Physical Exploration

A subject identifies or assesses routes through which they or another person could enter, leave, or move through an organizational facility while reducing the likelihood of challenge or detection.

The subject may observe loading areas, emergency exits, service corridors, shared tenant spaces, stairwells, parking access points, delivery entrances, maintenance routes, or locations with limited physical security coverage. They may also assess whether doors are routinely propped open, whether exit routes permit re-entry, or whether movement between zones can occur without an additional credential check.

The behavior may indicate preparation to bypass normal entry controls, facilitate unauthorized third-party access, remove assets, or move between restricted areas without creating a complete access record.

A subject searches for or identifies physical assets that are unattended, insufficiently secured, or accessible outside normal control processes.

These assets may include laptops, removable media, physical identity tokens, keys, printed records, unlocked cabinets, exposed network ports, backup media, prototype equipment, or devices left in shared or low-occupancy areas. The subject may test whether an asset can be handled, removed, connected to, photographed, or accessed without attracting attention.

This behavior is operationally relevant where it indicates that the subject is identifying opportunities that could later support theft, credential misuse, unauthorized system access, data loss, or physical sabotage.

A subject observes, explores, or informally surveys access routes, entrances, barriers, internal layouts, staffing patterns, and operational routines associated with a restricted physical area.

The subject may seek to identify which doors are badge-controlled, when an area is unattended, how visitors are processed, whether personnel challenge unfamiliar individuals, or where movement is not covered by security personnel or closed-circuit television. The activity may appear innocuous in isolation, but repeated or unexplained observation can indicate preparation for unauthorized entry, theft, sabotage, data access, or another physical infringement.

A subject observes the timing, route, frequency, staffing, or behavior of physical security patrols to identify periods or locations where monitoring is reduced.

The subject may repeatedly remain near patrol routes, note when security personnel enter or leave an area, track shift changes, observe response times, or determine whether patrols follow predictable schedules. They may also identify areas that are checked only intermittently or periods when security personnel are occupied elsewhere.

This behavior can support later unauthorized presence, theft, sabotage, tampering, or access to sensitive areas by allowing the subject to act during a predictable gap in physical oversight.