ITM is an open framework - Submit your contributions now.

Insider Threat Matrix™Insider Threat Matrix™
  • ID: PR027.003
  • Created: 07th May 2025
  • Updated: 07th May 2025
  • Contributor: The ITM Team

Physical Impersonation Through Dress, Uniforms, or Appearance

The subject deliberately alters their physical appearance to resemble an authorized individual or category of personnel—such as employees, contractors, vendors, maintenance staff, or delivery personnel—in order to bypass physical security measures and gain access to restricted areas. This tactic relies on exploiting visual trust cues (e.g., uniforms, badges, company branding) and is often used during reconnaissance or access staging phases prior to an insider event.

 

Common methods include:

  • Wearing uniforms or branded clothing associated with the target organization or a trusted third party.
  • Mimicking attire patterns of specific departments (e.g., IT, facilities, catering).
  • Carrying props such as tools, ID lanyards, or delivery equipment to reinforce the impersonated role.

 

Example Scenarios:

  • A subject dresses in a facilities maintenance uniform to gain access to server rooms under the pretense of conducting HVAC repairs, with no scheduled work order.
  • An insider recruits an accomplice who dresses as a delivery driver to stage equipment drops and tailgate into a secure loading dock.
  • During an internal staff shift, the subject wears a borrowed lanyard and IT polo shirt to move through restricted floors without being challenged.
  • A former contractor retains high-visibility branded clothing and uses it months later to re-enter a secure building undetected.