Tailgating and Piggybacking Guide: Physical Access Social Engineering and Controls

Tailgating is when an unauthorised person follows an authorised person through a controlled door or gate without presenting their own credential; piggybacking is the same act done with the authorised person's knowledge or consent. Both are physical social engineering: they defeat a badge reader, turnstile or lock by exploiting politeness rather than technology. This guide explains the two terms in plain language, then covers why they work, the controls that reduce them (turnstiles, interlocking entrances, anti-passback, badge policy, visitor management and a challenge culture), how physical access ties back to identity and offboarding, and how to measure the problem. It is written for security, facilities and identity teams who own building access, and for anyone building an awareness programme.

Key takeaways

• One credential, two bodies is the whole problem: a door that opens for one valid badge and lets two people through has authenticated only one of them.
• The difference is consent: tailgating happens without the authorised person noticing, piggybacking happens because they hold the door. Controls differ, because piggybacking is a behaviour problem as much as a barrier problem.
• Barriers and culture work together: speed gates and interlocks stop casual following at main entrances, but side doors, loading bays and lift lobbies still depend on people being willing to challenge or report.
• Physical access is an identity: a badge is a credential in an access control system, and it must be provisioned, reviewed and revoked through the same joiner-mover-leaver process as a network account.
• Measure with data, test with permission: door-held and forced-door alarms, anti-passback violations and authorised physical tests show whether controls work far better than policy attestations.

What it is

In plain terms: a secure building has doors that only open for the right badge, PIN or fingerprint. Tailgating and piggybacking get a person through such a door by following someone who is allowed in. No lock is picked and no card is cloned. The attacker relies on the gap between "the door is unlocked" and "everyone walking through it has been checked".

• Tailgating: the follower slips through behind an authorised person who does not notice or does not realise the follower lacks access. Typical cases are closely following through a slow-closing door or catching a door before it latches.
• Piggybacking: the authorised person knowingly lets the follower in, usually out of courtesy ("you look like you work here"), because the follower is carrying boxes, claims to have forgotten a badge, or appears to be a contractor or delivery driver.
• Usage varies: many organisations and training providers use the two words interchangeably. The distinction above (consent or not) is the most common practitioner usage and the one this guide follows, because it maps to different controls.

MITRE CAPEC classifies this family under CAPEC-390 Bypassing Physical Security, which notes that layered physical security (locks, electronic card entry and alarms) makes random intrusion hard to miss but is less effective against deliberate, planned entry. Tailgating is one of the cheapest ways to make that deliberate entry.

How it works

Most physical access control systems (PACS) authenticate a credential at a reader, then release a lock for a few seconds. The system records one valid entry. It does not know how many people passed while the door was open unless something else counts them. Followers exploit this through a small set of recurring patterns.

• Timing: waiting near an entrance at busy times (morning arrival, lunch, shift change, fire-drill re-entry) when people stream through and nobody holds the context of who is behind them.
• Pretext: props and stories that make a request for help feel normal: a hi-vis vest, a lanyard with a fake or foreign badge, a pizza box, a ladder, a phone call in progress, or "I left my badge at my desk".
• Reverse entry: entering through an exit-only door as someone leaves, or using a request-to-exit sensor that unlocks a door when it detects motion on the inside.
• Weak secondary entrances: smoking areas, loading bays, car park lifts and fire doors propped open for convenience usually have no guard and fewer cameras than the main lobby.
• Shared spaces: multi-tenant buildings where the lobby is controlled by the landlord but each floor relies on the tenant, so a visitor badge for one floor carries a person to all of them.

Once inside, the follower can reach unlocked workstations, printers, network ports and meeting rooms. In ATT&CK terms the physical entry enables techniques such as T1200 Hardware Additions (planting a device on the network) and theft of equipment or documents. Physical red teams use the same patterns, which is why they are part of authorised social engineering engagements; method and rules of engagement are covered in the Social Engineering and Physical Penetration Testing Guide and are not repeated here.

Why it matters

Tailgating turns a sound logical security programme into a gap: a strong network perimeter and phishing-resistant MFA do little if a visitor can sit at an unlocked desk or plug a device into a floor port. It also undermines evidence. If entries are not tied to individuals, access logs cannot be used reliably in an insider or theft investigation, and site safety (knowing who is in the building during an evacuation) suffers too.

Controls that reduce following

Choosing controls by site and size

• Small offices: a single controlled entrance, a staffed or video-answered reception, door-held alarms on every external door and a clear "no badge, no entry, go to reception" rule usually give most of the benefit. Barriers are rarely justified.
• Large or multi-tenant buildings: speed gates at the lobby, anti-passback between lobby and floors, tenant-controlled floor readers and contracts that require the landlord to share access logs.
• High-value zones: data centres, comms rooms, cash and lab areas justify interlocks, two-factor readers (badge plus PIN or biometric) and CCTV covering the reader and the door. NIST SP 800-116 Rev. 1 describes this risk-based choice of authentication mechanism per area for PIV-based systems.
• Option A vs B: choose barriers where throughput is high and following is easy to hide in a crowd; choose culture plus alarms where doors are many and traffic is light. Most sites need both, in proportion to what is behind the door.

Implementing a tailgating programme

1. Map entrances and zones: list every door, its reader type, who can open it, whether it has a door-held alarm and camera coverage, and what assets are behind it.
2. Baseline: pull a month of PACS data for door-held, forced-door and anti-passback events, and run an observational count at peak times at two or three key entrances.
3. Fix the easy paths first: stop doors being propped (alarms plus facilities follow-up), set door-held thresholds per door, and close or alarm unofficial entrances such as smoking-area doors.
4. Give people a legitimate alternative: fast temporary badge issue for forgotten badges, delivery drop points outside the secure area, pre-registered visitors.
5. Launch the behaviour: publish a short rule, train it with examples, and have senior leaders model being challenged. Pilot one site or floor before wider rollout.
6. Turn on anti-passback in log-only mode, review violations for a few weeks, then move high-risk zones to blocking mode. Roll back to log-only if evacuation or legitimate flows break.
7. Test: commission authorised physical tests with written rules of engagement and feed findings back. See the Physical Security Guide for Security Teams for wider building controls.

Where identity fits

A badge is a credential, and the PACS is an identity store, often run by facilities and never connected to HR or the identity governance platform. That is how leavers keep working badges and contractors keep access long after a project ends. Treat physical access like any other entitlement:

• Provision from the authoritative source: drive badge creation from HR and contractor records, with zone access attached to role.
• Deprovision on exit: disable the badge in the same offboarding workflow that disables directory accounts, and collect the physical card (NIST SP 800-53 PS-4 Personnel Termination covers disabling access and retrieving security-related property). See the Employee Offboarding Security Guide and the Joiner-Mover-Leaver Guide.
• Review access: include high-risk zones in access certifications, and remove zone rights when people move roles.
• Correlate: a logical login from a desk on a day with no badge-in, or a badge-in for someone on leave, are useful anomalies for insider investigations. See the Insider Threat and Identity Guide.

Detection and metrics

• Log sources: PACS events (valid read, invalid read, door held, door forced, anti-passback violation), turnstile tailgate sensor alarms, visitor system records and CCTV analytics where used. Send them to the SIEM so they can be joined with HR and directory data.
• Door-held-open events per door per week, trending down after fixes.
• Anti-passback violations per 1,000 entries in each zone.
• Tailgate success rate in authorised tests (attempts that reached the target area divided by attempts).
• Challenge rate: share of test attempts where staff challenged or reported the tester.
• Leaver badge lag: time between HR leave date and badge disablement, with a target of same day.
• Temporary badge return rate at the end of each day.

Common misconceptions

• "Our badge readers stop this." Readers authenticate a card, not the number of people who pass. Without a barrier, sensor or watchful staff, a valid read admits everyone behind it.
• "It is only a problem at the front door." The main lobby is usually the best-protected entrance. Loading bays, smoking areas and propped fire doors are where most following goes unnoticed. A common failure is guarding the lobby while leaving a side door on permanent hold.
• "Challenging people is rude, so we rely on awareness posters." Without an easy alternative (reception, quick temporary badge) and leaders who back challengers, posters do not change behaviour.
• "Anti-passback solves tailgating." It detects badges used out of sequence, which catches some piggybacking and badge sharing, but a follower who never badges is invisible to it unless barriers or sensors count people.
• "Physical access is a facilities issue." Leaver badges that stay active, contractor badges with no expiry and PACS admin accounts with shared passwords are identity failures. Excluding the PACS from offboarding and access reviews is one of the most common gaps.

Related concepts

• Badge cloning: copying a proximity card rather than following someone; addressed by modern encrypted credentials. See the Bluetooth, RFID and NFC Security Guide.
• Pretexting and phishing: the same persuasion techniques used on a phone or email. See the Security Awareness and Human Risk Management Guide.
• Hardware additions: devices planted after entry, such as rogue access points or USB implants. See the Removable Media and USB Control Guide.

Framework mapping

Practitioner checklist

• Inventory every entrance with reader type, alarm status, camera coverage and the assets behind it.
• Enable door-held and forced-door alarms on all external and high-risk doors, with thresholds set per door.
• Install one-person-per-credential barriers where traffic is high and interlocks for data halls and comms rooms.
• Run anti-passback in log-only mode, review violations, then enforce in high-risk zones.
• Provide a fast, staffed alternative for forgotten badges, visitors and deliveries, so refusing entry is easy.
• Publish a one-line rule ("every person badges, every time") and have leaders model being challenged.
• Connect the PACS to HR and the identity governance process: same-day badge disablement for leavers and expiry on contractor badges.
• Stream PACS events to the SIEM and correlate with directory sign-ins and HR status.
• Commission authorised physical tests at least annually and track tailgate success and challenge rates.

Standards and references

• NIST: Cybersecurity Framework 2.0
• NIST: SP 800-53 Rev. 5 Security and Privacy Controls
• NIST: SP 800-116 Rev. 1 Guidelines for the Use of PIV Credentials in Facility Access
• ISO: ISO/IEC 27001:2022 Information security management systems
• MITRE CAPEC: Bypassing Physical Security
• MITRE ATT&CK: Hardware Additions
• CISA: Physical Security

Related NHI Mgmt Group resources: Physical Security Guide for Security Teams · Social Engineering and Physical Penetration Testing Guide · Employee Offboarding Security Guide · Security Awareness and Human Risk Management Guide · Juice Jacking Guide