Access Logs

Decades before I ever ran a covert entry engagement or heard the term social engineering, I was learning it off a VHS shelf. Axel Foley, Ferris Bueller, and Fletch were teaching the same lessons I'd lean on for an entire career, and they were doing it without a single piece of technology. Everyone's worried about AI now, but the target hasn't changed.

A cocky client slid the authorization across the table with a smirk and a "Good luck," dead certain their building was a fortress. A few days of quiet recon, a forged badge, and one well-timed foot in a closing door later, we were running their production network from the hotel parking lot. They never saw us. They'll definitely remember us.

The front entrance had an armed guard, the server room had a lock, and the Security Control Room had a key box holding more than anyone meant to hand over. What it didn't have was anyone paying attention. A clipboard, a cold-open, and a little compliance jargon were enough to walk us past every layer.

Everyone wants to talk about what's in the bag. The truth is, the bag doesn't matter half as much as the person carrying it. Brent White and Tim Roberts break down the tools they actually use on real red team assessments — and more importantly, how they think about using them.

What happens when a federal facility transitioning into a SCIF leaves its rooftop forgotten, its access control panel on default credentials, and its employee badges worn in public every morning? You find out exactly how far a few overlooked details can take you. This is Access Log 001.