Definition
Shoulder Surfing is a social engineering technique where an attacker observes a victim's screen or keyboard to gather sensitive information such as passwords, PINs, or confidential data in public or semi-public spaces.
People Also Ask
Common questions about Shoulder Surfing answered by our security experts.
Shoulder Surfing in Practice
Shoulder surfing is observing someone's screen, keyboard or documents to obtain information they did not intend to share. It requires no technical capability and it remains effective because people work in places other people can see.
It is easy to dismiss as trivial, and it is the mechanism behind a meaningful share of credential compromise in environments with shared or public workspaces.
What gets observed
Passwords, entered slowly enough to read. Authentication codes, which are useful for the brief window they remain valid. Screen contents — patient records, financial data, customer information, internal correspondence.
Also badge numbers, door codes and the contents of documents left visible. Photography makes all of it recordable rather than memorised, which removes the practical limit on how much can be taken.
Where the exposure actually is
Open-plan offices with screens visible from walkways. Shared clinical and retail workstations. Public transport and cafes. Airport lounges and hotel lobbies. Video calls with screens or whiteboards in frame.
Reception and service counters, where a screen faces the person being served, are a specific and frequently overlooked case.
Physical and configuration measures
Privacy filters on screens in exposed positions, which are inexpensive and effective. Screen orientation away from walkways and public areas. Short automatic lock timeouts. Proximity-based locking where available.
For shared workstations, fast user switching so people do not leave sessions open for convenience, and rapid re-authentication so locking is not a productivity penalty.
Authentication design removes the value
Observation-resistant authentication is the structural answer. A hardware key or platform authenticator cannot be used by someone who watched it being used, because possession of the device is required.
That converts the problem from one of vigilance into one of provisioning, which is a considerably more reliable place for a control to sit. See multi-factor authentication.
The remote working case
Work in public places is now routine, and household members, shared accommodation and video call backgrounds all create exposure that no office control addresses.
Practical guidance is specific rather than general: privacy filters for laptops used in transit, awareness of what is behind you on calls, and a clear rule about which categories of data should not be opened in public at all.
In regulated settings it is a reportable exposure
Where health, financial or personal records are visible to people with no right to see them, that is unauthorised disclosure regardless of whether anyone acted on it. Several privacy regimes treat visual exposure the same way they treat any other.
That changes the calculation. A screen at a nursing station or a service counter facing a waiting area is not merely untidy practice — it is a control gap with notification implications, which is usually a more persuasive framing than the credential-theft argument.
Testing for it is straightforward and rarely done. A walk-through noting which screens are readable from public or shared positions, at the times people actually work, produces a short and immediately actionable list — and it is the kind of finding facilities teams can resolve without any security project.
Where to start
Walk through your own workspace and note every screen readable from a walkway or a public-facing position. Privacy filters for those cost very little and need no behaviour change.
See physical security. GuardsArm runs penetration testing.
Related Terms
Social Engineering
Social engineering is a manipulation technique that exploits human psychology to trick people into making security mistakes or giving away sensitive information. It is the human element of cybersecurity attacks and often serves as the initial vector for more complex attacks.
Insider Threat
An Insider Threat is a security risk posed by individuals within an organization, such as employees, contractors, or partners, who misuse their authorized access to harm the organization's data, systems, or operations.
Physical Security
Physical Security encompasses the measures designed to protect personnel, hardware, software, networks, and data from physical actions and events that could cause serious loss or damage to an organization.
Related Reading
Deepfake Voice Fraud: Defending Approvals Against a Convincing Call
Voice cloning removed the last reason to trust a familiar voice. The process changes that work, and the awareness training that does not.
Insider Threat Monitoring in Healthcare: What to Watch and Why
Most healthcare insider incidents are curiosity, not espionage — and both are reportable. Monitoring that catches real misuse without treating…
Physical Security and Cyber: Where Hospitals Lose the Thread
Hospitals are deliberately open buildings with network ports in public corridors. The controls that matter sit where physical access and network…
Speak With an Expert
Book a free consultation to discuss shoulder surfing for your organization.
Related Services
Need Help With Shoulder Surfing?
Our certified security professionals can help you implement the right shoulder surfing strategy for your organization. Get a free assessment today.
Book a Free Consultation