What Is Tailgating in Cybersecurity

They’re closely related, but not quite the same. Tailgating usually happens without the authorised person realising someone has followed them in. Piggybacking is when access is knowingly allowed, like holding a secure door open for a colleague or visitor. From a risk point of view, both create the same problem: unauthorised physical access that can lead to cyber exposure. In practice, organisations need to address both through awareness and clear access rules.

I see this all the time. Tailgating works because it targets human behaviour, not technology. People are busy, polite, and often uncomfortable challenging others. Even in buildings with key cards, CCTV, and guards, attackers exploit routine moments like shift changes or peak entry times. If culture doesn’t support staff to question access confidently, the best systems in the world can still be bypassed.

Not on their own. Tools like access cards, cameras, and alarms help, but tailgating usually slips through the gaps between them. Once someone is inside, many digital defences assume the person is trusted. That’s why organisations focus on a mix of physical controls, staff training, and clear procedures. Technology supports prevention, but people are still the deciding factor in stopping tailgating.

Yes, it is. Tailgating is classed as a social engineering tactic because it manipulates human behaviour rather than hacking systems directly. Attackers rely on trust, authority cues, uniforms, or simple confidence to gain access. Understanding this helps people see that cybersecurity isn’t only about code or networks. It’s also about psychology, awareness, and how people behave in everyday situations.

They do, especially in larger organisations. While Cybersecurity Analysts may not manage doors or badges directly, they’re expected to understand how physical access links to digital risk. Tailgating often appears as part of incident investigations, risk assessments, or threat modelling. Knowing how a physical breach can lead to data loss or system compromise is an important part of doing the job well.

The first step is simply noticing behaviour. I always suggest paying attention to access points, asking who should be challenged, and understanding normal routines in a space. From there, learning the basics of physical security, social engineering, and real-world attack paths builds confidence. This kind of awareness is often where people first realise that cybersecurity is something they can genuinely learn and move into professionally.