Definition
Tailgating is a physical security breach where an unauthorized person follows an authorized individual into a restricted area without presenting their own credentials, exploiting social courtesy to bypass access controls.
People Also Ask
Common questions about Tailgating answered by our security experts.
Tailgating in Practice
Tailgating is following an authorised person through a controlled door to gain physical access without credentials. It is the most effective physical intrusion technique because it exploits politeness rather than any weakness in the access control system.
It matters to information security because physical access defeats a great many technical controls: network ports, unlocked workstations, printed documents, server rooms and the opportunity to place a device.
Why it works so reliably
Holding a door for the person behind you is normal courteous behaviour, and challenging a stranger is socially uncomfortable. The attacker only needs to look like they belong — carrying boxes, wearing appropriate clothing, holding a coffee and a phone.
Physical security testing succeeds through this route more often than any other, frequently within minutes and frequently at organisations with substantial access control investment.
What access yields
An unattended workstation, which is a logged-in session. A network port, which is internal network access. Printed material left on desks and in trays. Credentials written down. Server and communications rooms, which are frequently less well secured than the building entrance.
And the opportunity to leave something behind — a small device on a network port can provide remote access for months.
Physical measures, and their limits
Turnstiles and interlocking door pairs that admit one person at a time are effective and expensive, and they are usually justified only at main entrances. Anti-passback rules detect a credential used to enter twice without an exit.
Staffed reception with genuine challenge authority works well. Cameras help investigation rather than prevention. Side doors, loading bays, smoking areas and fire exits are where testers actually get in, and they receive a fraction of the attention the main entrance does.
The cultural control is the cheapest and hardest
Staff willing to ask an unbadged person who they are visiting is the most effective single measure, and it requires explicit, repeated and visible backing from leadership.
Without it, nobody challenges, because the risk of embarrassing a senior person outweighs the perceived risk of an intruder. The necessary message is that challenging is expected, that being challenged is normal, and that nobody will be criticised for asking.
Reducing what physical access achieves
Automatic screen locking on short timeouts. Disabled unused network ports, and port-based authentication so a connected device must authenticate. Clear desk practice for sensitive material. Separate, stricter access for server and communications rooms.
These assume the perimeter will occasionally fail, which is the correct assumption.
The adjacent physical techniques
Credential cloning is the companion problem. Older proximity card technologies can be read and duplicated from a short distance with inexpensive equipment, which means an attacker does not need to follow anyone through the door.
Also common in testing: propped doors, unsecured lifts and stairwells, requesting access at a service entrance, and simply arriving with a visible contractor pretext. Modern encrypted credentials address the cloning problem; the rest are procedural and are usually where the finding actually is.
Where to start
Walk your own secondary entrances at shift change and see what would stop you. Then check whether an unlocked workstation and a live network port are waiting inside.
See where physical and cyber meet. GuardsArm runs penetration testing.
Related Terms
Social Engineering
Social engineering is a manipulation technique that exploits human psychology to trick people into making security mistakes or giving away sensitive information. It is the human element of cybersecurity attacks and often serves as the initial vector for more complex attacks.
Physical Security
Physical Security encompasses the measures designed to protect personnel, hardware, software, networks, and data from physical actions and events that could cause serious loss or damage to an organization.
Insider Threat
An Insider Threat is a security risk posed by individuals within an organization, such as employees, contractors, or partners, who misuse their authorized access to harm the organization's data, systems, or operations.
Related Reading
Physical Security and Cyber: Where Hospitals Lose the Thread
Hospitals are deliberately open buildings with network ports in public corridors. The controls that matter sit where physical access and network…
Deepfake Voice Fraud: Defending Approvals Against a Convincing Call
Voice cloning removed the last reason to trust a familiar voice. The process changes that work, and the awareness training that does not.
Insider Threat Monitoring in Healthcare: What to Watch and Why
Most healthcare insider incidents are curiosity, not espionage — and both are reportable. Monitoring that catches real misuse without treating…
Speak With an Expert
Book a free consultation to discuss tailgating for your organization.
Related Services
Need Help With Tailgating?
Our certified security professionals can help you implement the right tailgating strategy for your organization. Get a free assessment today.
Book a Free Consultation