Tailgating: The Access Control Vulnerability That Undoes Every Credential You Just Installed

You can install the most advanced credential technology available — facial recognition, scramble QR code and Bluetooth, fingerprint, palm vein, government-issued digital ID — and still have a building that anyone can walk into. Not by defeating the reader. Just by following someone through the door before it closes.

What tailgating and piggybacking actually are?

Tailgating is when an unauthorized person follows an authorized person through a secured door, typically without that person's knowledge or consent — slipping through right as the door swings shut.

Piggybacking is the same outcome with the authorized person's awareness, and often their courtesy — holding a door open for someone behind them, or letting a delivery rider in because it seemed rude not to.

Both bypass the access control system entirely. The credential did its job. The door just didn't stay closed long enough, or securely enough, to matter.

Why it's the vulnerability most buildings never budget for?

Access control investment overwhelmingly goes toward the credential and the reader — deciding who's allowed in. Very little goes toward the part that actually enforces how many people get in per credential presented. A building can have a facial recognition reader with 99.9% accuracy and still be completely open to tailgating, because accuracy at the reader has nothing to do with what happens at the door itself once it's unlocked.

It's also a vulnerability that has nothing to do with how modern or advanced the reader is. Upgrading from a single card reader to a biometric one doesn't fix tailgating — it just makes the credential that gets bypassed more sophisticated.

Why can't a reader alone solve this?

A reader's job ends the moment it verifies a credential and sends an "access granted" signal. What happens physically at the door after that — whether one person walks through or five — isn't something a reader mounted on a wall can see or control. Solving tailgating requires a mechanism that can physically distinguish and limit passage, not just a smarter way of identifying the first person in line.

This is what turnstiles, speed gates and entrance control systems are actually for

This is the specific gap turnstiles, speed gates and entrance control systems are designed to close — not by replacing the credential reader, but by pairing it with an automated transit enforcement layer. A well-designed speed gate / turnstile coordinates sensors and barriers to enforce true 1:1 throughput: one valid authentication unlocks passage for exactly one person, rather than leaving the door floating open for whoever is behind them.

ACX's Svelte Gate N1, for example, is built around exactly this problem: it supports card, QR code, and facial recognition credentials, and uses high-density 2D infrared sensing to track single-person passage, instantly flagging unauthorized followers and closing passage windows before a second person can slip through.

For lobbies where aesthetics matter as much as security, the AéroWing Gate series (T1 and T2) brings the same enforcement into a sleeker, airier form factor — the T-shaped design is even patented in Hong Kong — so the security layer doesn't have to look like a security layer.

The real question to ask about your building's access control

It isn't just "what credential do we use at the door?" It's "once that credential is accepted, what's physically stopping a second person from walking through behind it?" For a lot of buildings, the honest answer is: nothing. The reader was the investment. The door was an afterthought.

Explore how ACX's turnstile range closes that gap on the Turnstiles page.

Related Blog:

​Project Spotlight: T1 Turnstiles at Man Yee Building

Learn how ACX enhanced access control at Man Yee Building with T1 Turnstiles featuring a slim, modern design, efficient pedestrian flow, and seamless integration into a sophisticated lobby environment.