The "Nice Guy" Exploit
Tailgating (also called piggybacking) is when an unauthorized person gains physical access to a restricted area by following an authorized person through a secured entry point. It requires no technical skill — only social confidence and an understanding of human courtesy.
The attack works because holding a door open for someone behind you is a deeply ingrained social norm. Refusing to do so feels rude and confrontational. Attackers exploit this discomfort deliberately.
Common tailgating scenarios:
- The Smoker's Dock: Attackers identify the building's designated smoking area. When employees finish their break and badge back in, the attacker joins the conversation mid-sentence and walks in with the group. No one challenges a person who appears to belong.
- The Struggling Delivery Driver: An attacker dresses in a recognizable uniform (UPS, FedEx, a local courier) and carries a large, heavy box to the secure entrance. Human instinct compels an employee to hold the door for someone who appears to be struggling. The attacker thanks them warmly and is now inside.
- The New Employee: Attackers research company hiring announcements on LinkedIn. They dress professionally, arrive during morning rush hour, and blend in with the crowd of employees badging in. If challenged, they say they're new and their badge hasn't been provisioned yet.
The Fix: "One badge, one entry." Every single person must scan their own badge, every single time, even when walking in a group. Security culture must make this feel normal, not rude. Turnstiles and mantrap vestibules (a small chamber with two doors where only one can open at a time) are the physical enforcement mechanism. Tailgating detection cameras with AI can flag when more people pass through than badges were scanned.