Physical social engineering persists because the countermeasure is social rather than technical, and most workplace cultures make challenging a stranger feel rude. That reluctance is the vulnerability, and it is precisely what a confident approach exploits.

How entry is gained

  • Tailgating: following an authorised person through a controlled door, often while carrying something that occupies both hands.
  • Impersonating contractors — maintenance, IT support, delivery, fire inspection — with plausible clothing and a clipboard.
  • Arriving during a busy period when challenging someone feels disruptive.
  • Claiming an appointment with a named senior person known to be unavailable.

What is done once inside

Photographing screens and whiteboards, taking documents from desks and printers, plugging a device into an open network port, connecting a malicious USB device to an unlocked workstation, or simply mapping the layout for a later visit. None of it requires long access.

Controls that work

  • Explicit permission — stated by leadership — for anyone to politely ask an unfamiliar person who they are here to see.
  • Visible visitor badges and a sign-in process that is actually followed.
  • Automatic screen locking after a short idle period.
  • A clear-desk practice for anything sensitive, which also defeats photography.
  • Secure print release, so documents are not left in trays.

The USB rule

Devices left in car parks, receptions, and meeting rooms are a deliberate technique, not carelessness. Modern malicious devices can emulate a keyboard and execute commands the moment they are connected. Never connect a found device; hand it to whoever handles IT. Staff need to know this specifically, because the instinct is to find the owner.

Make challenging socially easy

The reason tailgating works is that nobody wants to be the person who questioned a colleague's guest. Give people a script — "Hi, are you being looked after? Who are you here to see?" — and make clear that using it is never criticised, even when the visitor turns out to be entirely legitimate.