Systems and data
Cyber-physical security tester
Trying to break into things that move or matter — building systems, vehicles, clinical devices, plant — before someone else does.
Written by Nivaan, founder of OffLadder · Last reviewed
Test it this week
Audit one connected thing in your own home: find out what it talks to, whether it has a default password, and whether it still gets updates. Write down what you would fix first.
What the work actually contains
- Mapping what a facility or device is actually connected to, which is rarely what the drawing says
- Testing the boring routes in: default passwords, forgotten remote access, a maintenance laptop
- Writing up findings so an operations manager can act on them without a security background
- Retesting after the fix, which is where half the real findings appear
Why it is appearing now
Buildings, clinics, farms and factories have been connected quickly, often on top of equipment designed before anyone imagined it being on a network.
What AI changes about it
Both sides get faster tooling. What stays human is physical access, improvisation, and persuading an organisation to change a habit.
The human abilities it leans on
- Curiosity that keeps going past the first locked door
- Careful, honest reporting
- Practical comfort around equipment
What it can grow out of
- IT support, electrical and maintenance trades
- Building management and facilities
- Anyone who has ever taken apart something they did not own
What nobody knows yet
How much of the routine testing becomes automated scanning.
Guides worth reading