Why hardware changes the pentest threat model

Why this matters

Software pentesting assumes the attacker stays on the network side of the perimeter. Hardware pentesting drops that assumption — once the attacker has physical access (or proximity), the entire defensive stack reshapes. A $35 Raspberry Pi in a ceiling tile sees the inside of the corporate VLAN. A Flipper Zero in a pocket clones a badge in three seconds. A USB cable in a charging port becomes a keyboard. The hardware track is what separates a competent web pentester from a red-team operator.

Demo

Same building, two attackers. A spends six weeks phishing. B walks in behind a delivery driver, drops a Pi Zero W into a printer's surge strip, and is on the internal network in 45 seconds. Both succeed; B is on a different cost curve.

Try it yourself

1. List 5 physical entry points in a building you work in (delivery dock, smoking area, server room rear, conference Ethernet ports, reception). Note the security control at each.
2. Read one DEF CON Physical Security Village writeup (badge cloning, lock bypass, tailgating). Note the hardware that enabled the tradecraft.
3. Map MITRE ATT&CK T1200 (Hardware Additions) and T1091 (Removable Media) to a device you'll learn in this course.

Prompt your AI

Use these three in order. Each builds on the one before.

1. Basics & terminology

In one paragraph, explain why hardware-enabled attacks bypass software defences entirely.

2. Why it works (the mechanism)

Walk me through how a Pi drop box on the internal network changes detection requirements.

3. Advanced — application & what's next

For a building you've never visited, design a 30-minute hardware-recon plan for an authorised red-team engagement.

References

• MITRE ATT&CK — Hardware Additions (T1200)
• DEF CON Physical Security Village