Tailgating prevention at UK workplace entrances

A card reader cannot stop an unauthorised person following someone through an open door. Effective tailgating prevention combines reliable door closure, individual entry checks, controlled visitors and a clear response when something goes wrong.

Workplace physical security may include badges, CCTV and reception staff, while side entrances or delivery routes remain poorly controlled. An unauthorized person may pass through an uncontrolled entrance. The practical test is whether each person crossing a secure boundary has permission to enter.

Start with the routes people actually use, then assign responsibility for the checks, exceptions and response.

Key takeaways for workplace managers

• Require each person to use their own credential at controlled entrances, with a documented process for visitors, escorts and forgotten passes.
• Inspect doors, gates and barriers under normal operating conditions, including busy arrivals, deliveries and reduced staffing.
• Give reception staff and hosts clear responsibility for visitor approval, temporary access, escorting and departure records.
• Distinguish equipment that detects extra entrants from equipment designed to physically restrict their passage.
• Train employees to report concerns without confronting, pursuing or attempting to restrain an unfamiliar person.
• Keep emergency escape and accessible entry arrangements effective when introducing or changing security controls.

These measures need a named owner and a working escalation route. A door-held-open alert has limited value if nobody receives it during lunch cover or after reception closes.

Apply controls according to the consequence of unauthorised entry. A public reception, staff office and server room do not need identical arrangements.

Understand tailgating and piggybacking

Tailgating happens when someone follows an authorised person through a controlled entrance without receiving their own permission. The weakness is the passage through the boundary, not necessarily a stolen or copied pass.

Consent changes the description, not the access decision

Many organisations distinguish tailgating from piggybacking. Tailgating means following without the authorised person’s knowledge; piggybacking means entering with that person’s knowledge or consent.

The distinction is useful for training, but terminology varies. NIST’s PE-3(8) control describes the activity using both terms together.

Define the terms in the workplace policy, then state the operational rule. An employee’s willingness to hold a door does not give a stranger permission to enter a restricted area. Permission must come through the site’s approved process.

A recorded swipe proves less than it appears

An access event normally records a credential presented at a reader. It does not establish how many people crossed the doorway or whether they stayed within their permitted area.

Unauthorised entry can lead to a security breach, theft, intimidation, access to confidential documents or interference with IT equipment. Internal boundaries matter alongside the external entrance.

CybeReady repeats a SACS Consulting report that 71% of security personnel considered their company likely or very likely to suffer a data breach through tailgating. SACS described a survey of 185 US and Canadian security personnel conducted by Boon Edam.

That older finding records respondents’ assessment of risk. It is not a UK breach rate or evidence that 71% of businesses have suffered such an incident.

Map actual entry routes before buying equipment

A front entrance review is incomplete if contractors can enter through a loading bay or employees return through an unsecured smoking-area door. Walk the full route from the public boundary to sensitive areas and record every entry point.

Include shared corridors, stairwells, car parks, bin stores and entrances used outside normal reception hours. Record where control changes between the employer, landlord and managing agent.

Observe the building when it is working

The facilities lead should inspect entry during morning arrivals, shift changes, lunch breaks, deliveries and late working. A door that closes reliably in an empty lobby may remain open through a queue.

Record what happens rather than relying on the written procedure. Who admits an unannounced contractor? Where does a courier wait? Can a person reach a communications cabinet before meeting anyone responsible for access?

Inspect lighting after dark where relevant. Glare, reflections and poor positioning can prevent staff or cameras identifying an approaching person, even where lighting is installed.

Rank exposure by consequence and opportunity

Compare the likelihood of unauthorised entry with what an entrant could reach. A route into a public waiting area presents a different exposure from direct access to payroll records or engineering systems.

Use incident logs, access permissions, maintenance records and CCTV coverage maps to support the assessment. Include unsuccessful entry attempts and recurring exceptions, not only confirmed losses.

A wider review of business access control measures should connect the entrance with internal permissions, monitoring and response.

Assign each weakness an owner, corrective action and completion date. Separate immediate faults, such as a failed latch, from changes requiring design work. The record should show why each action received its priority.

Set clear daily entry procedures

Staff need an entry rule they can follow without negotiating it at every doorway. Require personal credentials at controlled entrances and explain how approved visitors or assisted entry are handled.

Apply the same rule to managers, agency workers, cleaners and regular contractors. Familiarity with a person does not establish their current access rights.

Make individual entry the normal process

Where safe, employees should check behind them when passing through a secure door, gate or barrier to prevent tailgating. They should confirm the door closes properly and avoid physical confrontation.

Provide a standard instruction for someone requesting entry: “Please use reception so access can be authorised.” Keep the route to reception clear and usable.

Explain the boundary between everyday courtesy and controlled access. Holding a public lobby door is different from admitting someone through a staff-only entrance. Where someone needs assistance, use the approved process rather than abandoning the access check.

Provide workable exceptions

A forgotten-pass procedure should establish identity and authority before issuing time-limited access. Reception should record the temporary credential, responsible approver and expiry.

Lost credentials need prompt reporting and cancellation. Staff should not borrow a colleague’s pass while waiting for a replacement, because that makes the access record unreliable.

Assign HR responsibility for notifying relevant departures and role changes. Assign the access administrator responsibility for changing permissions at the required time.

Record exceptional access outside normal hours, including the person approving it and the areas permitted. An exception should have a defined end, not become an indefinite permission because nobody removed it.

Make doors close, latch and report faults

A controlled door left open provides an unrestricted route through the boundary. Propping it open removes the entry-control function without requiring deception, a copied credential or any interaction with staff.

Inspect the complete closing cycle

The facilities team should check the door leaf, frame, hinges, closer, latch, door locks and position sensor together. Watch whether the door closes and secures without someone pulling it into place.

Investigate slow closing, rebound, misalignment and doors obstructed by mats or stored equipment. Check gates and external barriers under the weather conditions they normally face.

Don’t shorten closing times indiscriminately. The door must remain safe for its users, including people with reduced mobility. The NSI’s guidance on access control and safe escape highlights the relationship between security hardware and escape arrangements.

Treat repeated propping as an operating problem

A wedge may indicate a delivery process, ventilation problem or queue that the current arrangement cannot accommodate. Remove the obstruction, then address the reason it appeared.

Where appropriate, configure separate alerts for a door held open too long and a door forced open without authorisation. These events require different investigation and maintenance decisions.

Alarms can also be configured to sound when more than one person passes through a monitored entrance. State who receives the alarm and what action follows.

Record recurring faults against the specific door. Treat inspection and repair as one of the site’s security measures. Repeated resets without repair leave the exposure unchanged. A temporary staffed post may be appropriate while a high-risk entrance remains defective, provided the arrangement has a clear end and handover.

Control visitors, contractors and deliveries

Visitor management should establish who is arriving, why they need access, who approves it and where they may go. Recording a name after entry does not perform those checks.

Include interview candidates, maintenance workers, couriers and contractors arriving before reception opens. Give each category a defined arrival route and waiting point.

Separate arrival from permission to enter

Reception should match planned visitors with an appointment or obtain approval through an established internal contact. An unexpected arrival should remain in the designated public area while that decision is made.

Hosts should provide accurate booking details and collect visitors where escorting is required. Temporary credentials should expire and open only the areas necessary for the visit.

Contractor checks may include the work order, responsible manager, induction and relevant site permissions. Access approval does not replace any separate safety authorisation required for the work.

Record departures and outstanding passes. A visitor list should support accountability, but its accuracy depends on checkout and host reporting.

Remove the delivery-driver pretext

CybeReady describes a pretext in which someone poses as a delivery driver, carries boxes and asks an employee to hold the door. The apparent task creates visual legitimacy and pressure to help.

Route deliveries to a receiving point where goods can be accepted without granting access to staff areas. Give drivers a defined place to wait and a named contact for unusual deliveries.

Work clothing, branded packaging and equipment are not proof of an approved visit. Apply the same approval process to a contractor who appears familiar with the building.

Where items genuinely require movement beyond reception, arrange an authorised escort or receiving team. Do not rely on whichever employee happens to pass the entrance.

Review the arrangement during busy delivery periods. If drivers repeatedly wait beside a staff door because the receiving point is unattended, the layout is encouraging the behaviour the policy prohibits.

Make tailgating prevention part of staff training

Training should explain the decision employees need to make at the doorway. A general instruction to “be vigilant” leaves too much uncertainty about visitors, colleagues without passes and people asking for help.

Practise requests that bypass the normal process

Include requests based on urgency, apparent authority, familiarity or inconvenience. Staff should recognise that a persuasive explanation still requires the correct access approval.

Year-round security awareness training can connect physical entry with wider social engineering. Simulated phishing may help staff recognise requests that bypass a procedure, but it doesn’t replace physical-entry practice.

Use short security training briefings at induction and after relevant incidents or changes. Temporary reception cover, cleaners and agency staff need instructions suited to the entrances they use.

Explain that politeness is compatible with refusal. Directing someone to reception should be a routine action supported by managers, not a personal accusation.

Test reporting without rewarding confrontation

Employees should know the reporting number, the information security needs and the safe action to take while waiting. Include arrangements for lone workers and staff using remote entrances.

Any exercise should be authorised, risk-assessed and supervised. Define its scope, stop conditions and handling of personal information before it begins.

Assess whether staff used the reporting route and whether the receiving team responded. Don’t treat an employee’s refusal to confront an unfamiliar person as a training failure.

A successful report can expose a failed control. Low reporting figures alone don’t establish that an entrance is secure.

Use findings to improve procedures and coverage. Publicly blaming individuals can discourage the reporting needed to identify repeated weaknesses.

Understand what credentials and anti-passback cannot do

Access control decides whether a credential may release a door. Tailgating exploits the period after release, when another person can cross without presenting a credential.

The distinction matters when choosing access control entry systems. More sophisticated authentication does not automatically provide better control over the number of entrants.

Use anti-passback for credential sequence control

Anti-passback detects or prevents credential use that breaks an expected sequence. A common example is an attempted second entry without a recorded exit between the two events.

Depending on configuration, the system may deny access or record the violation for investigation. It can discourage pass sharing and expose inconsistent credential use.

It does not detect someone following a valid cardholder without presenting a credential. That person creates no credential event for anti-passback to analyse.

Set a clear procedure for sequence errors. Legitimate missing events, outages and assisted passage need controlled correction rather than routine overrides that undermine the rule.

Restrict permissions beyond the front entrance

Give employees and contractors access according to their role, location, working hours and task. A contractor admitted to a plant room should not receive unrestricted access across an office floor.

Additional authentication may be appropriate for higher-risk rooms. Biometrics or a second factor can strengthen the identity check, but neither necessarily counts the people passing through an open door.

Retain internal boundaries around server rooms, communications cabinets, cash offices and sensitive records. These controls limit the consequence of an outer-door failure.

Review permissions after transfers, project completion and departures. A person using a valid but unjustifiably broad permission is an access-governance problem, even where no tailgating occurs.

Compare entrance controls by function and traffic

Choose equipment according to the required outcome: detect an extra entrant, delay passage or physically restrict it. These functions are different.

The following comparison describes relative commitments, not installation prices or guaranteed throughput.

The useful comparison is total operating commitment, including staffing, maintenance, integration and exception handling.

Distinguish optical detection from a physical barrier

Optical turnstiles use arrays of infrared beams to detect movement through a lane. Their effectiveness depends on configuration, spacing and actual pedestrian flow.

A barrier-free configuration can generate an alarm when an additional person enters, but it cannot physically stop that person. Security must receive and act on the alert.

Where barriers are fitted, assess their safety behaviour alongside the security function. A lane that creates frequent stoppages may encourage staff to use an uncontrolled alternative.

Specify a security revolving door, not an ordinary one

Purpose-designed security revolving doors can detect an unauthorised follower and prevent the second person entering, including when closely following an authorised user. That capability depends on the equipment and configuration.

An ordinary revolving entrance should not be assumed to provide this protection.

Assess peak arrivals, available lobby space, luggage, mobility aids and delivery requirements together. An adjoining wide gate needs its own controlled procedure, or it can become the easiest route around the main installation.

Use vestibules where sequential entry is justified

Access control vestibules use two interlocking doors to create a controlled space between an entrance and the workplace. They can provide stronger separation than a single doorway, but they also affect how people move and how exceptions are handled.

NIST PE-3(8) identifies vestibules as a control for organisation-defined locations. It doesn’t require them at every workplace entrance.

Understand the normal operating sequence

In a typical arrangement, the outer door closes and locks before the inner door can release. Occupancy detection can check that the chamber contains only the permitted number of people.

Some one-person configurations keep both doors locked and alert staff when excess occupancy is detected. This is one possible design, not how every vestibule works.

Specify how the system distinguishes ordinary passage, an occupancy alarm, an equipment fault and an emergency. Staff need clear instructions for each state.

Treat an occupancy alert as a condition that needs assessment. It doesn’t prove that the people inside intended to breach security.

Plan assistance and safe release before installation

A vestibule must not create an uncontrolled risk of trapping or detention. Its design needs suitable communication, supervision and release arrangements, and must be compatible with emergency escape.

Account for wheelchair users, people who need assistance, guide dogs, parcels and authorised escorted access. Don’t apply a one-person rule blindly when someone needs an assistant.

Assign responsibility for remote assistance and attendance. An intercom is useful only if someone answers it throughout the entrance’s operating hours.

Seek competent security, fire-safety and accessibility advice if the design affects escape routes or assisted passage. Include these requirements in the design, not as a later workaround.

Connect CCTV and AI alerts to a response

A camera system can support observation and investigation, but recorded footage doesn’t prevent someone passing through a door. Automated detection adds value only when alerts lead to an appropriate action.

Understand what an AI tailgating alert establishes

Some systems receive a door-unlock signal from the physical access control system, then compare the number of people counted passing through with valid credential events. An excess count generates a tailgating alert for review.

The method identifies a possible mismatch. It doesn’t establish a person’s identity, access rights or intention.

Commissioning should account for the site’s real conditions: people walking closely together, changes of direction, bags, assisted entry and varying light. Authorised group passage also needs an agreed operating rule.

Keep camera and access-control clocks aligned so reviewers can compare events. Record the entrance, time, associated credential events and available video rather than relying on an isolated alarm description.

Assign the alert and its fallback

State who receives alerts, who reviews them and who can attend. Include cover for breaks, shift handovers, lone working and communications failures.

Set priorities according to location and consequence. A possible extra entrant into a server-room vestibule may require a different response from an ambiguous count at a staffed lobby.

Review false alerts by cause. Repeated nuisance alarms can make a genuine event easier to miss, but disabling detection without a replacement control leaves a gap.

Apply the ICO’s video-surveillance guidance to camera selection, use and governance. Define the security purpose, restrict access to footage and retain information according to that purpose.

Avoid expanding camera use into general employee performance monitoring without a separate assessment. A system introduced for entrance security shouldn’t acquire unrelated uses through habit.

Separate UK legal duties from security preferences

There is no general UK rule requiring every workplace to install turnstiles, biometric readers or vestibules. The appropriate security measure depends on the site’s risks and any relevant sector, contractual or insurance requirements.

Individual credential use, monthly inspections and quarterly permission reviews are practical operating choices. They shouldn’t be presented as universal statutory requirements.

Keep escape and accessibility effective

Security controls mustn’t prevent safe emergency escape. Government guidance on fire-safety duties explains that doors forming part of the means of escape should be immediately openable without a key or code.

The Regulatory Reform (Fire Safety) Order 2005 applies in England and Wales. Scotland and Northern Ireland have separate fire-safety legislation, so responsibility and design decisions need the correct jurisdictional basis.

Don’t add padlocks, improvised restraints or delayed release arrangements to escape doors as a quick security fix. Agree any change through the building’s fire-safety arrangements.

Accessible entry also needs proper provision. In Great Britain, relevant duties include reasonable adjustments under the Equality Act 2010; Northern Ireland has separate disability discrimination legislation. Security procedures should accommodate authorised assistance without making an uncontrolled entrance the default.

Govern entry records and surveillance

Access logs, visitor records and identifiable recorded footage can contain personal data. Their collection and use require an appropriate lawful basis, clear information, proportionate retention and suitable protection.

The GOV.UK guidance on workplace video surveillance sets out basic obligations for business use. Explain monitoring to staff and visitors, and restrict access to people who need the information.

Face recognition introduces different issues from counting anonymous movements through a doorway. Biometric data used to uniquely identify someone receives additional protection under data protection law.

Complete a data protection impact assessment where processing is likely to create high risks to individuals. A purchase described as “AI security” doesn’t remove the employer’s responsibility for how it’s deployed.

Give staffed security a defined entrance role

A staffed entrance can assess unusual requests, manage exceptions and respond to alarms. Its effectiveness depends on the post instructions, visibility and available cover.

A receptionist handling calls and visitors may not be able to observe a separate staff entrance continuously. Define the responsibility rather than assuming presence provides coverage.

Match coverage to the exposed period

Use arrival patterns and incident records to identify when security guards need to supervise an entrance directly. This may include shift changes, evening access, large deliveries or continuous operation.

A comparison of static guards and mobile security patrols should distinguish continuous entrance control from periodic inspection. A patrol cannot continuously supervise an entrance while covering other areas.

Include meal breaks, sickness, alarm attendance and handovers in the coverage plan. If an officer leaves reception to investigate, assign someone else to the entrance or apply an agreed temporary arrangement.

Define authority and limits

Post instructions should state who approves access, who refuses it, who contacts hosts and when the incident lead takes over. Include the safe response to refusal, aggression and uncertain identity.

SIA licensing requirements depend on the activity and employment arrangement. Contracted security guarding against unauthorised access is generally licensable; ordinary reception work doesn’t automatically require a security licence.

Training or a licence doesn’t provide a general police power. Keep response instructions within the person’s role, authorisation and lawful powers.

Respond to suspected tailgating without confrontation

An employee who sees someone follow through a controlled entrance should report the location, time and direction of travel. Immediate personal safety takes priority over recovering a badge or proving that entry was unauthorised.

Give employees a short, safe response

Where safe, direct the person towards reception using a neutral instruction. An employee should not block their path, grab clothing, pursue them into an isolated area or attempt restraint.

If the person refuses, withdraw to a safe position and contact security or the appointed incident lead. Provide a factual description and identify any immediate risk.

An unfamiliar person without a badge may be an authorised visitor, a new colleague or someone whose badge is concealed. Report the observable issue rather than making assumptions based on appearance.

If there is immediate danger or a crime in progress, call 999 when safe. Procedures for managing aggressive visitors at work should cover withdrawal, assistance and protection of nearby staff.

Do not secure doors in a way that compromises escape or traps people during the response.

Give the incident lead responsibility for containment and evidence

Security should establish the person’s authority through approved records and contacts. Where appropriate, guide them to reception or arrange a trained response rather than leaving ordinary employees to manage the encounter.

Apply any protective restrictions selectively. Cancelling a compromised credential or securing an unaffected internal boundary may be appropriate; improvised building-wide locking can create additional risks.

Preserve relevant camera footage, access events, visitor records and witness accounts before routine deletion. Record the basis for the response and distinguish observations from assumptions.

After the immediate incident, establish how the boundary failed. Review door operation, credentials, visitor approval, staffing and alert handling. The corrective action should address that failure, with a named owner and a re-test date.

Audit the controls and close corrective actions

An audit should establish whether entry controls work in practice and whether failures receive a response. A collection of concerns without assigned action leaves the operating position unchanged.

Use a repeatable review cycle

For a typical office, monthly physical inspections, quarterly permission reviews and an annual full assessment provide a workable starting point. These are suggested intervals, not legal inspection frequencies.

Review sooner after an incident, refurbishment, new tenant, altered working hours, system outage or material staffing change. Match the frequency to the site’s exposure and equipment requirements.

Keep evidence proportionate: maintenance records, sampled access events, training attendance, authorised test results and completed action records. A photograph may show a repaired closer, but a closing-cycle test establishes whether the repair works.

Use this sequence for each failed check:

1. Record the entrance, observed fault, likely consequence and any immediate temporary control.
2. Assign a responsible owner, priority and completion date, including landlord or contractor responsibilities where relevant.
3. Record the completed repair, procedure change or training action with supporting evidence.
4. Re-test the control under representative conditions and close the action only when the result is satisfactory.

Measure performance without mistaking records for proof

Review confirmed unauthorised entry, suspected events, doors held open, alert response and repeated faults. Separate equipment failures from approved exceptions and inaccurate detection.

Compare similar periods and operating conditions. A rise in reported events after training may reflect better reporting rather than worsening behaviour.

Track queues and alternative routes as well. A new barrier may appear successful while people increasingly use an uncontrolled side entrance.

Include reception, facilities, IT, HR and the landlord where responsibilities overlap. The final review should establish who can enter, who responds to exceptions and whether overdue actions still expose the site.

Frequently asked questions

Which situations are not necessarily tailgating?

A visitor entering with an authorised escort under an approved procedure is not necessarily breaching access rules. The site may permit that passage without issuing the visitor a separate door credential.

The distinction is authorisation, not simply whether two people pass through together. A detection system may still raise an alert, which is why approved exceptions need clear handling.

Does every workplace need turnstiles or a vestibule?

No. A smaller workplace with limited footfall may manage its risk through reliable doors, supervised reception, controlled visitors and prompt reporting.

Higher-risk areas or busy entrances may justify stronger physical separation. The decision should reflect what an entrant could reach, how often the entrance is used and whether an effective response is available. Equipment should resolve an identified weakness rather than provide an impressive-looking lobby.

Can a visitor list prove who is inside?

A visitor list supports accountability only when arrivals, departures, escorts and unexpected changes are recorded accurately. It does not establish where each visitor is located.

Use the list alongside host responsibilities, emergency procedures and the site’s arrangements for staff and contractors. Do not treat an unchecked sign-in record as a complete occupancy count during an evacuation.

Is this the same as road tailgating?

No. Workplace tailgating concerns unauthorised passage through a controlled entrance. Road tailgating means following another vehicle too closely.

For the driving issue, National Highways’ tailgating advice covers maintaining safe separation. Avoid speeding up or brake-checking in response to a following driver, and allow a larger gap ahead. Those driving measures do not address physical access security at a workplace.

Make controlled entry a maintained process

Tailgating prevention depends on whether a secure boundary controls passage during normal work, busy periods and exceptions. Badges and cameras support that process, but their presence does not establish that it works.

Assign responsibility for each entrance, correct faults and re-test completed actions. Keep visitor approval, staff reporting and emergency escape within the same operating plan.

Begin with the highest-risk route and follow it through to the response. The control is complete only when the right person can identify a failure and act safely.