIREWALL

Spend a day looking at how organizations allocate security effort and a pattern jumps out. The money, the talent, and the monitoring cluster at the network edge. Firewalls, VPN appliances, email gateways, endpoint agents, a SIEM correlating all of it. The mental model underneath is a castle wall, and the wall faces the internet. It is a reasonable model for the threats that arrive as packets. It quietly assumes that is the only way threats arrive.

A capable adversary does not share that assumption. If the cheapest, most reliable path to your data runs through the lobby instead of the firewall, that is the path they take. And for a striking number of organizations, it does. The barrier between the public sidewalk and a live network jack is often a glass door and a badge reader, and the badge reader frequently trusts a credential technology that was designed before encryption was a default expectation. You can spend seven figures hardening the network edge and still leave the actual edge, the one made of doors and readers and an unlocked supply closet with a switch in it, effectively open.

This is not a hypothetical we reach for to sound dramatic. It is the most consistent finding in physical-inclusive engagements, and it works because the entire defensive posture was built facing the wrong direction.

THE BADGE IN YOUR POCKET RUNS A 1990s PROTOCOL

The card clipped to a lanyard or sitting in a wallet is doing less than most people assume. A classic 125 kHz proximity card, the kind that has been the default for decades, holds a number. When it gets close to a reader, it broadcasts that number. There is no encryption, no challenge, no mutual authentication, nothing that proves the card is the real one rather than a copy. The reader was built to answer a single question, "what number is this," and it cannot tell a genuine card from a device replaying the same number back.

That design is why cloning is trivial rather than clever. Inexpensive, widely sold tools can read one of these cards from short range, including while it sits in a bag or pocket, store the number, and emulate it on demand. The reader cannot distinguish the emulation from the original. The credential vendors know this. HID, the largest name in the space, has publicly acknowledged that cheap consumer hardware turned 125 kHz prox into a genuine risk rather than a theoretical one. The tooling is mature, the technique is old, and the installed base of vulnerable cards is enormous because nobody rips out a working access-control system on a normal budget cycle.

The wiring behind the reader is often no better. Many systems still carry the credential from reader to controller over the Wiegand protocol, which sends the data in the clear with no authentication on the wire. A small device spliced inline can capture or inject credentials at that layer too. Newer credentials at 13.56 MHz with real cryptography, and the encrypted OSDP protocol on the wire, close most of this. The problem is not that secure options do not exist. It is how much of the world is still running the insecure ones.

WHAT A PHYSICAL FOOTHOLD ACTUALLY BUYS

Getting through the door is not the goal. It is step one, and the reason it matters is what the inside of most buildings looks like once you are past the badge reader. The interior is soft, because the whole security model assumed the wall would hold.

Inside, the attacker finds the things an internal network quietly trusts. Ethernet jacks in conference rooms, empty offices, and hallways, many of them live and most of them with no network access control asking who just plugged in. Workstations left unlocked while someone steps away. Printers and IoT devices with default credentials sitting on the same flat network as everything else. A desk to sit at and look like they belong. The single most valuable move is often the quietest: connect a small, cheap implant, a device the size of a phone charger, to a live jack or behind a desktop, and walk back out. That implant phones home over cellular or the building's own internet, and now there is persistent remote access into the internal network from the parking lot, or from another country. This is the exact moment physical security becomes digital security. The badge clone bought the foothold. The implant turned it into the same remote access an external attacker spends weeks trying to earn, except it skipped all of that.

From there the engagement looks like any internal compromise. Map the network, find the domain controllers, hunt for credentials, escalate, move toward the data that matters. The difference is the starting line. The attacker began on the inside, as a trusted presence, behind the firewall and often beneath the notice of tools tuned to watch the perimeter.

Figure 01

1. 01

   Clone and enter. Read a 125 kHz badge in passing or tailgate through a held door, then badge in as a trusted employee. No alarm, no anomaly.

2. 02

   Find the soft inside. A live network jack with no access control, or an unlocked workstation. The interior assumed the perimeter would stop anyone hostile.

3. 03

   Leave an implant. Connect a small device that phones home, converting a few minutes on site into persistent remote access from anywhere.

4. 04

   Pivot to the domain. From inside, run the ordinary internal playbook: recon, credentials, escalation, the data that matters. The hard part, getting in, is already done.

YOU SPENT THE BUDGET ON ONE DOOR

The clearest way to see the gap is to map where the defenses sit against where the attacker actually walks. There are two ways into the internal network. One is instrumented to the hilt. The other is guarded by a card from the last century.

Figure 02

THE DIGITAL DOOR (where the budget went)

1. FIREWALL

2. EDR

3. SIEM

// monitored, funded, watched 24/7

THE PHYSICAL DOOR (where the attacker walks)

1. BADGE READER

   125 kHz, no crypto

2. LOBBY

   tailgate / clone

3. NETWORK JACK

   live, no NAC

// unmonitored, low cost to defeat, rarely tested

INTERNAL

same network, both paths land here

Two ways in. You instrumented the top one and left the bottom one to a card from the 1990s.

WHY ALMOST NO ONE TESTS THIS

If physical access is this effective, the obvious question is why it is so rarely on anyone's radar. The answer is process, not ignorance. A standard penetration test is scoped to a list of IP addresses and applications. Physical access is written out of scope in the first paragraph of the engagement letter, usually for legitimate reasons of safety and liability. Compliance frameworks check that badge access exists, not whether the badge technology resists a thirty-dollar copier. The result is a blind spot that is structural rather than accidental: the single path that bypasses every digital control is the single path the assessment is explicitly told not to walk.

Compliance frameworks check that badge access exists, not whether the badge technology resists a thirty-dollar copier.

This is the same scope theater that lets an organization say it passed its last pentest while a real adversary would not have bothered with the parts that were tested. A test that only ever looks at the network edge will keep certifying that the network edge is sound, which it may well be, while the door stays open. Attackers do not respect scope boundaries. They find the cheapest path to the objective, and that path frequently begins with a person walking into a building.

THE SEAM NO ONE OWNS

There is an organizational reason this gap persists, and it is worth naming because it is fixable. In most companies, the doors belong to facilities and the network belongs to security, and the two rarely sit in the same meeting. Facilities buys and maintains the access-control system on a building-operations budget, judged on whether doors open for the right people and stay shut otherwise. Security defends the network and is measured on breaches and compliance. The badge reader sits exactly on the boundary between those two charters, which means it is effectively owned by neither. The card technology is a facilities purchasing decision with profound security consequences that the security team often never reviews.

An attacker does not see two departments. They see one continuous path from the sidewalk to the domain controller, and they walk straight across the seam that the org chart pretends is a wall. Closing it does not require new technology so much as a conversation that usually has never happened: security treating the physical access system as part of its attack surface, and facilities treating credential choice as a security decision. The first organization to put both teams in the room tends to find the gap fast, because it was obvious all along to everyone except the people who could fix it.

WHAT REAL ADVERSARY SIMULATION LOOKS LIKE

The work that actually reflects how breaches happen does not stop at the firewall. It combines the physical and the digital into one continuous path, because that is how a determined adversary operates. It starts with reconnaissance of the site and the people, tests whether a credential can be cloned or a door tailgated, moves to what can be reached from inside the building, and then carries that foothold into the network the same way an external intrusion would, all under explicit authorization and tight rules of engagement. The point is not theater. It is to find the seams between physical and digital security that neither team owns, and to do it before someone hostile finds them first.

Most organizations have never seen their environment tested this way, which is exactly why the findings tend to land hard. The badge that clones in seconds, the conference-room jack that hands out a DHCP lease to anyone, the workstation left unlocked, the gap between the facilities team that owns the doors and the security team that owns the network. None of those show up in a network-only test. All of them show up when someone simulates the whole path.

WHAT TO DO ABOUT IT

1. 1

   Retire 125 kHz prox credentials. Move to modern 13.56 MHz cards with real cryptography and mutual authentication, such as SEOS or DESFire EV-class credentials. UID-only high-frequency cards are not enough; the security has to be in the protocol, not just the frequency. For sensitive areas, require a second factor at the door, a PIN or a phone-based credential, so a cloned card alone is not a key.

2. 2

   Encrypt the wire, not just the card. Replace Wiegand reader-to-controller links with OSDP in secure channel mode so credentials cannot be captured or injected with an inline device. Upgrading the card while leaving Wiegand in place only moves the weak point a few inches.

3. 3

   Put access control on the network jacks. Deploy 802.1X or NAC so an unauthenticated device plugged into a wall port gets nothing. A live, open jack in a lobby or conference room is a network onramp for anyone who reaches it, and it is the move that turns a physical foothold into a digital one.

4. 4

   Lock the soft interior. Enforce short auto-lock timers on workstations, disable unused ports, get IoT and printers off the flat user network, and treat the inside as hostile-capable rather than implicitly trusted. The assumption that everyone past the lobby belongs there is the assumption being exploited.

5. 5

   Make tailgating socially unacceptable, with help from design. Anti-tailgating training only sticks when the building supports it: turnstiles or mantraps at sensitive entries, clear escort policy for visitors, and a culture where challenging an unbadged stranger is normal rather than rude. Technology sets the ceiling; behavior decides the floor.

6. 6

   Scope physical into your testing. The path you never test is the path you never fix. Bring physical access into your assessment program, under proper authorization, so the badge, the door, the jack, and the seam between facilities and security all get exercised before an adversary does it for you.

FURTHER READING

1. IPVM // HID on cheap tools making 125 kHz prox dangerous
2. Reference // proximity card technology and 125 kHz limitations
3. Reference // the Wiegand interface and its lack of encryption
4. Reference // OSDP, the encrypted alternative to Wiegand