What is tailgating?
Tailgating is getting into a secured area by following someone who is allowed in. The intruder times their approach to catch a badge-controlled door before it closes, or walks closely behind an employee through a gate or turnstile, and the authorized person doesn't realize anyone followed them. It is one of the simplest physical attacks, and it defeats locks and badge readers without touching them, because the door opens for whoever is standing there once a valid badge is read.
Tailgating vs. piggybacking
Piggybacking is the same entry with the authorized person's consent. The employee holds the door because the stranger is carrying boxes, wears a delivery uniform or says they left their badge at their desk. That makes piggybacking a social engineering success as well as a physical one. Some sources use the two terms as synonyms. When both appear as answer options, consent is the deciding detail: no consent is tailgating, consent is piggybacking.
Indicators that someone tailgated
- More people on camera passing through a door than badge reads recorded for it.
- Door-held-open alarms, which fire when a door stays open longer than its configured time.
- Anti-passback violations, such as a badge used to exit an area it never entered, which suggests the holder came in behind someone else.
- A person in a secure area with no badge, or with a badge that isn't valid for that area.
- Employees reporting someone they didn't recognize close behind them at a door.
Example scenario
At 8:52 a.m., a man in a courier jacket carrying three boxes reaches a side door as an employee badges in, and he walks in behind her before the door closes. Twenty minutes later he leaves without the boxes, and a small device is plugged into a network jack under a desk in the finance office. The badge system shows one read; the camera shows two people. The physical attack opened the way to a technical one, which is why disabling unused switch ports and requiring 802.1X still matter inside a locked building.
How to prevent tailgating
- Access control vestibules, formerly called mantraps, use two interlocked doors, so the inner door won't open until the outer one has closed. Occupancy sensing confirms only one person is inside.
- Full-height turnstiles and security revolving doors admit one person per authentication, and optical turnstiles alarm when two people pass on one read.
- Guards at entrances check everyone who passes.
- Anti-passback rules stop one badge from being handed back to let a second person in.
- Security awareness training and a visible badge policy teach employees not to hold secure doors and give them a reason to challenge someone. Training matters most against piggybacking, where the employee chose to open the door.
Cameras record tailgating but don't stop it, and a badge reader alone opens the door for whoever is standing behind the badge holder.
Tailgating on the CompTIA Security+ exam
SY0-801 objective 2.5 lists tailgating among the physical attacks, and because it is a scenario objective you need to recognize it from its indicators and choose the control that stops it. A stranger who slipped in behind an employee who didn't notice is tailgating; an employee who held the door is piggybacking. When a question asks for the BEST control, pick one that physically limits entry to one person, such as an access control vestibule or a turnstile, rather than a camera that only records the problem. Shoulder surfing, skimming and forced entry are the usual neighboring distractors, and a door-forced-open alarm with no badge read points to forced entry instead. Tailgating also appears in A+ Core 2 (220-1202) objective 2.5.