Piggybacking is unauthorized access that occurs when one person follows another through a protected area or session without being properly authenticated. In identity security, it can also describe an attacker reusing a valid user’s access path, such as a logged-in device, shared badge, or active workstation, to evade controls.
Unauthorized access by tailgating and session reuse
Piggybacking is a physical or logical access bypass, not a legitimate authentication method. The core security issue is that a valid entry path, such as a door opened by another person or an already authenticated workstation, is reused without the defender’s controls being triggered.
That makes the term useful in both physical security and identity operations. In a workplace, a person may slip through a secured entrance behind an authorised user; in digital environments, the same pattern appears when someone takes over a logged-in session, shared device, or unattended terminal to inherit trust that was already established.
How piggybacking differs from normal access
Normal access depends on the subject proving entitlement at the point of entry. Piggybacking removes that proof step by exploiting proximity, social pressure, convenience, or an already open session. The access path itself is real, but the person using it is not the one the control was meant to admit.
This distinction matters because many controls assume the entry event and the identity of the entrant are bound together. Once that assumption breaks, door logs, session logs, and authentication records may look valid even though the actual actor was not authorised.
Where piggybacking shows up in practice
Physical piggybacking is common at badge-controlled doors, turnstiles, and reception gates where one person follows another through an authenticated entry. Digital piggybacking appears when an attacker uses an unlocked workstation, a shared kiosk, a remote desktop session, or a browser already authenticated to an application.
The same pattern can also occur in hybrid workflows where the physical and digital layers meet. For example, an intruder who gets past a door can reach an unattended device that still has access to internal systems, turning a brief physical lapse into broader account or data exposure.
Why piggybacking is dangerous for security programs
Piggybacking undermines confidence in who actually used a resource, which weakens both access control and auditability. It can also bypass step-up checks, session-level approvals, and location-based assumptions because the trust decision has already been made for someone else.
Defenders often underestimate it because no password is stolen and no alert necessarily fires at the moment of entry. But the result can still be unauthorized access to applications, data, offices, or privileged workstations, followed by deeper misuse if the intruder remains undetected.
Risk and Threat Considerations
Piggybacking creates a direct exposure when one trusted entry event is enough to carry an unverified actor into a protected area or session. The risk is highest where staff assume a valid badge, unlocked screen, or open door proves the right person is present, because that assumption is exactly what the attacker exploits.
Failure mechanism: The attacker waits for or induces a legitimate access event, then reuses the opened path before the control can distinguish the authorised user from the unauthorised follower or session borrower.
Impact: The attacker may gain undetected physical entry, inherited application access, exposure to sensitive data, or a foothold for further credential abuse and lateral movement.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-3 — Access Enforcement | Piggybacking bypasses enforced access decisions at entry or session boundaries. |
| IA-2 — Identification and Authentication (Organizational Users) | The term describes unauthorized use after or around user authentication. | |
| IA-11 — Re-authentication | Session piggybacking often relies on stale or inherited authentication state. | |
| Recommendation — Enforce access decisions at the point of entry so only verified users can cross protected boundaries. Require strong user authentication before granting access to protected systems and spaces. Re-authenticate users when session trust must be revalidated after a boundary or risk change. | ||
| NIST CSF 2.0 | PR.AA-05 — Identity Management, Authentication, and Access Control | Piggybacking is a direct failure of identity-bound access control and authentication assurance. |
| Recommendation — Tie entry and session access to verified identity and limit reuse of already-open trust paths. | ||
| CIS Controls v8 | CIS-6 — Access Control Management | This control family addresses controlling and reviewing who can access protected resources. |
| Recommendation — Restrict access paths and review where shared, inherited, or unattended access remains possible. | ||
Practitioner Guidance
Why practitioners should care: Piggybacking is a control-bypass problem, so it should be treated as an access integrity issue rather than a simple etiquette failure. Environments with badge systems, shared devices, or always-on sessions need explicit assumptions about who is present, who is authenticated, and when access ends.
What to watch for: Repeated open-door events without distinct badge scans, shared workstations left unlocked, and session continuity that survives user handoff are all signs that piggybacking risk is being tolerated. These conditions usually point to a gap between policy and the way people actually move through the space.
Practitioner takeaway: The control objective is not just to open the right door or start the right session, but to ensure the person crossing the threshold is the one that was verified.