Tailgating and piggybacking: physical access as an attack path

Tailgating is following an authorised person through a controlled door without presenting credentials. Piggybacking is the same thing with the authorised person's consent — they hold the door open. The distinction matters only for how you address it: one is a technical gap, the other is a social one.

Physical access short-circuits everything else. Someone inside the building can plug into a network port, attach a device to an unlocked workstation, photograph a whiteboard, or take a laptop. No amount of perimeter security applies once the attacker is past the perimeter.

Why it works so reliably

The vulnerability is politeness. Holding a door for the person behind you is normal, decent behaviour, and refusing to do so feels rude — particularly if they are carrying something, dressed like a contractor, or appear to be on a phone call.

Common pretexts, all cheap and all effective: arms full of boxes, a delivery, a high-visibility jacket and a clipboard, a ladder, a lanyard that looks approximately right, or simply arriving with a group after lunch. None requires technical skill.

Controls, roughly by effectiveness

Mantraps and turnstiles

The only genuinely reliable answer. A physical interlock allows one person per authentication and removes the social problem entirely — nobody has to challenge anyone, because the architecture does it. Expensive, disruptive to retrofit, and appropriate for data centres and server rooms rather than every door.

Anti-passback

The access system refuses a badge entering twice without an exit in between. This defeats badge-sharing, and it produces useful evidence: if someone's badge never registered an exit but they are badging in again, somebody came in behind them.

A challenge culture that protects the challenger

The instruction "challenge anyone without a visible badge" fails unless the organisation makes challenging safe. In practice that means: senior staff visibly accept being challenged, nobody is ever reprimanded for challenging someone who turned out to be legitimate, and there is a scripted, non-confrontational form of words — "Sorry, I don't recognise you, can I walk you to reception?" — so people do not have to invent one under pressure.

Without that, staff will not challenge a confident-looking stranger, and the policy is decorative.

Visitor management that means something

Badges that are visually distinct at a distance, dated, and collected on exit. A visitor badge indistinguishable from a staff badge at three metres provides no benefit.

Reduce what an intruder can reach

Assume tailgating will occasionally succeed and limit the consequences: 802.1X on wired ports so an unknown device gets nothing, enforced screen locks, clear-desk practice for anything sensitive, and separate controlled access to server rooms and comms cabinets. This is the layer most worth investing in, because it is the one that does not depend on human behaviour.

Testing it

Physical social engineering assessments are part of most red-team engagements, and they succeed far more often than clients expect. Two conditions are non-negotiable before any test:

• Written authorisation, carried by the tester. A signed letter naming the client, the scope, the dates and a contact who will answer a phone at any hour. Without it, a tester detained by police has committed trespass.
• A named point of contact who knows. Someone must be able to confirm the test is authorised, immediately.

The finding that matters from such a test is rarely "we got in". It is what was reachable afterwards: which ports were live, which screens were unlocked, which rooms were open.

What not to do with the results

Naming the individual who held the door is the fastest way to guarantee nobody reports the next incident. The useful output is structural — a door that should have an interlock, a network port that should not have been live, a visitor badge that looked like a staff badge.