Physical Penetration Testing: Why Your Building Might Not Be as Secure as You Think
Physical security relies on more than systems. Physical penetration testing reveals real-world gaps between design and day-to-day practice before they become risks.
Physical Security
Getting ahead of retail crime with behavioural detection intervention training
Learn how behavioural detection training helps retail teams spot risk earlier, prevent theft before it happens, and create a safer environment for staff and customers.
7 reasons physical security training is no longer optional
Physical security training shouldn’t be reactive – done early, it helps people spot and act on small risks before they escalate.
Phone theft epidemic advice
In this piece, Gavin Wilson, tackles London’s growing phone theft epidemic with a simple message: treat your mobile like cash.
With more than 80,000 phones reported stolen in London in 2024, Wilson explains how distraction, visibility and routine behaviour are fuelling opportunistic crime. From e-bike snatches to crowded street pickpocketing, thieves are targeting unlocked devices that hold far more than just resale value, often giving criminals access to banking apps, emails and personal data.
His advice focuses on practical habit changes. Keep devices out of sight, use secure pockets, activate biometric locks and remote wipe features, and avoid using your phone openly in high-risk areas. Small behavioural shifts, he argues, can make you a far less attractive target and significantly reduce the risk of becoming the next statistic.
Your building in a day
In this interview, Gavin Wilson, Director of Physical Security and Risk at Toro Solutions, asks a straightforward question: do you really know who was in your building today?
He looks at how hybrid working, shared offices and the rise in third-party access have made traditional, trust-based security far less reliable. Physical access is no longer just a facilities issue, it is part of your wider risk exposure.
Drawing on Toro’s experience inside client environments, Gavin explains why controls often exist but do not connect and why visibility, confident challenge and joined-up thinking make the real difference when something goes wrong.
It’s 2026. Why are the basics still being missed?
In this latest article, Toro Solutions’ Directors of Cyber Security and Physical Security & Risk ask a simple but uncomfortable question: it’s 2026, so why are the basics still being missed?
Reflecting on high-profile failures, including the widely reported security lapse at the Louvre, they explore how weak passwords, inconsistent MFA, unmanaged access and overlooked physical controls continue to sit at the heart of major incidents. While organisations focus on AI, geopolitics and evolving threat actors, foundational disciplines such as access management, patching and third-party oversight are too often deferred, normalised or quietly accepted.
The piece argues that most breaches are not the result of unknown risks, but of known controls that were never fully enforced or revisited and that real progress in 2026 will depend less on chasing the next big threat and more on consistently getting the fundamentals right.
People not plans
In this recent press piece, Toro Solutions’ Directors of Cyber Security and Physical Security and Risk discuss why resilience is about people, not paperwork.
They argue that most organisations don’t fall short because they lack plans, but because their teams operate in silos. When cyber, physical and operational functions fail to share context early, warning signs are missed and response slows down. Convergence, they explain, isn’t about restructuring it’s about getting the right people talking before small issues turn into bigger problems.
Because when pressure hits, it’s not the plan that makes the difference, it’s how well your teams work together.
How many people move through your building in a single day
Most organisations can’t say who was in their building today. Discover the security risks behind “almost belongs” behaviour and how to spot issues earlier.
Physical security training that actually changes behaviour
At Toro, physical security training is about behaviour, not just rules. We teach people how real incidents start, how attackers exploit politeness and routine, and how small actions by ordinary staff prevent serious harm.
What should you do to stay secure when working from home?
Without a security-conscious approach, remote working can unintentionally expose organisations to cyber, physical and information security risks.
How to train staff to challenge suspicious behaviour without creating conflict
Most physical security incidents do not start with someone forcing a door or smashing a window. They begin with someone walking into a space where they do not belong and no one feeling comfortable enough to say anything. In busy offices, hospitals, warehouses, data centres and shared buildings, people are taught to be helpful, polite
It’s 2026. Why are the basics still being missed?
The biggest cyber risks in 2026 aren’t new technologies – they’re old controls that were never enforced, reviewed or removed.