What Is Piggybacking in Cybersecurity? Risks, Examples, and Prevention
What Is Piggybacking in Cybersecurity? Risks, Examples, and Prevention
Piggybacking in cybersecurity is a physical security threat in which an unauthorized person gains entry to a restricted area by following someone who is authorized to enter. It can look harmless: a person carrying boxes asks you to hold the door, or someone in business attire walks in closely behind an employee using a badge.
But a single unverified entry can put company equipment, data, systems, and people at risk.
Also called tailgating, piggybacking relies on human politeness and distraction rather than breaking a lock or stealing a password. The U.S. Cybersecurity and Infrastructure Security Agency describes tailgating—sometimes called piggybacking—as an unauthorized person following an authorized individual into secured premises.
How piggybacking works
A piggybacking attempt usually follows a simple pattern:
- An authorized employee opens a controlled door with a keycard, mobile credential, or biometric check.
- An unauthorized person positions themselves close behind that employee.
- The employee holds the door open or assumes the person has permission to enter.
- The unauthorized person reaches a secure workspace without presenting credentials.
The attacker may pretend to be a visitor, delivery driver, contractor, new employee, or IT technician. They may use props such as a uniform, clipboard, package, or coffee tray to appear legitimate.
Piggybacking vs. tailgating: is there a difference?
The terms are often used interchangeably. Some security teams use “piggybacking” when the authorized person knowingly lets someone through, while “tailgating” describes someone entering without that person noticing.
In practice, the risk is the same: a person bypasses the organization’s access-control process. For this reason, policies should focus on verifying access rather than debating terminology.
Why piggybacking is a cybersecurity risk
Physical access can quickly become a digital security incident. Once inside a restricted office, server room, data center, laboratory, or operations facility, an intruder may be able to:
- Steal laptops, mobile devices, documents, or storage media.
- View confidential information on unattended screens or desks.
- Plug malicious devices into a network.
- Access printers, network ports, servers, or backup equipment.
- Impersonate an employee to gain further access.
- Damage systems or disrupt business operations.
NIST identifies tailgating as a social-engineering technique and recommends that organizations verify physical access authorization, maintain access logs, and escort visitors in sensitive facilities.
Common piggybacking examples
- Following an employee through a badge-controlled door – An individual waits near an office entrance at a busy time, then walks in immediately after an employee scans their badge.
- Pretending to be a delivery worker – Someone carrying a package asks an employee to hold the door. The employee, wanting to be helpful, allows them inside without checking identification.
- Using a crowded entry point – During shift changes, meetings, or events, people may enter in groups. An unauthorized person can blend in with the crowd and avoid credential checks.
- Claiming to be a vendor or IT contractor – An attacker may say they are there to repair equipment, inspect a system, or meet a colleague. Without verification, this pretext can grant access to sensitive areas.
How to prevent piggybacking
The strongest defenses combine thoughtful facility design, reliable access controls, and a workplace culture that makes security checks normal.
1. Require every person to use their own credential
Employees should never allow someone else to enter a controlled area on their badge, key, or biometric authentication. Each person should scan their own credential, even during busy periods.
A simple rule works well: No badge, no entry.
2. Train employees to challenge politely
Security awareness training should give employees language they can use without creating unnecessary conflict. For example:
“Hi—our policy requires every visitor to check in. Let me help you find reception.”
Employees should know how to report suspicious behavior and feel supported when they follow access policies.
3. Use visitor management procedures
Visitors, vendors, and contractors should be identified, registered, issued temporary credentials when appropriate, and escorted in sensitive areas. Keep visitor records current and deactivate temporary access promptly.
4. Install anti-tailgating controls
For higher-risk entrances, use controls that restrict passage to one person at a time. Options include turnstiles, optical lanes, access-control vestibules, security guards, and door alarms.
NIST notes that access-control vestibules with interlocking doors can help prevent more than one person from entering after a single authorization.
5. Review physical access logs and footage
Access logs, security cameras, and incident reports can reveal patterns such as repeated failed attempts, unusual entry times, or doors being held open too long. Regular review helps security teams identify gaps before they become serious incidents.
6. Secure sensitive areas separately
Not every employee needs access to every room. Server rooms, records storage, laboratories, executive areas, and network closets should have additional controls based on the sensitivity of the assets inside.
Building a security-conscious culture
Technology matters, but piggybacking is fundamentally a people-focused risk. Employees are more likely to follow procedures when they understand why the policy exists and when security leaders model the behavior themselves.
Avoid blaming employees for honest mistakes. Instead, make secure behavior easy, repeatable, and expected. Clear signage, simple reporting channels, regular training, and visible leadership support all make a difference.
Final thoughts
Piggybacking in cybersecurity is easy to overlook because it often begins with an everyday courtesy. Yet physical access can expose an organization’s people, facilities, devices, and data. By requiring individual credentials, verifying visitors, training employees to respond confidently, and using appropriate physical controls, organizations can reduce this risk without making the workplace unwelcoming.