Tailgating — also called piggybacking — is a physical social engineering attack where an unauthorised person walks through a secure door right behind an authorised one, without ever showing a credential. No malware, no phishing email, no exploit: the attacker borrows the trust your badge reader places in the person in front of them. It is the physical-world twin of phishing, and in 2026 it remains one of the cheapest ways into an office, a server room or a construction site.
TL;DR
- Tailgating is entering a secure area by following closely behind someone who is authorised — no card, code or forced door.
- It exploits politeness, not technology: holding a door for a colleague carrying boxes is exactly the reflex attackers use.
- Common disguises: the delivery driver with hands full, the contractor in a hi-vis vest, the new employee who "lost" their badge.
- Stopping it needs both layers: physical controls (turnstiles, mantraps, door alarms) and a trained reporting culture.
- If your security plan covers email but not the front door, a security gap assessment shows where the coverage ends.
What tailgating means in plain terms
Every access control system has the same design assumption: one authorised person passes through one door at a time, and the door closes behind them. Tailgating breaks that assumption by adding a second body into the same opening — a known courier, a person who claims to have left their badge at reception, or simply someone moving with enough purpose that nobody questions them.
It matters because most businesses spend their security budget on digital doors and treat the physical ones as furniture. A stolen laptop, an unattended workstation, a network port in a meeting room or a printed client list on a printer tray all become accessible the moment an attacker is inside.
How a tailgating attack actually runs
The attack is simple enough to describe in one sentence, which is exactly why it works:
- The attacker dresses to belong — hi-vis vest, lanyard, tool bag, coffee cups.
- They wait for peak flow, usually 8 to 9 am, when doors open constantly and guards stop checking.
- They follow an authorised person through, offering an excuse if questioned: "card's not working", "I'm with the HVAC contractor".
- Inside, they look for unattended laptops, network jacks, badge-printing stations or documents.
The three disguises that work every time
- The courier. Arms full of boxes means nobody expects them to badge in — the polite reflex opens the door for them.
- The contractor. A hi-vis vest and a clipboard read as "expected here". Few staff will challenge someone who looks like maintenance.
- The new hire. A lanyard and a plausible story ("first week, badge isn't activated yet") turns your own kindness into the access control.
All three exploit the same trait: people do not want to be wrong, so they do not challenge strangers. Training flips that default — being challenged politely is the outcome a secure culture produces.
How to stop tailgating
No single control stops it; the layered set does.
| Layer | Control | What it does |
|---|---|---|
| Physical | Turnstiles or security revolving doors | Physically enforce one person per credential |
| Physical | Mantraps at high-value doors | Hold the second person until identity is verified |
| Physical | Door position alarms | Alert when a secure door opens twice or stays open |
| Policy | Single-badge rule, stated and enforced | No exceptions for couriers, contractors or new hires |
| Policy | Visitor escort requirements | Nobody without a badge moves unaccompanied |
| People | Tailgating in the training curriculum | Staff learn to challenge politely and report attempts |
The people layer is where most Australian businesses are weakest. Physical hardware needs a facilities budget; a habit needs training and reinforcement. That is why tailgating belongs in the awareness programme, not just the site security plan — Cyber Aware's security awareness training covers physical social engineering alongside phishing so staff hear one consistent message.
Why training makes the difference
An intruder only needs one polite employee. So the training goal is narrow and specific:
- Badge in every time, even when the door is already open.
- Challenge unknowns with a friendly script: "Hi, can I help you find someone?" — a question is a control.
- Report every tailgating attempt, successful or not, the same way they report a phishing email.
Measure it the same way you measure phishing readiness: professional red-team firms run physical ingress tests, and repeated attempts that fail are the proof the culture changed. A workforce that reports two failed tailgating attempts in a quarter is safer than one with a turnstile and a silent reception desk.
FAQ
What is tailgating in cyber security? A physical social engineering attack where an unauthorised person enters a secure area by following closely behind someone authorised. It needs no technical exploit — only a door and a moment of politeness.
What is the difference between tailgating and piggybacking? Very little. Piggybacking is sometimes used for the version where the intruder tricks the victim into letting them in with a story; tailgating for silently following. Most sources, including ASD guidance on physical security, treat the two as synonyms.
Why do attackers use tailgating instead of hacking? Because it is cheap, fast and almost never logged. There is no failed-login alert for a person who walks in behind an employee, and a stolen laptop or an unattended workstation hands over data directly.
How do you prevent tailgating? Layer it: one-person-per-entry hardware at sensitive doors, a single-badge policy with no exceptions, visitor escorts, door alarms — and training so staff challenge and report. Any single layer alone can be beaten by one polite moment.
Is tailgating covered in security awareness training? It should be. The same reflexes that stop a phishing click — slow down, verify, report — stop a tailgater. A 2026 curriculum that covers email but not the front door leaves an entire attack class untrained.
One last thing
Ask your reception team the last time someone was turned away for tailgating. If the answer is "never", either your building is perfectly secured or attempts are not being noticed and reported — the second one is far more likely, and it is fixable this quarter.