The second person through the door: making visitor access resistant to social engineering

A badge reader can work perfectly and a building can still admit the wrong person. One common gap is the moment after an employee unlocks a door: someone carrying a laptop case follows close behind, says their hands are full, or claims they are late for a meeting. The interaction is small. The access decision is not.

Recent practitioner conversations in cybersecurity forums keep returning to this mundane failure mode: tailgating, unattended badges, and visitor processes that depend on an employee feeling comfortable challenging a stranger. These discussions are useful as practitioner anecdotes, not as a measure of incident prevalence. The control foundation is clearer in NIST guidance: verify access authorization, control entry and exit, maintain logs, and escort visitors when required.

Why the doorway is a social-engineering surface

Door controls turn a complicated security policy into one brief human moment. The person opening the door may be juggling coffee, a laptop, or a conversation. A visitor may look like a contractor, courier, employee from another floor, or someone who simply belongs. The social pressure is often the point: nobody wants to seem rude, block a colleague, or delay a delivery.

That is why “be vigilant” is not an adequate control. It asks employees to improvise under pressure and leaves them to decide whether challenging someone is socially acceptable. A reliable program makes the safe action predictable, supported, and low-friction.

Start with zones, not one building-wide rule

Not every lobby needs the same access model as a server room, records area, lab, or finance office. Define zones by the impact of unauthorized access and the work performed there. Then specify who may enter each zone, whether visitors require an escort, and what happens when a credential does not work.

NIST SP 800-171 Rev. 3 explicitly includes physical access controls such as verifying authorization, controlling ingress and egress, maintaining access logs, escorting visitors, and securing keys or badges. It is a standard for protecting controlled unclassified information in nonfederal systems, not a universal legal requirement for every company. Organizations should map its controls to their own obligations and risk, rather than claim compliance from a checklist alone.

Make the challenge script normal

People are more likely to act when they have words ready. Give employees a neutral phrase that does not accuse: “I can’t badge someone else in, but reception can get you sorted.” Or: “Let’s use the visitor entrance so your host can meet you.” The person being challenged has a clear next step, and the employee is not asked to judge intent.

Leaders should model this response and say plainly that no one will be penalized for using it in good faith. Avoid incentives that reward speed through the door, and avoid training that turns every stranger into a suspect. The point is authorization, not profiling. Employees should follow the same process for executives, contractors, vendors, and people they recognize.

Build a visitor path that does not rely on memory

1. Pre-register when practical. Capture the host, expected arrival window, purpose, and access level in the approved visitor system.
2. Check in consistently. Reception or a designated host verifies the visit using the organization’s process, not a caller-provided name alone.
3. Issue visible, limited credentials. Guest badges should be distinguishable, time-bounded, and unable to open areas beyond the approved scope.
4. Escort to the right place. Make clear who owns the escort and what to do if they are delayed or called away.
5. Close the visit. Collect badges, record departure where required, and disable temporary credentials promptly.
6. Provide exceptions safely. Deliveries, emergencies, accessibility needs, and after-hours visits need documented paths—not ad hoc bypasses.

Design for accessibility and real working conditions

A strict rule that cannot be followed becomes an exception factory. Consider wheelchair access, temporary injuries, employees carrying equipment, door hardware, fire egress, shift changes, and reception coverage. Do not ask someone to hold a secure door open if the design makes independent entry difficult. Fix the building and process instead of blaming the person who is trying to use them.

Also distinguish a failure to authenticate from an emergency. Fire doors and life-safety systems must follow the building’s code and emergency procedures. Security staff should not improvise a lock-down that blocks egress. Facilities, safety, HR, IT, and physical security need a shared ownership map for these cases.

Measure whether the process works

Training completion alone tells you little. Review whether employees know where to send visitors, whether reception can reach hosts, whether temporary badges expire, and whether there is a safe way to report a door left unsecured. Test the process only through an approved assessment with written scope, safety boundaries, and non-punitive follow-up. Do not stage surprise tests that create risks for employees or visitors.

Track useful operational signals: unresolved badge exceptions, visitor check-ins without a host, time to disable a lost credential, and recurring door faults. Keep data proportional and protect visitor information; access logs should not become an informal employee-surveillance database.

What to do after a suspected unauthorized entry

Keep the response factual and quick: alert the designated security contact, note the time and location, preserve relevant access records, and identify which spaces or assets may have been exposed. Do not confront someone if doing so could create danger. Follow the organization’s incident plan, and involve law enforcement or emergency services when there is an immediate safety concern. Review both the human decision and the process conditions that shaped it.

For related organizational controls, see our explainers on new-starter impersonation and unwritten rules, verification scripts that reduce social friction, and minimizing sensitive data in incident screenshots.

Sources

• NIST SP 800-171 Rev. 3, §3.10.7 Physical Access Control
• CISA physical security resources
• Practitioner discussion: physical penetration testing and tailgating (anecdotal)
• NIST SP 800-53 Rev. 5, PE-3 Physical Access Control