Physical security · Security culture
The most effective way into a building needs no tools, no code and no card. It needs a cardboard box and an employee who is decent. This is how tailgating works — and why the access card does not stop it.
Christian Tang Mathiasen · · 7 min read
Most organisations spend a lot of money on the one metre where a door meets a frame. Card reader, electric strike, door automation, logging. All of it works exactly as it should. And it is still the way we most often get in.
Not because the technology fails. But because it only checks one thing: that a valid card was held up to a reader. It does not check how many people walked through the door afterwards.
Tailgating is following someone who has legitimate access through a controlled door — without having access yourself. Some people distinguish between tailgating, where you slip through without the other person really registering it, and piggybacking, where they actively hold the door open. In practice the distinction does not matter. The result is the same: there is an extra person inside the building whom nobody has recorded.
It is not an advanced technique. It is the most common entry in the entire trade, and it usually takes only three things: a reason to be there, something in your hands, and a moment when there is traffic. The morning rush at the main entrance. The smoking break at the back door. Five minutes before a meeting, when three guests arrive at once.
Tailgating does not work because people are stupid or indifferent. It works because they are decent — and because the arithmetic in the doorway is lopsided.
Seen from the person with a hand on the door handle, it looks like this: if I shut the door on a colleague, I am definitely being rude right now, to a human being standing half a metre away and looking straight at me. If I let a stranger in, something might happen at some point, which somebody else might find out about. One cost is immediate, social and concrete. The other is abstract and sits somewhere in the future. People choose the way they do because it is the rational decision in the situation.
We help the arithmetic along a little. A large cardboard box. Two cups of coffee. A coil of cable over one shoulder, a ladder, a hi-vis vest, a phone in hand and a busy expression. Props are not a disguise — they are a role. Nobody asks the man with the ladder what he is doing, because the ladder has already answered. And if you need both hands to carry something, it is almost rude of the other person not to hold the door.
A card reader authenticates a card. Not a person, and not a number of people. In the log, a successful tailgate looks like a perfectly ordinary working day: one card, one lookup, one door, one timestamp. There is no incident to investigate afterwards, because none was ever recorded.
Anti-passback — the rule that the same card cannot be used to enter twice in a row — helps against borrowed cards, but not against a person who never showed a card. Turnstiles, speed gates and mantraps genuinely do work. They are also expensive, slow and unpopular, which is why they rarely sit anywhere other than the main entrance. The main entrance is not the door we come in through.
The doors that carry us in are goods reception, the bicycle basement, the back door by the smoking area, the garage gate that stands open for five minutes at every delivery, and the fire door wedged open with an extinguisher because the warehouse gets too hot in summer. Reception is usually the best-trained control in the whole building. That is precisely why it is rarely the problem.
Countermeasures
None of them is about buying a more expensive lock. They are about making it easy to do the right thing — and hard to be polite in the wrong way.
The hard part about stopping a stranger is not the suspicion. It is finding the words without sounding unpleasant. So give your people the words: “Hi — I can’t see your badge. Come up to reception with me and we’ll sort it out.” That phrasing makes it a service rather than an accusation. Practise it out loud. People do not use a rule they have only read.
No employee should have to invent the rule in the doorway. Write it down, and have the leadership say it out loud — to guests, to suppliers, and to the leadership itself. Then the person who asks is not being difficult. She is doing her job. It is the cheapest security measure there is.
If the card reader is placed so that you need a hand free, people will hold the door for each other with their arms full. Readers at a sensible height, automation at goods reception, a parcel room by the entrance, a trolley for the heavy things. Many tailgating problems are really logistics problems that have ended up in a doorway.
A mantrap does not care whether your hands are full. That kind of measure belongs in front of what genuinely has to be protected — server rooms, plant rooms, laboratories, production — not necessarily at the main entrance. Add door contacts and alarms to the doors that get wedged open. They are easy to find: they are the ones with a wedge lying next to them.
Badges worn visibly by everyone, visitor badges that look clearly different, escorting in sensitive zones. The point is not the badge in itself. The point is that a person without one becomes something you can spot — and that noticing becomes normal.
Behaviour that is not measured exists only in the policy. When somebody stops us during a test, it goes into the report alongside the weaknesses — because a human being is the only control in the building that can react to something nobody anticipated. Say thank you publicly. Once is usually enough to shift the norm on a whole floor.
The best reaction we meet rarely looks dramatic. An employee walks along with us, asks politely, and stays put. She does not accuse, she does not leave the situation, and she does not hand it to somebody else. That is all it takes.
The second-best is good enough too: somebody is unsure and rings reception. Doubt is a perfectly valid reason to make the call.
The reaction that costs most is the half one. Somebody notices us, says nothing, and mentions it to a colleague over lunch. The organisation has in fact detected the intrusion — but the detection never became an incident. Detection that is not reported is not detection. So reporting has to be quick, easy and safe, and there must never be a raised eyebrow waiting for the person who called in vain. Do that once, and nobody calls again.
The aim is never to make a workplace cold, or to expose the person who held the door. We do not want people to stop holding doors for one another. We want them to hold the door and ask. The two do not exclude each other, and together they take four seconds.
The human factor can be the weakest link. With the right approach it can also become the organisation’s strongest defence — because a human being is still the only control in the building that can react to something nobody had foreseen.
Want to know how many steps into the building a polite stranger can get before anyone says anything? That is exactly what a Security Assessment or a physical penetration test measures — within agreed limits, and without anyone being hung out to dry.
Next step
A short conversation is enough to work out whether a Security Assessment or a full penetration test is the better fit. It costs nothing and commits you to nothing.