Tailgating and Piggybacking

What Is Tailgating?

Tailgating is the act of following an authorized person through a secured door or entry point without presenting valid credentials. The authorized person badges in, the door opens, and the unauthorized person walks through behind them before the door closes.

It is one of the oldest and simplest physical security attacks. It requires no tools, no technical knowledge, and no preparation beyond looking like you belong. And it works with alarming consistency - physical security assessments routinely find that tailgating succeeds on the first attempt at the majority of tested facilities.

Tailgating bypasses every technical security control at the door - the access control reader, the credential, the controller, the management software, and the audit trail. When someone tailgates through a door, the access control system logs only the authorized person's credential. The unauthorized person leaves no trace in the system.

This makes tailgating particularly dangerous because it is both easy to execute and difficult to detect after the fact. There is no failed access attempt in the logs. There is no alarm. The only evidence might be on security camera footage - if cameras are present, recording, and being reviewed.

Tailgating vs Piggybacking

graph TD
    subgraph Tailgating["Tailgating"]
        T1["Authorized person\nbadges in"] --> T2["Door opens"]
        T2 --> T3["Unauthorized person\nfollows through"]
        T3 --> T4["Authorized person is\nUNAWARE of follower"]
        T_Note["Covert - the authorized\nperson does not know"]
    end
    subgraph Piggybacking["Piggybacking"]
        P1["Authorized person\nbadges in"] --> P2["Door opens"]
        P2 --> P3["Unauthorized person\nfollows through"]
        P3 --> P4["Authorized person\nKNOWINGLY holds door"]
        P_Note["Consensual - the authorized\nperson cooperates"]
    end
    subgraph Key_Difference["The Critical Difference"]
        KD1["Tailgating = stealth\nPiggybacking = social engineering"]
        KD2["Tailgating targets the gap\nPiggybacking targets the person"]
        KD3["Different countermeasures\nneeded for each"]
    end

The critical distinction between tailgating and piggybacking - awareness of the authorized person

These two terms are often used interchangeably, but they describe different situations with different implications:

Tailgating: The unauthorized person follows through without the authorized person's knowledge. They time their approach to slip through behind the authorized person before the door closes. The authorized person does not realize someone followed them in. This is a stealth-based attack.

Piggybacking: The authorized person knowingly allows the unauthorized person through. This might be because the unauthorized person asked ("I forgot my badge - can you hold the door?"), because they are carrying items that make badging difficult ("Can you get that? My hands are full."), or simply because the authorized person is being polite and holds the door for the person behind them. This is a social engineering-based attack.

The distinction matters for countermeasures. Tailgating can be prevented with physical barriers (turnstiles, mantraps) that allow only one person through per credential. Piggybacking requires changing human behavior - training employees to not hold doors, which conflicts with deeply ingrained social norms of politeness.

Why It Works: The Psychology

Tailgating and piggybacking exploit fundamental human social behaviors:

Courtesy and politeness: Holding a door for someone behind you is a basic social norm in most cultures. Deliberately closing a door in someone's face feels rude, aggressive, and confrontational. Most people will hold the door rather than risk an uncomfortable social interaction.

Authority and conformity: If the attacker looks like they belong - wearing appropriate attire, carrying a laptop bag, walking with confidence - people assume they are authorized. Challenging someone who looks like a colleague feels presumptuous.

Diffusion of responsibility: In busy entrances with many people flowing through, individuals assume someone else has verified the person behind them, or that security is handling it. Nobody feels personally responsible for the door.

Conflict avoidance: Most people strongly prefer to avoid confrontation. Asking "Can I see your badge?" to a stranger feels confrontational. The perceived social cost of challenging someone usually exceeds the perceived security benefit, especially when the person looks harmless.

Helping behavior: When someone asks for help ("My badge stopped working, can you let me in?"), most people's instinct is to help. Refusing feels mean-spirited, especially if the request seems reasonable.

These psychological factors make piggybacking one of the most reliable social engineering techniques. In penetration testing, a confident approach with a reasonable pretext succeeds far more often than it fails.

Common Scenarios

Tailgating and piggybacking happen in predictable patterns:

The Morning Rush

The highest-risk period is the morning arrival rush. Employees stream through the entrance between 8:00 and 9:30, often in groups. Doors are held open continuously. In many buildings, security guards are overwhelmed by volume and cannot verify every person. Slipping into this flow unnoticed is straightforward.

The Smoking Area

Smoking areas adjacent to secured entrances are a classic vulnerability. Employees prop doors open to maintain access while smoking. When they go back in, anyone standing nearby can follow. The informal, social nature of smoking areas also makes it easy to start a conversation and be "invited" back inside.

The Loading Dock

Loading docks and service entrances are frequently less secured than main entrances. They may be propped open during deliveries, monitored intermittently, or accessible without the same credential requirements as the main entrance. An attacker in work clothes approaching a loading dock during business hours is rarely questioned.

The Lunch Return

Similar to the morning rush, the post-lunch return creates a wave of employees entering the building. Groups returning from lunch together naturally hold doors for each other, and an outsider can join the flow.

The Delivery Pretext

Carrying a box, a bag of food, or a stack of documents makes piggybacking almost automatic. People instinctively hold doors for someone whose hands are full. "Can you get the door? Thank you so much" is all it takes. The delivered item also provides a reason for being there - "I have a delivery for [department on the directory]."

The Shared Elevator

In buildings where floor access requires a badge scan in the elevator, an attacker simply waits for someone to select the desired floor. In many elevators, once a floor is selected by one person, others can exit on that floor without scanning.

Measuring the Risk

How significant is the tailgating risk? Physical security assessments consistently demonstrate:

Success rates are high: In authorized penetration tests, tailgating attempts succeed 60-90% of the time on the first attempt. The rate varies by organization, culture, and time of day, but the overall picture is clear - most facilities are vulnerable.

Challenge rates are low: Employees rarely challenge someone following them through a door. Studies and penetration test reports suggest that fewer than 10-20% of employees will challenge an unfamiliar person or refuse to hold a door.

Awareness decay: Even after security awareness training, challenge rates decrease over time as the training effect fades and social norms reassert themselves. Sustaining a culture of security requires ongoing reinforcement, not one-time training.

The combination of high success rates, low challenge rates, and an absence of technical detection makes tailgating one of the most reliable initial access methods for physical attackers.

Technical Countermeasures

graph TD
    subgraph Barriers["Physical Barriers"]
        Turnstile["Optical Turnstile"] --> T_Desc["Detects multiple people\nper credential scan"]
        Mantrap["Mantrap / Airlock"] --> M_Desc["Only one person\nin chamber at a time"]
        Speed_Gate["Speed Gate"] --> S_Desc["Fast-closing barriers\nwith anti-tailgate sensor"]
        Revolving["Security Revolving Door"] --> R_Desc["Single-person compartment\nwith weight sensor"]
    end
    subgraph Detection["Detection Systems"]
        Camera_AI["AI Video Analytics"] --> C_Desc["Count people vs badge scans\nalert on mismatch"]
        Overhead["Overhead Sensors"] --> O_Desc["Count bodies passing\nthrough doorway"]
        Floor_Sensors["Floor Pressure Sensors"] --> F_Desc["Detect multiple people\nin passage"]
        Thermal["Thermal Imaging"] --> TH_Desc["Detect body heat\ncount persons"]
    end
    subgraph Response["Response Actions"]
        Alert["Security Alert"] --> Guard["Guard Dispatched"]
        Alarm_Sound["Audible Alarm"] --> Deter["Deter Tailgater"]
        Door_Lock["Re-lock Door"] --> Prevent["Prevent Further Entry"]
        Log["Event Logged"] --> Investigate["Post-incident Review"]
    end
    Barriers --> Detection
    Detection --> Response

Technical countermeasure layers - from physical barriers through detection to response

Technical solutions can make tailgating physically difficult or detectable:

Turnstiles and Speed Gates

Optical turnstiles use infrared sensors to detect when more than one person passes through per badge scan. They can trigger alarms, lock the barrier, or alert security when tailgating is detected. Speed gates (full-height barriers that close quickly after one person passes) provide stronger physical enforcement.

Turnstiles are effective but have limitations. They are expensive ($5,000-$20,000+ per lane), require space, slow down traffic flow, and can create accessibility issues for wheelchair users or people with mobility devices. They also do not work for loading docks, fire exits, or other non-standard entry points.

Mantraps (Security Vestibules)

A mantrap is a small chamber with two interlocking doors. The first door opens to admit one person. It then closes and locks before the second door opens. The chamber can include weight sensors, cameras, and credential readers to verify that only one authorized person is present. Mantraps provide the strongest anti-tailgating protection but are slow, expensive, and typically reserved for high-security areas like data centers, vaults, or SCIFs.

Security Revolving Doors

Security revolving doors create individual compartments that hold one person at a time. Weight sensors can detect if two people enter the same compartment. These combine anti-tailgating enforcement with architectural aesthetics, making them popular for corporate lobbies.

Video Analytics

Modern video analytics systems use computer vision to count people passing through doorways and compare the count to badge read events. If three people walk through a door but only one badge was scanned, the system generates an alert. These systems work with existing cameras and doors but are detection-only - they do not prevent the tailgating, only flag it after the fact.

Overhead Counting Sensors

Ceiling-mounted sensors (stereoscopic cameras, time-of-flight sensors, or infrared beams) that count the number of individuals passing through a doorway. When the count exceeds the number of valid badge reads, an alert is triggered.

Procedural Countermeasures

Technical controls alone are not enough. Procedural countermeasures address the human element:

One-person-per-badge policy: Every person must scan their own badge at every door, every time. No exceptions. This must be a clear, communicated, enforced policy - not just a suggestion.

Visitor management: All visitors must check in, receive a visitor badge, and be escorted. Visitor badges should be visually distinct from employee badges (different color, large "VISITOR" label). Unescorted visitors without proper badges should be immediately identifiable as anomalous.

Badge visibility: Require all employees to display their badges visibly while on premises. This makes it easy to identify someone without a badge and creates a visual norm that visitors and unauthorized people cannot easily mimic.

Challenge protocol: Establish a clear, supported protocol for challenging unfamiliar people. Employees should be empowered to ask "Can I help you? Who are you here to see?" and know that doing so is expected and appreciated, not rude.

Reporting mechanism: Make it easy to report tailgating or suspicious behavior. A phone number, app, or simple process that employees actually use. If reporting is cumbersome, it will not happen.

Security Awareness Training

Training is essential but insufficient on its own. Effective anti-tailgating training includes:

Explain the why: Employees who understand what an attacker could do once inside are more motivated to prevent tailgating than employees who are just told "don't hold the door." Explain the consequences: data theft, network intrusion, corporate espionage, physical theft.

Practice the behavior: Role-play scenarios where employees practice challenging someone politely. Provide specific phrases: "I'm sorry, I need to ask you to scan your badge." "Let me call the front desk for you." "Our policy requires everyone to badge in individually."

Address the social discomfort: Acknowledge that challenging someone feels awkward and provide strategies for doing it comfortably. Framing it as helpful ("Let me help you get where you need to go") rather than confrontational ("I don't think you're supposed to be here") makes a significant difference.

Positive reinforcement: Recognize and reward employees who challenge unfamiliar people or report tailgating. This reinforces the behavior and signals to the organization that security is valued.

Regular reinforcement: One training session per year is not enough. Regular reminders, simulated tailgating tests, and periodic refresher training maintain awareness over time.

Penetration Testing for Tailgating

Tailgating is a standard technique in physical penetration testing. Testers evaluate:

• How easy is it to tailgate through each entrance?
• What percentage of employees challenge or report the tester?
• How far inside the facility can the tester get via tailgating alone?
• Do technical controls (turnstiles, sensors) detect the tailgating?
• How quickly does security respond to tailgating alerts (if any)?

The results provide a quantitative measure of the organization's tailgating vulnerability and the effectiveness of existing countermeasures. Serial testing over time can track improvement (or regression) in the organization's physical security posture.

During testing, pentesters typically try multiple approaches: silent tailgating (walking closely behind without interaction), piggybacking with a polite request ("Could you hold that?"), and pretext-based entry ("I'm from IT, my badge isn't working"). Each approach tests different aspects of the organization's defenses.

Conclusion

Tailgating and piggybacking are deceptively simple attacks that defeat sophisticated access control technology by exploiting human behavior. No amount of encryption, smart card technology, or biometric scanning matters if an attacker can simply follow someone through the door.

Effective defense requires a combination of technical controls (turnstiles, mantraps, video analytics), procedural controls (badge policies, visitor management, challenge protocols), and human controls (security awareness training, positive reinforcement, organizational culture). No single measure is sufficient - the strongest defense layers all three.

For security professionals interested in exploring wireless protocols and physical security technology, the BLEShark Nano provides hands-on BLE 5.0 and WiFi capabilities for security research.

Get the BLEShark Nano - $49.99

This article is for educational purposes. Physical penetration testing, including tailgating tests, requires explicit written authorization. Unauthorized entry to secured facilities is trespassing and is illegal.