▧
Sensitive networksAccess cannot or should not be exposed remotely.
On-site engagements
Physical presence should increase control, not ambiguity.
When location, facility access, production context, hardware, supervision, or data residency materially changes the work, Black Bag can deliver on-site under explicit safety and evidence controls.
Controlled physical delivery
▣
ScopeSystems · locations · windows · no-go areas○
SupervisionEscort · access · local authority◎
ExecuteBounded testing · safety controls◇
EvidencePermitted capture · secure handling!
EscalateImpact · finding · stop condition · reportOn-site access adds operational context without weakening control.
When on-site adds value
Use physical presence when the environment changes the answer.
Travel is not the service. On-site delivery is justified when local access, hardware, network position, supervision, operating windows, or legal constraints materially affect the technical work.
Where location changes the engagement
▦
Hardware & appliancesThe physical system is part of the attack surface.
○
Supervised testingClient oversight is part of the safety model.
⌖
Residency & handlingEvidence must remain inside an approved geography or environment.
Safety model
Know who can act, what can be touched, and when the work stops.
On-site execution is governed by the same institutional standard as remote work, with additional facility, supervision, and production-safety controls made explicit before testing begins.
Access and safety controls
▣
AuthorityApproved targets, facilities, test windows, access methods, and prohibited systems.
○
SupervisionClient escort, technical point of contact, governance authority, and escalation ownership.
!
Stop conditionsOperational impact, unexpected behavior, safety threshold, or scope ambiguity pauses activity.
↻
RecoveryKnown rollback, restoration, and communication paths for work near sensitive operations.
Bounded work remains bounded even when the environment is complex.
Evidence and communication
Capture what proves the result. Protect everything else.
Physical access can expose more sensitive context than a remote engagement. Evidence collection therefore stays purpose-limited and client-approved.
Three control surfaces
◇
Evidence handlingCollect the minimum required to support material conclusions.
↗
CommunicationKeep technical and governance owners aligned.
⌖
Cross-border constraintsOperate to approved requirements, not assumptions.
Plan the physical boundary before travel
Tell us why location matters, what access is required, and what operational constraints must be protected.
We will determine whether on-site delivery materially improves the engagement and define the safety model before arrival.
Plan before arrival
⌖
LocationWhy physical presence matters.▣
AccessWhat must be reached.○
SupervisionWho controls local authority.!
SafetyWhat cannot be disrupted.◇
EvidenceWhat may be captured and where.