Proximity Threat Management: A Complete Framework for Physical Attack Surface Security

Every enterprise invests heavily in digital perimeter defence: firewalls, endpoint detection, zero-trust network architectures. Yet the most consequential security breaches often begin not with a packet traversing a wire, but with a human being standing in the wrong place at the wrong time. A contractor photographs a whiteboard in an unlocked meeting room. A cleaning operative discovers a master keycard in a desk drawer. A state-sponsored operative aims a laser interferometer at a boardroom window during a merger discussion. These are proximity threats, and no firewall in existence can stop them.

Proximity Threat Management (PASM) is the discipline SAPP Security co-founder Marko Tuisk developed to close this critical gap. PASM is the practice of identifying, classifying, and neutralising threats that exploit physical closeness to an organisation's people, assets, and technical infrastructure. It sits at the intersection of physical security, counterintelligence, insider threat management, and technical surveillance countermeasures (TSCM), bringing together disciplines that have historically operated in disconnected silos.

Where cybersecurity protects the digital attack surface, PASM protects the physical attack surface: the buildings, rooms, devices, documents, and human behaviours that surround sensitive information before it ever reaches a network. This page is a complete guide to the proximity threat landscape, the three-tier attack taxonomy, and the operational framework for implementing PASM across your organisation.

Tier 1

Tier 1: Behavioural and Asset Oversight, The Critical First Line

Tier 1 threats are the most common and the most frequently underestimated. They require no technical sophistication from the attacker, only physical presence and opportunity. These are threats born from human behaviour: lapses in protocol, failures of habit, and the casual assumption that “nobody would do that here.” In our experience conducting proximity audits across financial services, legal, and technology organisations, Tier 1 vulnerabilities are present in over 90% of sites assessed on the initial visit.

Physical Credential Dispersal

The Observation: Master keycards, building access fobs, server room keys, and safe combinations stored insecurely. Left in unlocked desk drawers, pinned to noticeboards, or shared informally between team members. During one assessment of a Tier 1 financial institution, our team identified a master building access card stored in an unlocked kitchen drawer, accessible to every employee, contractor, and visitor on the floor.

Risk Classification: Critical. Physical credential dispersal creates cascading access failures. A single compromised master credential can grant unrestricted access to server rooms, executive offices, and secure document storage, bypassing every digital access control in the building.

Remediation Approach: Implement tiered credential hierarchies with individual accountability. Replace shared physical credentials with individually assigned access tokens tied to identity management systems. Deploy tamper-evident storage for emergency-access credentials with dual-person integrity controls. Integrate physical credential auditing into the continuous PASM monitoring cycle.

Hard-Copy Ledger Exposure

The Observation: Confidential documents, printed reports, strategy presentations, and financial models left on desks overnight, stacked in open printer trays, or displayed on whiteboards after meetings. Despite the digital transformation narrative, hard-copy documents remain a primary exfiltration vector in proximity attacks. An attacker needs nothing more than a smartphone camera and thirty seconds of unsupervised access to capture pages of sensitive material.

Risk Classification: High. Hard-copy exposure bypasses every form of digital data loss prevention (DLP). The The information never traverses a network, never triggers an alert, and never appears in an audit log. From a forensic perspective, the breach is invisible.

Remediation Approach: Enforce clean-desk (clear desk) policies with automated compliance verification. Not annual reminders, but weekly or daily spot-checks scored through the SAPP platform. Deploy secure print-release systems requiring badge authentication at the device. Implement document classification marking and destruction schedules. Whiteboards in sensitive areas should be equipped with privacy screens or housed in rooms with automatic locking.

Orphaned Transit Media Vulnerability

The Observation: Printed documents, USB drives, and portable storage devices carried between locations in unsecured briefcases, backpacks, or vehicle boots. Transit media represents the period when sensitive material is most vulnerable. It has left the controlled environment but has not yet reached its destination. Laptops left in hotel rooms, document bundles carried through public spaces, and USB drives in jacket pockets all constitute orphaned transit media.

Risk Classification:High. Transit media is inherently difficult to control because it exists outside the physical security perimeter. Loss or theft during transit may not be discovered for hours or days, extending the adversary's exploitation window.

Remediation Approach: Establish chain-of-custody protocols for all physical media leaving secure areas. Deploy tamper-evident document pouches and GPS-tracked transit containers for high-value materials. Implement mandatory hardware encryption for all removable storage devices. Train personnel in transit security awareness with specific scenario exercises: hotel room searches, public transport protocols, and vehicle security procedures.

Tier 3

Tier 3: Advanced Espionage and State-Actor Threat Vectors

Tier 3 represents the apex of the proximity threat taxonomy: sophisticated, intelligence-grade attacks that exploit physics, electronics, and tradecraft to extract information from ostensibly secure environments. These vectors are associated with state-sponsored actors, organised corporate espionage operations, and advanced persistent threats (APTs) operating in the physical domain. Detection requires specialised equipment, trained operatives, and methodologies drawn from national-security-grade counterintelligence programmes.

Proximity Side-Channel Exploitation

Side-channel attacks exploit unintentional information leakage from physical systems. In the proximity context, these include:

• Acoustic laser interferometry: a laser beam directed at a window pane detects micro-vibrations caused by speech within the room, enabling reconstruction of conversations from outside the building with no physical intrusion required.
• Power-line audio injection: audio signals coupled onto building electrical wiring can be received by equipment connected to the same circuit, or conversely, audio can be extracted from power-line noise generated by equipment in the room.
• Passive electronic surveillance devices: miniaturised bugs, GSM transmitters, Wi-Fi-enabled cameras, and devices disguised as everyday office equipment (power strips, USB chargers, smoke detectors). Modern implants can be as small as a grain of rice and operate for months on internal batteries or parasitic power drawn from nearby electronics.
• Electromagnetic emanations (TEMPEST): electronic equipment emits electromagnetic radiation that can be intercepted and decoded to reconstruct displayed images, keystrokes, or processed data. TEMPEST attacks have been demonstrated against CRT and LCD monitors, keyboards, and even CPU operations from distances of tens of metres.

SAPP Security's TSCM methodology addresses Tier 3 threats through a combination of physical inspections, radio-frequency (RF) spectrum analysis, non-linear junction detection (NLJD), thermal imaging, and acoustic noise generation. Our operatives are trained to the standards referenced in ICD 705 (Intelligence Community Directive for physical security of Sensitive Compartmented Information Facilities) and employ equipment calibrated to detect emissions below the threshold of commercial-grade RF scanners.

For organisations requiring the highest level of protection, such as boardrooms used for M&A discussions, government SCIFs, and diplomatic facilities, SAPP Security delivers full TSCM sweeps combined with ongoing environmental monitoring, ensuring that the secure space stays clean between scheduled inspections.