Test physical access

An adversary can test physical access options in preparation for the actual attack. This could range from observing behaviors and noting security precautions to actually attempting access. [1] [2]

ID: T1360
Sub-techniques:  No sub-techniques
Tactic: Test Capabilities
Version: 1.0
Created: 14 December 2017
Last Modified: 17 October 2018


Detectable by Common Defenses (Yes/No/Partial): Yes

Explanation: Defender often install badging, cameras, security guards or other detection techniques for physical security and monitoring.

Difficulty for the Adversary

Easy for the Adversary (Yes/No): No

Explanation: Requires a physical presence in the space being entered and increased risk of being detected/detained (e.g., recorded on video camera)


  1. Orange County Intelligence Assessment Center. (n.d.). Pre-Incident Indicators. Retrieved March 28, 2017.
  1. The Canadian Press. (2012, August 22). Reporter says Chinese news agency asked him to spy. Retrieved March 9, 2017.