A card reader logs who badged in, at what door, at what time. It does not log who walked in right behind that person while the door was still swinging open. For a facility manager who already installed card or credential access control, that second person is the whole problem: the system was never built to see them.

What tailgating is, and why badge logs cannot see it

Tailgating, sometimes called piggybacking, is someone entering a controlled door on the strength of another person’s credential event instead of their own. It does not require stealing a badge or cracking a code. It requires a held door, a shared elevator lobby, a loading dock worker with both hands full, or plain courtesy. The person who walks through owes nothing to the reader.

An access control log records a credential number, a door, a timestamp, and a result: granted or denied. That is the full extent of it. No sensor counts bodies through the opening. A door position switch can report how long a door stood open, useful for propped-door alerts, but it cannot distinguish one person passing through from three. When a manager pulls a badge report after an incident and sees a valid credential opened the door at 8:47 a.m., the report is accurate and incomplete at the same time. It answers who badged in. It does not answer who came in.

What the available survey found, and its limits

The most cited figures on tailgating come from a Boon Edam security survey published in September 2019: 78% said they take a reactionary stance toward tailgating, relying on access control systems, guards, cameras, and video management software rather than prevention at the door, 74% said they do not track tailgating at all, and 71% said they believe their facility is vulnerable to a physical breach from tailgating.

Those numbers need context before anyone repeats them. Boon Edam sells security entrances and turnstiles, so a survey that emphasizes the size of the tailgating problem serves the company that ran it. The sample was more than 185 end users and security advisors in the U.S. and Canada, self-selected through social media and Boon Edam’s own contact database rather than randomly drawn, answering an eight-question multiple-choice survey. That is a small, vendor-run, seven-year-old data set. It stays in circulation because no newer tailgating-specific survey with a disclosed sample size and methodology has replaced it. Treat the figures as directional, not as a precise reading of any one Kentucky facility.

The part worth keeping regardless of who funded the survey is the 74% figure: if three out of four organizations never count tailgating events, most facilities have no record of their own to check the number against. Worth checking at your own building.

Why credential data creates false confidence

Access control vendors have spent the past few years improving the credential itself, and that work is real. HID’s 2026 State of Security and Identity Report, a survey of more than 1,500 security and IT professionals published in February 2026, found mobile credential adoption is now driven more by security improvements (50% of respondents) than by convenience (34%), a reversal from prior years. The same report found 73% of respondents named identity management their top security priority. Neither finding touches the tailgating gap. A phone-based credential that is harder to clone or share still logs one event per person who chooses to present it. Someone who walks in on a stranger’s mobile credential leaves the same blank space in the record they would have left with a plastic card.

The same report found 84% of organizations using mobile credentials keep physical badges running alongside them, which says the same thing from another angle. Separately, Genetec’s 2025 State of Physical Security Report, based on 5,696 responses collected August through September 2024, found 43% of end users prefer a hybrid mix of cloud and on-premise deployment over the next five years, against 18% wanting fully cloud and 17% wanting to stay fully on-premises, and 77% of end users say physical security and IT departments now work collaboratively on these decisions. That is a real shift in how access control gets bought, and it is a conversation about deployment model and governance, not about whether a door can tell one person from two. A facility can modernize every part of its credential and hosting strategy and still have no way to know whether the person who walked in at 8:47 a.m. was the one whose badge opened the door.

Where video analytics at the door closes the gap

A camera aimed at a door does not solve tailgating on its own, and no study in this research quantifies what share of tailgating events a camera or analytics system catches. What a camera adds is what a badge log cannot provide by design: a visual record of how many people passed through, available for review instead of assumed.

Versys installs localized IP camera and NVR systems, and separately runs live monitored surveillance with analytics geofencing, where an agent can detect a person or vehicle on the property after hours, speak through a paging horn, and call police if warranted. During business hours, a camera positioned to see the door threshold, not just the hallway beyond it, turns “the badge log says one entry” into something a manager can verify by watching the clip. After hours, when the building is closed and any entry is suspicious, the analytics and live response layer does a different job: it catches a person on the property who should not be there, rather than counting bodies through a staffed door during the day. Neither layer is a fixed percentage fix for tailgating, because that number does not exist in any study available right now.

The privacy conversation biometrics requires

Biometric access control, fingerprint or facial recognition tied to a physical body instead of a card or phone that can be handed off, aims most directly at the counting problem: one person, one credential, no way to lend it out. HID’s February 2026 report found 45% of respondents view biometrics as strategic, and among organizations already using biometrics, fingerprint recognition leads at 71% and facial recognition at 50%.

The same report found ethical and privacy concern about biometrics roughly doubled year over year, from 31% to 67%. That is a legitimate objection, not a marketing hurdle to talk a client past. Employees and visitors are entitled to know where fingerprint or facial data lives, who can access it, and how long it is kept before any reader goes on the wall. A facility considering biometrics to close the tailgating gap needs that conversation settled first.

A walkthrough checklist for entry points

Walk each controlled door with this list. It takes longer than reading a badge report, and it shows things the report cannot.

• Stand near the door during a normal traffic window, shift change or lunch return, and count how many people pass per badge swipe. More than one, on a regular basis, is tailgating happening in front of you.
• Time how long the door stays open after a valid badge event. A closer set to hold, or a door that swings slowly, gives a second or third person a wider window to follow through.
• Look for doors propped open with a wedge, a chair, or tape over the latch, especially at smoke break doors, loading docks, and back entrances used for deliveries.
• Check whether a camera has a clear sightline on the door threshold itself, not just the corridor on the other side of it. A camera aimed down a hallway will not show who came through the door.
• Check lighting at every exterior door used before sunrise or after dark, including the ones staff use as a shortcut rather than the marked entrance.
• Ask who reviews badge logs, and how often. If the honest answer is “only after something happens,” that door is running on the reactive model the Boon Edam survey describes.
• Walk secondary and delivery doors specifically. These tend to be the least monitored and the most frequently propped.
• Ask whether anyone tracks tailgating incidents as an ongoing count. If the answer is no, that facility is in the 74% that do not track it.

What this looks like handled well

A facility that has closed most of this gap looks a specific way on a walkthrough: cameras placed to see the door itself, footage reviewed on a routine schedule rather than pulled only after a problem, and staff who know propping a door is a reportable event, not a convenience nobody mentions. After hours, the same cameras carry analytics that flag a person or vehicle on the property when the building should be empty, with a live agent able to speak through a paging horn or contact police before anyone reaches a door.

None of that erases the limits described above. A card reader will never count bodies, and no camera system in the available research is shown to catch a fixed share of tailgating attempts. What changes is whether a facility can see the gap at all, instead of assuming the badge log tells the whole story. Versys works across Kentucky and Southern Indiana on access control and surveillance systems built around that gap. A facility manager who wants to know where their own doors stand can call (270) 358-2200 and ask for a walkthrough.