The short definition
Tailgating is the simplest possible access-control attack: a human follows another human through an opening before the lock re-engages. The credential is genuine, the door physically opens, and the unauthorized person walks through. It's the residual risk that survives every credential-strengthening upgrade. You can deploy mobile credentials with biometric MFA and still have an employee polite-hold the door for someone they don't recognize. That's why tailgating mitigation lives at the door, not in the credential: it requires either a physical control that prevents two-person passage or a detection control that flags it after the fact.
The four mitigation classes
- Mantraps. Interlocked door pairs that physically prevent two-person passage. Highest assurance, slowest throughput, most expensive. Variants include two-door vestibules, single-occupant booths with floor-weight sensors, and revolving security doors. See the mantrap entry. Standard at data center cages, federal facilities, and pharmaceutical clean rooms.
- Optical anti-tailgating sensors. Header-mounted laser or infrared beams create a curtain across the opening and count each passage; when the count exceeds badge swipes, an alarm fires and bookmarks the recording. Common modes catch two-pass-one-swipe, reverse passage, and door-held-open beyond a 15-to-30-second threshold. Brands: Newton (Boon Edam), Smarter Security, Allegion DSI. Faster and cheaper than mantraps. Standard at corporate office IDFs and after-hours lobbies.
- Turnstiles. Optical or speed gates that physically meter one person per credential. Common at multi-tenant office lobbies, stadium entrances, transit, and gym entries. Brands: Boon Edam, Smarter Security, Argusa, dormakaba.
- AI camera analytics. A door camera (typically a 4MP fixed dome or bullet) detects two people passing one badge event, fires an alarm, and bookmarks the video for operator review. Cheapest mitigation: it rides on existing cameras with no door-hardware change. Vendors: Verkada (built into Command), Avigilon Unusual Motion plus access integration, Genetec KiwiVision, Briefcam, Dragonfruit AI. Detection-only, not prevention, but it gives the audit trail compliance frameworks expect. Standard at IDFs and server rooms.
Where to deploy each mitigation
- Data center cages, federal SCIFs, pharmaceutical clean rooms. Mantraps. The cost of a single unauthorized entry justifies the throughput compromise.
- Multi-tenant office lobbies, large corporate front doors. Turnstiles. High volume, throughput-critical, plus aesthetic compatibility.
- IDFs, server rooms, after-hours back doors. Optical sensors plus AI camera analytics. Lower throughput but real audit-trail value.
- General office doors, retail back-of-house. Camera analytics only. Detection without physical prevention, sufficient for most threat models.
When to ask Tec-Tel about tailgating
Right mitigation depends on the door, the throughput, and the cost of an unauthorized entry. We walk a building, prioritize the doors that need physical controls versus detection-only, and scope hardware.