Tailgating Study: 74% of People Hold the Door Open for Strangers in Secure Buildings
Security consultants conducting red team assessments and formal studies consistently find that 70-80% of employees hold secure doors open for tailgaters — even when signs explicitly prohibit it and the stranger is wearing civilian clothes.
Background
Tailgating (or "piggybacking") — following an authorised person through a secure access-controlled door without badging — is one of the most consistently successful physical penetration techniques. Multiple red team assessments and formal studies have quantified the success rate.
The Attack
Security firm Boon Edam conducted a study at 10 companies and found that 74% of employees held secure doors open for strangers. Red team assessments by firms including Coalfire and Bishop Fox consistently report tailgating success rates above 70% in the first attempt. The social psychology is well understood: holding a door for someone who is carrying things, appears to belong, or who makes eye contact and smiles triggers the human instinct to be helpful and to avoid confrontation. Physical penetration testers report that wearing a high-vis vest, carrying a box, or appearing to struggle with the door dramatically increases success rates.
Response
Organisations install physical barriers (mantrap / airlock entries, turnstiles) to force individual badge access. Security awareness programmes train employees to challenge tailgaters and to not hold doors. Some organisations implement behavioural analytics on access control logs to detect tailgating patterns.
Outcome
Tailgating remains effective despite decades of awareness training because it exploits fundamental human social behaviours. Physical controls (mantrap entries) are more reliable than policy and training alone. Once inside a building, a tailgater can access terminals, conference rooms, server rooms, and other sensitive areas.
Key Takeaways
- Physical mantraps or turnstiles that permit only one entry per badge swipe are the only reliable anti-tailgating control
- Train employees to politely challenge anyone without a visible badge, even if it is socially uncomfortable
- Security guards at reception are a deterrent but not a complete control — most tailgating bypasses unmanned side entrances
- Combine physical access controls with visitor management systems so unregistered visitors cannot progress into secure areas