I didn't steal the paintings... but I reckon I could have

I should say from the outset that I am a huge art fan. The Impressionists in particular. So when I tell you that a Renoir, a Cézanne and a Matisse were stolen from a private museum in Italy last month, I mean it when I say it hurt a little, and don't get me started on the jewels at the Louvre.

On the night of 22 March 2026, four hooded thieves broke into the Magnani-Rocca Foundation, a beautiful villa set in the countryside outside Parma. They forced their way through the front door. An alarm went off. They ignored it, pulled three paintings from the walls, and walked out. Worth around €9 million between them. Gone. In three minutes.1

This came five months after the Louvre heist, where a group of thieves dressed as construction workers entered the Galerie d'Apollon during normal opening hours, used a mechanical ladder mounted on a truck to reach the display cases, and left with eight pieces of the French Crown Jewels. Value: approximately €88 million. Time taken: eight minutes.2

Two of the most audacious thefts in recent European history (ok ok I’m not including the KitKat heist in that statement). Both over before most people have finished their morning coffee. Both in buildings that had security in place.

The alarm at Magnani-Rocca was going off. You can hear it in the surveillance footage, sounding in the background as the thieves carry the paintings calmly across the gardens.3

That detail is worth sitting with. The alarm didn’t fail technically, it worked exactly as it was supposed to. What failed was the assumption that an alarm would be enough to stop someone who had already decided to come in anyway.

Now. I want to be very clear that I did not steal the paintings. I have a moral compass, it works perfectly, and I am not writing this from a cell in Parma (I promise). But I’d be lying if I said I hadn’t read about both heists with a certain professional curiosity.

Sometimes I'm hired to do something not entirely dissimilar. Legally, and with the full knowledge of the client, but with the same objective. Find the way in. Get further than you should. Report back.

It’s called physical penetration testing, and I’ve carried out a lot of them. I’m booked in for plenty more.

The method couldn’t be more different from what happened in Parma or Paris. I don’t always force doors. Alarms don’t always go off. There’s no crowbar involved and certainly no running across Italian gardens with a Renoir under my arm, as tempting as that sounds. What I use is conversation, behaviour, and a significant amount of preparation beforehand. Because the preparation is where this kind of work is actually won or lost.

Before I go anywhere near a building, there's a process. I won't go into the specifics, trade secrets and all that, but the short version is this: by the time I walk through the front door, I already know a great deal about what I'm walking into. The execution on the day mostly looks effortless, because the groundwork that makes it possible happens long before anyone sees me.

What the museum thieves and I have in common isn't the method. It's that neither of us turned up and winged it.

Last week I was asked to test two buildings in central London. The brief was the same as always, attempt to gain unauthorised access, identify the vulnerabilities, report back.

The client was quietly confident about the first one. Good access control, trained staff, a proper setup. They were almost apologetic about it, like they didn’t want to waste my time.

I talked my way past reception and security, they even gave me a lanyard and badge, so I could swipe myself into restricted areas floors, offices, spaces that required credentials I didn’t have. No alarms. No confrontation. Just a conversation that went the way I needed it to.

The second building was easier. I walked straight in. Yikes.

I want to be careful here, because these were real clients and real buildings, and the point isn’t to embarrass anyone. The people working in those buildings were doing their jobs. They weren’t negligent. They were, quite reasonably, inclined to trust someone who presented themselves with confidence and seemed to belong there. That inclination and that very human instinct, is exactly what a physical penetration test is designed to find and address.

After the Louvre was hit, experts were quick to call it a wake-up call, particularly for smaller institutions with valuable collections and older security infrastructure. Christopher Marinello, CEO of Art Recovery International, put it plainly:

“The Louvre theft was supposed to be a wake-up call to museums everywhere, especially small museums.”4

Magnani-Rocca happened five months later.

I see this pattern constantly, at every scale. Security gets put in place in response to the last threat, not the next one. The system was designed for a world that’s moved on, so the gap between what the security is supposed to do and what it would actually do under pressure quietly widens.

The uncomfortable truth is that most security looks fine until someone who’s done their homework walks up to it with a plan.

Three questions worth sitting with - whether you’re running a building, a business, or just thinking about your own home:

1. When was the last time someone actually tested your security — not checked it, but genuinely attempted to get through it?

2. Is your security designed for the threat that came before, or the one that might come next?

3. If someone walked in looking like they belonged, would anyone stop them?

The Magnani-Rocca Foundation is still open. At the time of publishing this, the thieves haven’t been caught. The paintings are gone. A Renoir is missing from a wall it had hung on for decades. That bothers me more than I’d like to admit.

Safety and Security. From someone hired to protect.

Share Black Widow Security