A locked door looks secure — usually only because the person in front of it does not know how it opens without a key. In physical security testing, lock picking is not a hobbyist's party trick; it is the fastest route to the decisive question: how much effort does an unauthorised person need to gain unnoticed access?
Most locks deployed in building security are pin tumbler cylinders. Their mechanics are well understood and their tolerances are manageable. With a simple pick and a tension wrench, an experienced tester opens standard cylinders within seconds to minutes — non-destructive, quiet, and without waking up the alarm chain.
Classic picking is only one option: bump keys open many standard cylinders in a handful of attempts, impressioning produces a working key without ever having a template, and modern methods from bypassing to automated picking cover the more demanding cylinders. Every lock carries a concrete cost of attack — one simply has to know it.
In a professional test, the result is never simply "open" or "closed". What counts is time, noise and the traces the attacker leaves behind. A standard cylinder is silently picked in thirty seconds. A high-security cylinder with active elements and anti-bump design forces the attacker into minutes, special tools or destructive methods. This is where certification classes such as DIN EN 1303 or VdS ratings prove their value — not on paper, but in the tester's hands.
Inside the cylinder
Six components decide between open and locked. First: the housing (1) — anchored in the door leaf, immovable. Second: the plug (2) — the only part that turns, and the part that retracts the latch. Third: the key pins (3) in its bores, their ends feeling the bitting of the key through the keyway. Fourth: the driver pins (4), driven down by springs from the housing onto the key pins. Fifth: the shear line (5) between the two parts — if even one driver pin protrudes across it into the plug, the plug stays locked. Sixth: the tension wrench (6), whose minimal torque is precisely what makes that lock-up perceivable. Without a key, every driver pin stands across the shear line in the plug; the correct key lifts each key pin until the gap between key pin and driver pin sits exactly on the shear line — and the plug runs free.
Why picking works at all comes down to manufacturing: no cylinder has its pin bores perfectly aligned, and no tolerance is zero. When the tension wrench rotates the plug by a fraction of a degree, it skews in the housing — and exactly one pin stack takes the measurable friction. That skew transfers into the tool as palpable resistance. The hook lifts that one pin until its driver pin crosses the shear line; the plug advances silently by a click, and the next stack takes over. The order in which the pins bind is arbitrary — it cannot be read from the key, and it changes as the lock opens. The picker feels through it one pin at a time.
This is precisely where the countermeasures start. Spool- or mushroom-shaped security pins drop back behind the shear line while being lifted and fake a set pin — a false set that stalls the inexperienced attacker while the plug stays locked. Paracentric keyways narrow the channel so far that the hook barely reaches the rear pin stacks. And systems with multiple locking elements demand that many pins stand correctly at the same time, instead of being worked through one by one. The mechanism has been understood for 150 years — all that remains is the question of effort a rating demands from the attacker.
What a lock is worth
Certifications such as VdS, SKG and DIN EN 1303 measure exactly one thing: resistance time against defined attacks. In an assessment this reduces to a single calculation — picking time against detection window. The practical mapping:
| Equipment | Picking effort | Attacker falls back to | Appropriate for |
|---|---|---|---|
| Standard profile cylinder | seconds | — | Warehouses, secondary doors |
| Security pins, paracentric keyway | minutes | Bump key, tools | Office areas |
| Anti-pick and anti-bump with pull protection (VdS "Z+") | over five minutes | Drilling, core pulling | Server rooms, risk areas |
| SKG ***, hardened hardware | at least five minutes, heavy tools | Door, hinges, glazing | Building envelope, risk rooms |
| Electronic access with mechanical fallback | no pick — new attack surface | Tailgating, badge cloning, key misuse | Protected zones |
A rating is no promise of unpickability — it buys time. The attacker answers with bumping, a drill or a core extractor, or simply with the next door. The rating covers the cylinder, not the building: hinges, frames, strike plates and glazing remain unclassified.
The second calculation is paid for by the organisation: insurers and auditors recognise certifications as evidence, documented protection reaches into the insurance premium and maps cleanly onto ISO 27001 and PCI DSS. Match the class to the room, not to the budget — warehouse, office, server room.
How the attack unfolds
- Observation: when are which doors used, where do which keys live, who carries which master key.
- Choice of method: pick, bump key or bypass — decided by cylinder class, time window and ambient noise.
- Attack during operations: loading bay, lunch hour, door propped open. A setting plug disappears in the daily noise.
- Re-locking: door shut, plug locked — the building reports "all is well".
- Movement: the attacker has time. Only a camera, an alarm or the guard's round still stands between them and the target.
In practice, the strongest cylinder does not compensate for weak organisation: keys get lost, quietly copied or taken from the key cabinet. Master key systems widen the attack surface, because every additional key increases the chance of loss. A lock picking test therefore always examines key management, access rules and response as well — the mechanism is just one layer among many.
For Breachvolt, a picked cylinder is not a verdict but an indicator. It shows where the mechanical, organisational and technical layers of protection fail to interlock — and how much time an intruder is given between the door and the critical assets.
Lock picking in a physical security test simulates neither the locksmith nor the opportunistic burglar. It simulates the quiet, deliberate intruder who spends thirty seconds and is already inside.
