Anti-tailgating is a physical security control that prevents unauthorised people from entering a restricted area by following an authorised person through a door or gate. It uses measures such as turnstiles, mantraps, badge readers, door alarms, and security awareness to enforce one person per authentication or entry event.
What Anti-Tailgating Means in Physical Security
Anti-tailgating is the control layer that stops an unauthorised person from slipping into a restricted area behind an authorised entrant. In practice, it turns a doorway or gate into a controlled entry event, so the organisation can enforce one person per access cycle and reduce the chance of silent physical intrusion.
Because the control is about movement through a real boundary, it is usually implemented as part of a broader physical access design rather than as a standalone device. Physical Security Guide for Security Teams places it in the wider context of layered site protection, badge control, and physical access control systems.
How Anti-Tailgating Works
Anti-tailgating measures create friction or detection at the entry point. Common mechanisms include turnstiles, mantraps, security vestibules, optical gates, badge readers, and alarms that trigger when a door is held open or when two people attempt to pass on one credential event.
The strongest designs combine a physical barrier with a verification step, because awareness alone rarely stops a determined person from following close behind. The control may also rely on process, such as reception checks, challenge culture, visitor escorting, and signage that makes the expected behaviour obvious at the point of entry. Tailgating and Piggybacking Guide covers those practical patterns in more detail.
Why Tailgating Is Dangerous
Tailgating undermines the assumption that a secure door, badge reader, or turnstile actually limits access to authorised people. If an attacker gets inside, they may gain proximity to sensitive systems, offices, documents, clean rooms, data centres, or endpoints that were supposed to be physically segregated.
The risk is not only theft or trespass. Physical intrusion can enable observation, device theft, malicious USB placement, badge cloning opportunities, or direct access to work areas where privileged activity occurs. Social Engineering Guide and Top 10 Social Engineering Attacks both treat tailgating as a social engineering method that exploits courtesy, haste, and trust.
Where Anti-Tailgating Fits in the Security Stack
Anti-tailgating is most effective when it is paired with broader physical and operational controls. It works best where the facility has clear zoning, visitor management, alarm response, and consistent enforcement, because the control depends on people treating the boundary as meaningful.
It also matters in environments where physical and cyber security intersect, such as offices with sensitive production access, engineering labs, or data centres. In those settings, a physical bypass can become a cyber problem very quickly if an intruder reaches consoles, recovery media, credentials, or unattended devices. Physical Security Guide for Security Teams is useful here because it links entry control to wider site protection and security convergence.
Risk and Threat Considerations
Anti-tailgating fails when an entry point depends on courtesy instead of enforced separation. That creates a narrow but serious gap, because a single successful follow-through can bypass otherwise strong access controls and place an unauthorised person inside a trusted space.
Failure mechanism: An attacker or opportunistic intruder exploits normal human behaviour at the door, then uses the authorised person's entry event to bypass the control before anyone challenges them.
Impact: Physical compromise can lead to theft, surveillance, device tampering, workspace intrusion, or onward access to systems and materials that were assumed to be protected by the entry control.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8 and NIST SP 800-53 Rev 5 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-5 — Account Management | Physical entry control supports governed access to restricted facilities. |
| Recommendation — Restrict facility entry paths so only authorised people can access protected spaces. | ||
| NIST SP 800-53 Rev 5 | PE-3 — Physical Access Control | This control directly addresses restricting and monitoring physical access to facilities. |
| PE-6 — Monitoring Physical Access | Tailgating is often detected through monitoring of physical entry events and anomalies. | |
| PE-8 — Visitor Access Records | Visitor controls reduce tailgating risk by tracking and controlling non-employee entry. | |
| Recommendation — Enforce PE-3 at entrances to prevent unauthorised physical entry. Monitor entry activity for unusual access patterns and tailgating attempts. Record and escort visitors so entry events remain attributable and controlled. | ||
| ISO/IEC 27001:2022 | A.7.2 — Physical entry | Annex A covers physical entry controls for protected areas and facilities. |
| Recommendation — Implement physical entry controls that stop unauthorised following through entrances. | ||
Practitioner Guidance
Why practitioners should care: Anti-tailgating is only effective when the control is enforceable in real operations, not just documented in policy. If staff treat it as optional etiquette, the organisation has a visible security boundary that can be bypassed with little effort.
What to watch for: Repeated door-holding, badge sharing, “hold the door” habits, and inconsistent challenge behaviour are signs that the control is degrading in practice. The most reliable programmes combine the physical measure with clear expectation-setting and routine reinforcement.
Practitioner takeaway: Treat anti-tailgating as an access control, not a courtesy rule, and verify that the doorway actually enforces one person per entry event.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 9, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org