Physical penetration tester and infosec consultant on how she uses social engineering to gain access into high security facilities
and gets paid to do it http://motherboard.vice.com/ ... http://twitter.com/...
Context & Ripple Effects
This profile sits in a lineage Motherboard and its peers have been building around the human layer of security: the 1980s hacker Susan Headley built her reputation on social engineering long before it was a billable service, and the [[a:951155|analyst who planted malicious USB drives in a state correctional facility with fake credentials]] showed how little hardware is needed once a person is fooled. What has changed is that the trick is now a profession — a consultant paid by facilities to attempt exactly those breaches.
First-order effects
- Clients paying for these engagements get a direct readout of which physical controls failed — badges, tailgating, front-desk protocol — rather than an assumption about them.
Second-order effects
- Facilities that fail such tests face pressure to spend on human-layer defenses (training, visitor verification) alongside technical ones, shifting red-team budgets toward people-centric testing.
Third-order effects
- If paid physical/social engineering becomes standard practice, the industry's benchmark for 'secure' moves from perimeter technology to demonstrated resistance against deception — institutionalizing what Headley-era hackers did informally.
The trend: Security testing is professionalizing the oldest attack vector — human trust — turning social engineering from an underground skill into a contracted audit layer.