One is a security breach the authorized person never saw happen. The other is a favor the authorized person chose to do. Treating them as the same problem is why sensor technology alone never fully solves either.
In casual conversation, "tailgating" and "piggybacking" get used interchangeably — both describe a second person getting through a secured door on someone else's credential. In physical security engineering, that interchangeability is a mistake, because the two scenarios differ on exactly one variable that determines what actually fixes them: does the authorized person know it's happening?Get that variable wrong and you'll spend a security budget on sensors and interlocks that were never going to solve the problem you actually have.
Tailgating is an unauthorized person following an authorized person through a secured door without the authorized person's knowledge or consent. The authorized person badges in and walks through, entirely unaware that someone slipped in behind them before the door swung closed. Nobody made a conscious decision to let the second person in — the authorized credential-holder did nothing wrong knowingly, but the unauthorized person still gained access they weren't entitled to. It is a genuine, unwitting security breach. Piggybacking is a follower entering through a secured door withthe authorized person's knowledge and active cooperation. The authorized person deliberately holds the door open — often out of simple courtesy: for a coworker whose hands are full of boxes, for someone who says they "forgot their badge," or just for a familiar face walking up right behind them. The person being let in may not actually be authorized for that specific access point at all, but the act itself is willing and conscious on the credential-holder's part, not a breach they were unaware of.
Tailgating happens entirely outside the authorized person's knowledge, which means the only things capable of stopping it are systems that don't depend on that person noticing anything at all — a mantrap that makes simultaneous dual-door passage mechanically impossible, a turnstile that counts bodies with an infrared beam, a sensor that flags a second entry on one credential. Piggybacking, by contrast, happens because the authorized person is actively, knowingly cooperating — usually out of ordinary politeness, not malice. A technical countermeasure that depends on that same person's cooperation to work (an alert they can silence, a door they can prop, a sensor they can wave off as "just my coworker") is fighting the exact behavior it's trying to prevent. That's why piggybacking is best addressed with security awareness training and a workplace culture where asking a follower to badge in themselves is normal and expected — not treated as rude — while tailgating is best addressed with physical and detection engineering. They sit on opposite sides of the technology-vs-culture line, even though they can look identical from three feet away.
False, or at least badly incomplete. Tailgating happens without the authorized person's knowledge, which makes it a genuine detection/physical-prevention problem — sensors, mantraps, and turnstiles can meaningfully address it precisely because the countermeasure doesn't need that person's cooperation to function. Piggybacking happens withthe authorized person's active, willing cooperation, which makes it fundamentally a human-behavior, training, and culture problem. An authorized person who wants to hold the door for a coworker carrying boxes can often simply override, ignore, or talk their way past a technical countermeasure — silencing an alert, propping a door, waving off a "second body detected" warning as a false alarm — out of ordinary habit or politeness. An organization that only invests in anti-tailgating sensor technology while ignoring piggybacking's human dimension will still have a real security gap: willing cooperation from an authorized person can defeat many technical countermeasures that ultimately rely on that same person following the security process. Closing that gap takes security awareness training and a culture where asking a follower to badge in themselves is normal, not detection hardware alone.
Explains the real distinction between tailgating (an unauthorized person following an authorized person through a secured door without that person's knowledge) and piggybacking (a follower entering with the authorized person's active, willing cooperation) — and why conflating them leads to the wrong countermeasure: tailgating is a detection/physical-prevention problem, while piggybacking is a human-behavior, training, and culture problem.
Tailgating occurs when an unauthorized person follows an authorized person through a secured door without the authorized person's knowledge or consent. The authorized person badges in and walks through normally; the unauthorized person slips in behind them before the door closes, and the authorized person never becomes aware anyone followed them in at all. The authorized credential-holder did nothing wrong knowingly — but the unauthorized person still gained access they weren't entitled to, making this a genuine security breach that happened entirely outside anyone's conscious decision-making.
Piggybacking occurs when a follower enters a secured door with the authorized person's knowledge and active cooperation. The authorized person deliberately holds the door open for someone else — often out of simple courtesy, for a coworker carrying boxes, someone who says they forgot their badge, or just a familiar face walking up behind them. The person being let in may not actually be authorized for that specific access point, but the act itself is a conscious, voluntary choice by the credential-holder, not something that happened behind their back.
Because tailgating happens without the authorized person's awareness, it is fundamentally a detection/physical-prevention problem: the fix has to be a system — sensors, mantraps, turnstiles — that can catch or physically prevent the unauthorized follow-through without depending on anyone noticing. Piggybacking, by contrast, is fundamentally a human-behavior, policy, and training problem: the authorized person is knowingly and voluntarily letting someone else in, often out of genuine politeness, so a purely technical countermeasure — a sensor that alerts on a second body, for instance — doesn't reliably solve it, because the authorized person can simply ignore, silence, or override the alert out of habit or courtesy.
An organization that invests only in anti-tailgating sensor technology while ignoring piggybacking's human and cultural dimension still has a real security gap. Willing cooperation from an authorized credential-holder can defeat many technical countermeasures that ultimately rely on that same person following the security process as designed. Effectively addressing piggybacking requires security awareness training and a workplace culture that makes it socially normal — even expected — to ask a following person to badge in for themselves, not just better sensors at the door.
Not necessarily in terms of security consequence — the same unauthorized person ends up on the secured side of the door either way. What differs is the mechanism and therefore the fix: tailgating is unwitting and needs detection/physical-prevention technology, while piggybacking is willing and needs training and culture change. Both can result in an equally serious security incident if the person let in has bad intent.
Only partially, and only if the technology forces a hard one-body-per-credential rule that the authorized person cannot override. A basic optical turnstile that simply alarms on a second body is easy for a willing, cooperating authorized person to talk past, hold open through, or have staff wave off as routine. A true mantrap interlock is harder to defeat even with cooperation, but organizations still need policy and training so staff don't attempt to prop doors or double-badge for a follower in the first place.
Security awareness training paired with a workplace culture that makes "please badge in yourself" a normal, non-awkward thing to say — not a breach of politeness. Employees need to understand that letting someone in as a favor can bypass the entire access control system, and they need social permission to decline the favor without feeling rude.
It can help at the margins — a sensor that alarms on a second body at least creates a moment where staff or security could intervene — but it does not solve the underlying problem, since the authorized person's active cooperation (holding the door, ignoring the alarm, vouching for the follower) is exactly the behavior the sensor is trying to catch. The sensor detects the event; it doesn't change the willingness that caused it.
Look at the authorized person's body language and attention at the moment of entry. In tailgating, they walk through facing forward, at a normal pace, with no acknowledgment of anyone behind them. In piggybacking, they typically turn back, make eye contact, hold the door wider or longer than needed, or gesture the follower in — visible signs of a conscious, cooperative act rather than an unnoticed one.
Try our Physical Security Studio
More calculators, simulators, and guides for this discipline.