How to Prevent Tailgating in Your Office

Published on 10/21/2026 • Updated on 10/23/2026

A building's CCTV, reviewed after a laptop theft, shows the thief entering at 10:42 AM. He does not force a door, clone a card, or do anything cinematic. He simply walks in behind an employee, who holds the door with the automatic courtesy everyone extends to a person carrying a pizza box. Twenty seconds of footage, one polite gesture, and the building's entire access control investment is defeated by manners. The security head's report contains a sentence that should be printed above every turnstile in the country: the system worked exactly as designed; the design assumed people would be rude to strangers.

Tailgating (and its cousin, piggybacking, where the insider knowingly lets someone in) is the most common physical breach precisely because it exploits courtesy rather than hardware. This guide covers where it actually happens, the layered controls that work (policy, culture, technology), and how to measure whether any of it is working. It pairs with our guide on preventing visitor buddy punching and our face recognition analysis.

Where tailgating actually happens

Not at the main gate, which everyone watches. The breach points are the polite ones. The lobby door at lunch hour, when a queue of employees badges in and each holds the door for the next. The smoking-zone door, which opens from outside with a badge and stays open while three people file back in. The fire-exit stairwell door someone wedges for a delivery. The service corridor the housekeeping vendor uses, whose latch has been "getting fixed" for a quarter. And the visitor route itself: a checked-in visitor who simply keeps walking past reception into the floor, having been verified but never escorted.

The pattern worth internalising: tailgating follows the path of least social friction, not least physical resistance. A determined intruder case-studies your building the way your own team never does: which door opens most often, who holds it, and what prop (pizza box, ladder, ID card worn backwards on a lanyard) makes holding it feel natural. Your counter-strategy starts from the same observation. Walk your own perimeter at 1 PM on a weekday and watch the doors for ten minutes each; the building will show you its breach points without any technology at all.

The policy and culture layer

Technology without culture produces a brief, expensive improvement and then regression, because the courtesy instinct does not retire. The culture change has three parts, and each has a failure mode worth naming.

The technology layers

Measuring whether it works

You cannot manage "it feels safer". Three practical measures. Door-held-open alarm counts per door per week, trended; a rising alarm count at one door is a culture problem with an address. Periodic challenge tests: an authorised tester attempts a tailgate monthly and records whether anyone intervenes; the intervention rate is your true culture metric, and publishing it (anonymised) improves it faster than any memo. And unescorted-visitor sightings logged by floor staff, which should trend to zero once the escort workflow is real.

Review the three monthly with security and facilities, and expect the first quarter to look worse than the baseline, because measurement reveals what courtesy was hiding. That is progress, not regression. The buildings that catch tailgaters are not the ones with the most incidents; they are the ones whose incidents are finally visible.

A thirty-day rollout that sticks

Week one is observation only: the door watches, the alarm-count baseline, and a list of the three worst doors. Announcing nothing yet is deliberate; a policy announced before the baseline invites everyone to claim the problem is exaggerated. Week two fixes the physics: un-wedge the stairwell, tune the held-open alarms, repair the service-corridor latch that has been "getting fixed" since last quarter. Week three is the culture launch: onboarding script, the standard phrase, the forgotten-badge fast path, and a visible moment of leadership compliance at the busiest door at the busiest hour.

Week four is the first challenge test and the first honest numbers. Publish the intervention rate and the alarm trend to the floor managers, not as blame but as the scoreboard it is. Buildings that run this cycle report the same arc: alarm counts spike in week two as measurement turns on, fall through the quarter as the culture layer bites, and settle at a low steady state that the challenge test then keeps honest. The pizza-box walk does not survive a building that knows its own doors.

Reader Q&A

Bottom line

This week, do the ten-minute door watch: lobby at lunch, the smoking door, the stairwell. Count the holds. That count is your baseline, and it cost nothing to collect.

This quarter, attack in order: culture script and forgotten-badge path first, door discipline and anti-passback second, detection third. The pizza-box walk works because it is polite; the counter is a building where security is also polite, and just as automatic.