Tailgating and piggybacking are physical security bypass techniques where an unauthorized person follows an authorized individual through a secured access point. Tailgating occurs without the authorized person's knowledge, while piggybacking involves the authorized person knowingly allowing entry, often out of politeness or social pressure.
Attackers position themselves near secured entrances and time their approach to coincide with an authorized person's entry. Common tactics include carrying boxes or equipment that make it difficult to badge in, appearing to talk on a phone while following closely behind, wearing clothing matching the organization's dress code or vendor uniforms, and timing arrival with shift changes when many people enter simultaneously. Social pressure is the primary tool: most people feel uncomfortable confronting someone or closing a door in another person's face. Advanced techniques combine tailgating with pretexting, where the attacker engages the authorized person in conversation to establish rapport before reaching the access point.
Physical access bypasses all digital security controls. Once inside a facility, attackers can access unlocked workstations, install hardware implants, connect to internal networks, steal documents, and plant surveillance devices. Many organizations invest heavily in digital security while maintaining weak physical access controls. Tailgating is one of the simplest and most consistently successful techniques in physical penetration testing.
CDA covers tailgating within the SPH and IAT domains as part of physical security assessment. Theater missions include physical penetration testing scenarios where operators must gain facility access. Our training emphasizes that physical security requires the same operational discipline as digital security, and that culture rather than technology is the primary defense.