A tailgating attack is when an unauthorized person follows an authorized one through a controlled entrance, usually without being challenged. It works because people hold doors open to be polite. Stopping it takes door hardware that admits one person at a time, plus a workplace habit of politely challenging strangers.
How does tailgating work?
The attacker needs no credentials. They wait near an entrance, often carrying boxes, a coffee or a phone call, and walk in behind someone who has just badged through. Sometimes they ask for the door to be held. Sometimes they simply look like they belong.
CISA's social engineering guidance explains the underlying pattern: an attacker uses human interaction and social skills, and may appear unassuming and respectable, possibly claiming to be a new employee, a repair person or a researcher, and even offering credentials to support that identity. Tailgating applies that approach at a door. The attack target is the person's politeness, not the lock.
Related terms get mixed up. Piggybacking usually means the authorized person knowingly lets someone in. Tailgating usually means the person follows without the other's knowledge or consent. Both give the same result.
What can an attacker do inside?
Once past the door, the damage depends on what the area holds. They can plug a device into a network port, take a laptop or documents, photograph screens, sit at an unlocked workstation, or place a rogue device. MITRE ATT&CK lists hardware additions, technique T1200, as a way adversaries introduce computing devices into a system or network to gain access.
What do standards say about physical access?
NIST SP 800-53 Revision 5 has a family of physical controls. Control PE-2 says to keep a list of individuals with authorized access to the facility, issue credentials and remove people whose access is no longer needed. Control PE-3 says to enforce physical access authorizations by verifying individual authorizations before granting access and controlling entry and exit, and to keep physical access audit logs. PE-3 also covers controlling access to areas within the facility designated as publicly accessible.
Those controls describe what to achieve. The door type and the procedure are your choices.
Which controls reduce tailgating?
Hardware. Turnstiles, mantraps (a small chamber where only one person can pass before the next door opens) and speed gates admit one person per credential. They cost more and need space, so reserve them for high value areas.
Detection. Cameras and door sensors that alert when two people enter on one badge, or when a door is held open too long.
Policy and habit. A clear rule that everyone badges in, even when the person ahead is known, and that visitors wear visible passes and are escorted.
Training. Short, practical coaching on how to challenge a stranger in a friendly way. Giving staff a script helps: Hi, can I help you find someone? Let's check in at reception.
Separation of zones. A server room or lab behind a second door with its own access list limits what a successful tailgater reaches.
Constructed example: the delivery person
A person in a courier jacket carrying two boxes waits at a side door. An employee badges in and holds the door. The visitor walks to the nearest empty meeting room and connects a small device to a wall network port. Nothing was stolen, so no one reports anything. Weeks later unusual network traffic from that port prompts an investigation. Port security that disables unused wall jacks, plus a policy that couriers use reception, would have closed both gaps.
How to check or apply this
- Walk your own entrances at busy times and watch whether people badge individually.
- Review the physical access list for leavers and expired contractors, and set a review schedule.
- Put sensitive areas behind a second controlled door and log who enters.
- Disable unused network ports and require authentication on wired connections.
- Give staff a simple way and a script to challenge strangers and report them.
- Test with an authorized, documented exercise, with management consent and no punishment for people who fail it.
Quick check
Is tailgating a cyber attack?
It is a physical attack that often leads to cyber compromise, because physical access to a network port or workstation bypasses many technical controls.
Does a badge reader stop it?
Not alone. A reader checks the badge that was presented, not how many people walked through. Turnstiles, mantraps and alert rules cover that.
Sources
- CISA, Avoiding Social Engineering and Phishing Attacks
- NIST SP 800-53 Rev. 5 control catalog, PE-2 and PE-3 (OSCAL, NIST GitHub)
- MITRE ATT&CK T1200, Hardware Additions
Last reviewed: 18 October 2026.
