Tailgating is prevented by physical enforcement, not by awareness training. A turnstile that admits one person per badge cannot be talked out of it, which is the whole advantage over asking staff to challenge strangers.
Training still matters, but it carries a social cost the attacker relies on. Challenging a confident stranger carrying coffee feels rude, and penetration tests keep proving that politeness wins.
Documented cases
- Rapid7 got in on door-holding reciprocity alone, with no working credential.
- GAO repeatedly entered secure federal facilities using fabricated badges.
- Nations Title Agency is a reminder that the physical perimeter includes what leaves the building, not just who enters it.
The control that breaks it
- Install one-person-per-badge turnstiles at every staffed entrance.
- Escort all visitors, with a badge that looks obviously different.
- Remove the social cost: make “please use reception” the expected response, not an accusation.
- Test it. Physical tests find gaps that policy review never will.
Related: tailgating vs piggybacking · Physical social engineering
Related
Social Engineering Examples