Tailgating in physical security is an unauthorized access technique in which an individual follows an authorized person into a restricted area without presenting proper credentials. It exploits human behavior rather than technical vulnerabilities and is one of the most common physical security weaknesses in enterprise environments.
Tailgating is frequently identified during physical penetration testing and red team engagements.
How Tailgating Attacks Work
Tailgating typically occurs when:
- An employee holds a door open for a stranger
- A person enters behind someone using a badge
- A visitor blends into a group entering a secure zone
Attackers rely on:
- Politeness norms
- Social pressure
- Lack of credential verification
- High-traffic building entrances
Why Tailgating Is a Major Enterprise Risk
Tailgating allows unauthorized individuals to access:
- Server rooms
- Executive offices
- Research labs
- Financial records
- Critical infrastructure areas
Once inside, attackers may:
- Install malicious devices
- Exfiltrate hardware
- Conduct reconnaissance
- Facilitate insider compromise
How Physical Penetration Testing Identifies Tailgating Vulnerabilities
During controlled intrusion simulations, red team operators assess:
- Employee response to unknown individuals
- Enforcement of badge policies
- Security guard attentiveness
- Access control monitoring
Organizations frequently underestimate tailgating risk until tested.
Learn more about physical penetration testing services (link to master page).
Tailgating vs Piggybacking
Though often confused:
Tailgating: Unauthorized person follows without permission.
Piggybacking: Authorized person knowingly allows entry.
Both represent significant procedural weaknesses.
How to Prevent Tailgating
Effective mitigation includes:
- Anti-tailgating awareness training
- Strict badge enforcement policies
- Mantrap security systems
- Turnstile access controls
- Visitor escort requirements
- Periodic physical penetration testing