The FORTRESS Framework: The Modern Standard for Physical Penetration Testing & Adversary Simulation

Enterprises in 2026 allocate millions of dollars to safeguard their digital estates. They procure AI-augmented Extended Detection and Response (XDR), deploy zero-trust network architectures, enforce phishing-resistant FIDO2 hardware keys, and commission continuous Penetration Testing as a Service (PTaaS). Yet, in dozens of red team assessments conducted every year, our operators bypass this entire multi-layered digital fortress in fewer than ten minutes—simply by walking through the front door.

An unencrypted 125kHz RFID badge cloned from a distance in a coffee shop, an exterior latch slipped with a flexible plastic shim, a confident pretext dressed in a courier uniform, or an unauthenticated Ethernet port behind a smart television in a visitor conference room is all an attacker needs to render digital firewalls irrelevant. When an intruder physically connects a covert hardware drop-box into an internal corporate network, all internet-facing perimeter defenses are bypassed entirely.

Historically, physical security testing suffered from a lack of standardization. While digital offensive security matured around rigorous, taxonomy-driven frameworks like MITRE ATT&CK, OWASP ASVS, and NIST SP 800-115, physical penetration tests often devolved into ad-hoc "stunt hacking" or glorified checklist walkthroughs. Reports gave CISOs humorous anecdotes of consultants picking padlocks, but left security directors and compliance auditors without actionable metrics, repeatable validation criteria, or regulatory alignment.

That paradigm shifted decisively with the release of the FORTRESS Framework (fortressframework.com). In this guide, we break down what the FORTRESS Framework is, examine the military and offensive security background of its creator Bradley Ammerman, analyze its 236+ controls and 60+ regulatory crosswalks, dissect the cyber-physical bridge, and illustrate how modern security programs leverage it to harden physical facilities against advanced adversaries.

What is the FORTRESS Framework?

The FORTRESS Framework stands for Framework for Organized RedTeam Threat Response Evaluation for Security and Safeguards. Accessible publicly at fortressframework.com, it represents the offensive security industry's most rigorous, structured, and comprehensive methodology for planning, executing, and measuring physical security assessments.

Just as MITRE ATT&CK standardized the vocabulary and tactical categorization of digital adversary behaviors, FORTRESS establishes a formalized library of physical Tactics, Techniques, and Procedures (TTPs). Rather than treating physical security as an all-or-nothing binary exercise ("Did we get inside or not?"), FORTRESS provides granular, measurable evaluation across every layer of defense:

• Perimeter Barriers & Structural Deterrents: Natural topography, fences, gates, turnstiles, and bollards.
• Mechanical & Architectural Ingress: Lock mechanisms, deadbolts, latch shields, crash bars, and emergency exits.
• Electronic Access Control Systems (EACS): Proximity cards, smart badges, biometric scanners, and controller wiring.
• Surveillance & Anomaly Detection: CCTV coverage, pan-tilt-zoom (PTZ) blind spots, motion sensors, and security operations monitoring.
• Human Factors & Social Engineering: Reception protocol enforcement, vendor verification, challenge culture, and badge etiquette.
• Critical Enclave Compartmentalization: Server rooms, MDF/IDF wiring closets, executive suites, and secure records storage.
• Cyber-Physical Attack Vectors: Hardware implants, keystroke loggers, network taps, and unsegmented wall jacks.
• Technical Surveillance Counter-Measures (TSCM): Eavesdropping devices, covert audio/video bugs, and unauthorized RF emitters.

The Origin: Bradley Ammerman & Military Tactical Rigor

The FORTRESS Framework was developed by Bradley Ammerman, a seasoned offensive security executive, innovator, and US Army combat veteran. Serving as a Combat Medic with the 2nd Infantry Division, Ammerman operated in demanding environments where operational discipline, physical perimeter integrity, standard operating procedures (SOPs), and strict rules of engagement (RoE) were literally matters of life and death.

Transitioning into cybersecurity, physical penetration testing, and red team leadership over nearly two decades—including roles driving offensive innovation and security evangelism at enterprise cybersecurity firms—Ammerman recognized a glaring disconnect in commercial offensive security:

• The "Magic Trick" Fallacy: Physical pentesters often focused on dramatic parlor tricks (e.g., blowing vape smoke into an optical request-to-exit sensor) without documenting whether the door had an alarm, whether security guards received an alert, or how long responders took to arrive.
• The Compliance Void: Enterprise CISOs faced relentless audits from SOC 2, ISO 27001, PCI DSS, and NIST assessors demanding evidence of physical security controls, yet traditional pentest reports provided zero crosswalks to regulatory standards.
• The Cyber Disconnect: Physical security guards reported to Facilities or Real Estate teams, while digital security engineers reported to the CISO, leaving a cavernous blind spot right where the two worlds meet—at the physical network port.

Ammerman created FORTRESS to bridge these operational silos. By combining military-grade tactical discipline with enterprise regulatory rigor, FORTRESS transforms physical pentesting from an unpredictable, boutique exercise into an auditable, quantifiable, and repeatable engineering process.

Architecture: 236+ Physical Controls Mapped to 60+ Frameworks

What sets the FORTRESS Framework apart from all prior physical penetration testing checklists is its extensive database of over 236 granular physical security controls, meticulously cross-mapped to more than 60 major regulatory and industry compliance frameworks.

When an organization undergoes a SOC 2 audit, a PCI DSS QSA evaluation, or a FedRAMP assessment, auditors do not accept vague assertions that "our office is secure." They demand concrete verification of specific physical controls: visitor logging, badge issuance, server room dual-custody access, anti-passback enforcement, and clean desk adherence. FORTRESS correlates each red team test directly to these requirements.

When a vulnerability is uncovered during an assessment conducted under the FORTRESS Framework, the finding is not reported in isolation. It includes the exact FORTRESS Control ID, the affected compliance frameworks, the CVSS / physical severity rating, reproducible photographic and timestamped telemetry, and a targeted Plan of Action and Milestones (POAM) remediation blueprint.

The 7 Core Operational Domains of FORTRESS

The FORTRESS Framework structures adversarial testing and defensive validation across seven core operational domains. Each domain encompasses dedicated attack techniques, instrumentation tools, and defensive verification criteria.

The 6-Phase Lifecycle of a FORTRESS Physical Assessment

To eliminate operational risk and ensure repeatable results, assessments conducted under the FORTRESS Framework follow a disciplined six-phase engagement lifecycle:

Phase 1: Scoping, Threat Modeling & Rules of Engagement (RoE)

Before any physical operator sets foot near a target property, a strict Rules of Engagement document is signed by executive leadership. The RoE defines authorized target locations, off-limit areas (such as childcare facilities, tenant suites not owned by the client, or hazardous mechanical rooms), emergency contact escalation protocols ("White Cell"), and an official "Get Out of Jail Free" authorization letter on corporate letterhead signed by the CISO and General Counsel.

Phase 2: Non-Invasive Reconnaissance & OSINT

Testers gather open-source intelligence (OSINT) and conduct covert physical surveillance. Satellite imagery, municipal building blueprints, social media geotags, and job postings reveal security vendor details, badge models, uniform styles, and shift change schedules. Operators observe physical chokepoints, smoking areas, loading docks, and guard patrol frequencies without making physical contact.

Phase 3: Exterior Ingress & Perimeter Evasion

Adversary simulation commences. Operators attempt ingress using non-destructive, realistic tactics: cloning an employee's RFID badge using a high-gain reader in the parking garage, slipping a spring latch on an unlatched side exit, slipping an under-door tool under an emergency egress door, or executing a delivery pretext at the main reception desk.

Phase 4: Interior Infiltration & Enclave Penetration

Once inside the exterior perimeter, operators navigate internal hallways to reach pre-agreed "crown jewel" destinations. Objectives typically include the primary data center, executive boardrooms, network operations centers (NOC), or financial record storage. Operators evaluate whether internal compartmentalization holds and whether employees challenge unfamiliar individuals without visible badges.

Phase 5: The Cyber-Physical Pivot & Implant Deployment

In mature physical assessments, gaining access to the room is merely the prerequisite. The true business risk is demonstrated by connecting covert hardware to the network:

• Plugging a cellular-enabled drop-box behind an IP phone or network printer.
• Establishing an encrypted out-of-band reverse SSH/WireGuard tunnel back to the attack command-and-control (C2) server.
• Harvesting unencrypted network traffic, poisoning broadcast protocols (LLMNR/mDNS/NBT-NS via Responder), or capturing network credentials.

Phase 6: Quantitative Analysis, POAM Remediation & Retesting

The engagement concludes with a comprehensive debrief. Every physical finding is scored against the FORTRESS control matrix and mapped directly to the client's compliance requirements. Crucially, the process includes a complimentary retest to verify that physical adjustments (e.g., installing latch guards, configuring 802.1X Network Access Control, upgrading to encrypted RFID credentials) have completely eliminated the vulnerability.

The Cyber-Physical Bridge: A Real-World Attack Scenario

To understand why the FORTRESS Framework places such heavy emphasis on the cyber-physical bridge, consider a real-world engagement executed by our offensive security team:

Here is how the attack unfolded on the ground:

1. Reconnaissance (FORTRESS-REC-04): Our operators identified the building's badge system from employee LinkedIn photos showing their lanyards. The company used legacy 125kHz HID Prox cards, which broadcast their raw card identifier in plaintext without encryption.
2. Credential Theft (FORTRESS-EAC-12): While an employee stood in line at a coffee shop 200 feet from the office, an operator carrying a concealed long-range RFID reader brushed past within three feet. The card ID was instantly captured and cloned onto a blank key fob using a Proxmark3.
3. Ingress (FORTRESS-PER-09): Using the cloned key fob, the operator tapped through the perimeter turnstile at 8:45 AM during peak morning influx, blending into the crowd without raising suspicion.
4. Enclave Breach (FORTRESS-ENC-03): The operator walked up to the 4th floor server room. While the door had a badge reader, the latch lacked a protective strike plate. Using a flexible bypass shim, the spring latch was retracted in 12 seconds without triggering a forced-door alarm.
5. The Cyber Pivot (FORTRESS-CYB-01): Inside the server room, the operator plugged a miniaturized Raspberry Pi drop-box into an unmanaged patch panel switch port. The implant established an encrypted cellular 5G reverse tunnel to our external team.
6. Domain Takeover: Because the internal network switch lacked 802.1X port security, the drop-box was immediately assigned a DHCP address on the internal corporate management VLAN. Within 45 minutes, our remote operators executed Active Directory Kerberoasting attacks, dumped local administrator password hashes, and compromised the root Domain Controller.

The organization's multi-million dollar cloud firewalls and endpoint monitoring software never logged a single suspicious external connection. The breach was 100% physical—and 100% fatal to their network security posture.

How Blue Teams & Facilities Use FORTRESS to Defend

While FORTRESS is designed for red teams, its greatest beneficiaries are blue teams, CISOs, and corporate facilities directors. For years, physical security teams have struggled to justify capital expenditures for physical upgrades because they lacked a quantitative framework to demonstrate risk to the board.

FORTRESS empowers defenders in three distinct ways:

• Defensible Budget Justification: Demonstrating that legacy 125kHz proximity cards violate specific NIST PE-3 and PCI DSS 9.1 controls provides the exact regulatory leverage needed to secure budget for modern MIFARE DESFire EV3 or mobile PKI credential migrations.
• Eliminating False Senses of Security: Knowing that a door is locked is meaningless if the Request-to-Exit sensor can be triggered by compressed air sprayed through the door seam. FORTRESS identifies the specific engineering countermeasures needed (such as REX sensor baffles, full-length astragal latch plates, and door-closer re-calibration).
• Unified IT and Facilities Governance: FORTRESS forces IT security and physical facilities teams to sit at the same table. Facilities learns why network wall jacks must have 802.1X authentication, and IT learns why server room HVAC vents require security grilles.

Lorikeet Security: FORTRESS-Aligned Physical Pentesting

At Lorikeet Security, we conduct physical penetration testing and adversary simulations aligned strictly with the FORTRESS Framework. While our autonomous AI engine Lory pentests digital web applications, APIs, and network perimeters around the clock, physical penetration testing is the one service we reserve exclusively for seasoned, certified human offensive security researchers.

Every physical engagement conducted by Lorikeet Security delivers:

• 100% Human-Led Tactical Execution: Led by certified offensive practitioners (OSCP, GPEN, military veterans) operating under formal, legally vetted Rules of Engagement.
• FORTRESS Control Mapping: Every gap is correlated against the 236+ controls of the FORTRESS Framework, accompanied by timestamped photographic evidence and telemetry logs.
• Auditor-Ready Compliance Packages: Deliverables include signed attestation letters and crosswalk tables ready for immediate submission to SOC 2, ISO 27001, PCI DSS, and HIPAA auditors.
• Real-Time Talon Portal Integration: Discovered physical exposures and breach milestones stream directly to your secure Talon dashboard in real time, so your defenders can track the attack chain as it happens.
• Complimentary Retest Guarantee: After your facilities and IT teams implement the recommended physical and network safeguards, our operators re-evaluate the controls at zero additional cost to confirm full remediation.

To learn more about our specific physical testing capabilities, explore our Physical Penetration Testing Services or review our comprehensive methodology on our Security Testing Methodology page.

Lorikeet Security Team

Penetration Testing & Cybersecurity Consulting

Lorikeet Security helps modern engineering teams ship safer software. Our work spans web applications, APIs, cloud infrastructure, and AI-generated codebases — and everything we publish here comes from patterns we see in real client engagements.

Practical security, written by practitioners.