"There were gaps in their security, literal gaps."

Sizing Up the Target

We arrived on site just before the end of business day, pulling into the surrounding area like we had done countless times before. This target was a government facility, the kind that tries very hard to look like a city-fortress from the outside. Armed security guards in tactical vests, multi-band radios and sidearms at their hip, and immediate visibility. Always a good sign that someone, somewhere believes they've done things correctly, or at least wants it to look that way.

There were multiple guards working the perimeter. Some moved on foot, pacing predictable routes between entry points and corners of the property, while another rotated around the block on a bike, occasionally cutting between nearby buildings and looping back toward the main entrance. It wasn't random. It was structured, repeatable, and easy enough to study if you gave it a little time.

The front entrance was exactly what you would expect. The durable glass double doors made it easy to see the request-to-exit (REX) sensor mounted between them from across the street. The wall of glass also helped us identify a guard stationed just inside the lobby. He wasn't distracted, either. He was watching badges, watching people, and doing the job in a way that would shut down most low-effort attempts immediately. He was actively approaching and talking with nearly every single person entering through that door. Anyone trying to walk straight through the front without a plan was going to have a bad day.

So we didn't waste time there. There is always another way.

Finding a Better Angle

Instead, we did what we often do when the front looks solid. We looked elsewhere. The surrounding area had a few taller public buildings and parking garages that gave us a better vantage point. From above, you can watch without being part of the environment, and more importantly, you can let the environment reveal itself without interfering with it.

Pro tip: We learned this from a Private Investigator friend of ours. Public parking garages make great stakeout locations.

From that position, we were able to observe everything we needed. Exterior and interior guard movement patterns and interactions, employee traffic, the cadence of people entering and exiting, and even interior behavior through the glass doors and walls. Over time, security culture starts to show itself in subtle ways. Who hesitates, who doesn't, who gets questioned, and who walks through without a second glance.

But while we were watching all of that, something else stood out.

Behind the building, partially obscured from the main flow of traffic, was a gated ramp leading down into an underground parking garage. It was clearly intended for VIP or restricted access, and at a glance, it looked far more secure than anything else on the property. The gate itself was heavy-duty steel, not something you could casually bypass or force open. It gave the impression that whatever was beyond it was well protected, or at least obstructed from surface view.

What made it interesting wasn't just the gate, though. It was what typically comes after.

In most environments like this, those garages have stairwells and interior access points. And if those doors rely on badge access controls paired with ADA-compliant lever handles, and more importantly, if they lack proper alarm sensors, you start to see opportunities. The kind that don't require brute force, just a willingness to think a little differently.

We knew our first attack path.

Pattern-of-Life and Preparation

Later that evening, we regrouped over pizza at a place not far from the facility. It gave us a clear view of the parking lot and enough of the building to continue observing without being obvious. We watched the lights inside the target floors flick on and off as the cleaning crew moved through, timestamping each event. You could practically map their route just by paying attention. With so much visible through the windows, we didn't need days to understand their pattern-of-life.

Pro tip: This is one of those details that often gets overlooked. If your building is fully lit at night and your windows aren't treated or tinted, you are effectively broadcasting your internal activity to anyone willing to watch. Cleaning crews moving through offices, opening doors, interacting with equipment, it all becomes visible, and it all becomes predictable over time.

As the evening progressed, we also noticed a steady presence of vagrants moving through the area. In some scenarios, that can be leveraged by blending into an existing population, becoming part of the background noise, hiding tools in baggy clothing, dome tents, and so on. It's a viable approach under the right conditions. However, it also comes with risks that weren't necessary for us to take. If you don't know the environment well and you don't understand the people who occupy it, you can quickly create a situation that you can't control. The last thing we needed was an unpredictable variable complicating an otherwise clean plan or compromising our personal safety.

So instead, we went with something far more reliable.

Going Invisible

We went invisible. It's easy to do when you can get away with wearing multiple layers because of the weather. Always consider this when you plan for your travel, guises, concealment, and comfort.

Dark slacks, neutral shoes, laptop bags, polos with plain zip-ups, winter coats (because it was very cold, and even more of an excuse to carry hand warmers), but nothing flashy and nothing memorable. The kind of look that says "we work here" without ever having to say it out loud. It's one of the most effective disguises there is, because no one questions it. You're not interesting enough to remember.

We approached the building by walking the block, keeping our distance until we were ready to move in. Cameras were positioned at the front as expected, but the rear told a different story. A single static camera was mounted in a way that clearly prioritized vehicle traffic entering and exiting the garage, not individuals approaching on foot. By staying tight to the exterior wall, we were able to move outside of its effective coverage without much effort. Once we reached the ramp, we made our way down quickly to disappear from cars coming down the street.

The Gate

At the bottom, the gate came into full view. Up close, it looked just as solid as it had from a distance. Heavy steel, industrial construction, designed to stop vehicles and discourage tampering. Inside the garage, the lighting was bright enough to clearly see the access control panel mounted just beyond the barrier. It featured a touchscreen interface with administrative options that, under normal circumstances, would allow authorized users to open the gate. The problem was simple. It wasn't meant to be reached from our side. At least, not easily.

We've seen similar setups before, and over time you start to notice a pattern. Systems like this are often installed with the assumption that the barrier itself is enough. The focus is on vehicles, on throughput, on convenience for authorized users. What gets overlooked is how those same systems can be interacted with in ways they weren't designed for. There were gaps, like literal ones. Small spaces in gates, seams in construction, areas that don't seem significant and aren't often thought of as issues, until someone decides to exploit them.

In the past, we've tried a number of approaches. Improvised methods, physical positioning, even attempting to manipulate sensors indirectly. At one point, we went as far as trying to encourage a stray cat to trip a request-to-exit sensor by strategically placing food nearby.

For the record, cats are not reliable team members.

Deploying the Drone

This time, we came prepared with something more deliberate. A small quad drone, compact enough to fit through the gap in the gate, and just powerful enough to carry a simple heat source. Nothing complex, just a hand warmer secured to the top with gaffer tape. The idea had come up in previous discussions, and this was the first opportunity to apply it in a real environment.

I positioned the drone at the base of the gate, slid it carefully through one of the openings, and set up on the other side of the barrier. FPV goggles on (I mean, if we're living in a dystopian future, why not lean into the whole cyberpunk vibe?), controller in hand, with the rest of the team positioned as lookouts. One near the top of the ramp, another keeping eyes on the surrounding area.

Pro tip: Before doing anything like this, it's worth stating the obvious. If you're operating drones in any capacity, especially in environments like this, you need to understand and follow FAA regulations and requirements. That's not optional. Equally important, your equipment needs to be quiet. Loud propellers, startup tones, unnecessary lights, none of that belongs in a covert environment. Subtlety matters.

Once everything was set, I brought the drone up slowly and moved it toward the interior of the garage. The REX sensor was mounted above the lane where vehicles would normally pass as they exited. There was no visible weight sensor or secondary validation, just the motion and heat detection typical of REX sensors.

As I piloted the drone further into the garage, I could see a door slightly ajar leading into a stairwell, and another door off to the side that appeared to connect to an employee gym and spa area. Both presented additional opportunities once access was established.

After gaining a better understanding of the layout, it was time to attempt to trigger the sensor. I gave the team a moment to observe through the feed on their phone, then adjusted position and moved the drone directly into the sensor's field. It didn't take much. The system registered the presence, interpreted it as a vehicle preparing to exit, and within seconds, the mechanism engaged.

The sound of the gate unlocking and beginning to open echoed through the garage. In that moment, everything shifted from tested theory to actual access. It's as satisfying as setting the last pin on a lock you've been trying to pick.

Inside the Facility

Once the gate opened and we entered the garage, the rest unfolded quickly. The stairwell door had been ajar for some time, which told us it wasn't alarmed. That immediately expanded our movement options. If it had been alarmed, the door being propped open would have already triggered a response.

From there, we navigated up to a suite entrance protected by a badge reader and PIN pad tied to an electric strike. On paper, that sounds solid. In practice, the hardware told a different story. The door was equipped with an ADA-compliant lever handle, and there was a sufficient gap between the bottom of the door and the threshold that allowed for an under-the-door tool. With minimal effort, we were able to manipulate the interior handle from the exterior side and gain entry without ever interacting with the reader.

If that hadn't been an option, we still had alternatives. We could have manipulated additional REX sensors leading into other areas or attacked the badge readers directly. Part of our standard scope includes the ability to deploy implants when appropriate. Badge readers, particularly in areas like parking garages, are often more accessible and less monitored. By removing the faceplate and inserting a small skimmer device, such as a BLE or ESP-based implant, you can capture credential data and PINs over time. It then becomes trivial to replay or clone those credentials and return later as a legitimate user. The same concept used in credit card skimming, just applied to physical access control systems. Even if we hadn't gained access through the stairwell, we could have implanted the badge reader and waited. It was only a matter of time.

Once we were inside, it was business as usual, for us anyway. Locked office doors and filing cabinets were picked open. Keyloggers were implanted on systems. Secured areas were accessed and explored. Even shredder bins. We continued to scour through every file, bin, and bag until there was nothing left to look at. Everything that appeared heavily defended from the outside was now accessible through a path that had been largely ignored in the overall security design.

All of it traced back to a single assumption: "No one comes this way."

Baseline Issues

At the end of it all, the weaknesses are rarely complex. The issues we found came down to the following:

  • Gaps in physical barriers that allowed tools and small devices to bypass intended protections
  • An overreliance on improperly configured request-to-exit sensors without additional validation mechanisms
  • A lack of alarm coverage on critical interior doors
  • No routine physical inspections against doors that should remain locked
  • No 24/7 security coverage
  • Accessible badge readers that could be leveraged for credential skimming
  • A parking garage that was treated as secure simply because it looked secure

These techniques are not advanced. They were simply overlooked, the product of in-the-box thinking and checkbox-driven security practices. This is why you hire professional security consulting services, to see the holes that others don't and to find out if they can be exploited.

Conclusion

This engagement reinforced something we see over and over again. The most fortified-looking perimeter in the world doesn't matter if the assumptions behind it are wrong. A heavy steel gate, armed guards, badge readers, and cameras, none of it held up because the security design never accounted for someone willing to approach the problem differently. A hand warmer, a small drone, and some gaffer tape were enough to defeat a system that was built to stop vehicles, not creativity.

The lesson here isn't about drones or REX sensors specifically. It's about the gap between what a security system is designed to handle and what an attacker is actually willing to try. If your defenses only work against the threats you've imagined, they don't work at all.

We've got more coming in Access Logs. The next entry picks up where these stories always do, somewhere we weren't supposed to be.