Category hub: Social engineering and human risk

In one sentence: Tailgating is walking into a secure area by following an authorised person, and piggybacking is when that person knowingly lets the visitor in.

What it is

Tailgating is a physical form of social engineering. The attacker does not break a lock. They rely on people being polite and busy.

Two terms are used. Tailgating usually means following without the authorised person noticing. Piggybacking usually means being knowingly let in, perhaps after a believable excuse. Some sources use the words interchangeably. Policy should treat both the same: nobody passes a controlled door without their own approved entry.

How it works

1. The attacker studies the building, shift changes, smoking areas and delivery times.
2. They choose a cover story. CISA’s guidance notes attackers may claim to be a new employee or a repair person.
3. They time their approach to a door, often carrying parcels so staff offer to help.
4. The authorised person badges in and the attacker follows. The door log shows one valid entry for two people.
5. Inside, they can plug a device into an open network port, take papers or use an unlocked PC.

A badge system only verifies the person who swipes.

Who it affects and how badly

• Sole trader to 10 staff. A shared office or serviced building is the weak point. A stranger in the room can take a laptop or phone.
• 10 to 250 staff. Accountancy and legal practices, recruiters and estate agents leave client files near reception. Schools, care homes and manufacturers have many entrances and visitors.
• 250 plus and regulated firms. Hospitals, councils, fintech and insurers must show who had physical access to systems with personal data. Server rooms and comms cupboards are the real prizes.

Worst case: a planted device or stolen equipment that goes unnoticed for weeks.

Real examples

No named victim is included. The sources we could find for named cases were not primary. CISA’s public guidance describes the underlying tactic: attackers posing as new employees or repair people, and building credibility from one contact to the next. Treat this entry as a pattern, not a case study.

How to detect it

• Door logs where one badge entry is followed by two people on camera.
• An unfamiliar face without a visitor badge or escort.
• New devices on network ports, unknown Wi-Fi access points or equipment in a comms cupboard.
• Reports of missing laptops, papers or visitor badges.
• Door alarms for doors propped open or held open too long.

How to fix or prevent it

1. Make a clear rule: one badge, one person, every time.
2. Use turnstiles, airlock doors or door sensors where traffic is high.
3. Give every visitor a badge and an escort, and sign them in and out.
4. Agree a polite challenge, “Can I help you? Who are you here to see?”, and back staff who use it.
5. Lock server rooms and comms cupboards separately.
6. Disable unused network ports, and use 802.1X on the rest.
7. Lock screens when leaving a desk.
8. Test it with written permission, and cover it in awareness training.

Related terms

• Social engineering
• Pretexting
• Baiting
• Impersonation of IT support
• Vishing
• Phishing simulation

FAQ

What is the difference between tailgating and piggybacking?
Usually tailgating means following without the person noticing, and piggybacking means being knowingly let in. Many sources use them interchangeably.

Does a badge system stop tailgating?
Not on its own. It logs the person who swipes, not the person who follows.

How can a business reduce tailgating?
Use one-badge-per-person rules, escorts, turnstiles or sensors, and train staff to challenge politely.

Sources

• https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks
• https://www.doppel.com/doppel-pedia/what-tailgating-attack
• https://www.trendmicro.com/en_us/what-is/social-engineering/what-is-tailgating.html
• https://www.sentinelone.com/cybersecurity-101/identity-security/tailgating-attack/

How Wolfcore helps

Phishy runs realistic phishing simulations against your own staff and shows you who clicked, so you can train the people attackers target. See Phishy phishing simulation.