The sub-techniques beta is now live! Read the release blog post for more info.

Test physical access

An adversary can test physical access options in preparation for the actual attack. This could range from observing behaviors and noting security precautions to actually attempting access. [1] [2]

ID: T1360
Tactic: Test Capabilities
Version: 1.0
Created: 14 December 2017
Last Modified: 17 October 2018


Detectable by Common Defenses (Yes/No/Partial): Yes

Explanation: Defender often install badging, cameras, security guards or other detection techniques for physical security and monitoring.

Difficulty for the Adversary

Easy for the Adversary (Yes/No): No

Explanation: Requires a physical presence in the space being entered and increased risk of being detected/detained (e.g., recorded on video camera)


  1. Orange County Intelligence Assessment Center. (n.d.). Pre-Incident Indicators. Retrieved March 28, 2017.
  1. The Canadian Press. (2012, August 22). Reporter says Chinese news agency asked him to spy. Retrieved March 9, 2017.