In plain English
Tailgating is one of the simplest physical security breaches. An attacker waits near a secured door and, when an authorised person badges in, follows them through before the door closes — relying on social courtesy and the reluctance to challenge strangers. Physical security awareness training teaches staff to politely challenge anyone without a visible badge.
Full definition
Physical security failures do not always look like a breach. Sometimes they look like politeness. An attacker waits near a secured entry, times their approach to coincide with a staff member badging in, and walks through behind them. The staff member holds the door. The attacker is inside your building, on your floor, next to your servers or your staff's unlocked desks.
No technical control stops this. Tailgating exploits a social norm: most people feel uncomfortable challenging someone who looks like they belong there. The attacker may be dressed appropriately, carrying a bag, or on their phone. They do not look like a threat. That is the point.
Practical defences include physical mantrap or airlock-style entry systems that allow only one person through at a time, clear staff training that makes challenging unknown visitors a cultural expectation rather than an awkward exception, and visitor management procedures requiring sign-in at reception rather than following staff through side doors. In IronSights physical security assessments, tailgating is one of the most commonly exploited vectors because it requires no tools and leaves no digital trail.
- Mantrap or airlock entry systems at secured access points
- Staff training that normalises challenging unknown visitors
- Visitor management procedures with reception sign-in
- CCTV coverage at entry points with regular review