Tailgating detection for data centers and secure entrances
Tailgating detection for data centers and secure entrances is the camera-side check that one badge admitted one person, at the doors where the badge log is otherwise the only record: data halls and cages, labs, records rooms and corporate lobbies. The access control system logs a valid credential and nothing about the second person who walked in behind it. Camzify watches the door, counts the people who crossed on each entry event, and messages the person designated for that door when the count is more than one.
- One badge, one person, counted on camera
- No access-control integration required
- Every event logged with its frame
The badge log says one person came in
A badge reader records that a credential was presented and the door released. It does not record how many people came through before the door closed, so the most common access-control failure leaves no trace in the access-control system. In the ASIS International survey of security professionals deployed in September 2023, tailgating or piggybacking topped the list of failures experienced in the previous six months, at 61 percent.
Data centers, labs and records rooms answer this with vestibules and interlocking doors where the budget and the floor plan allow. Most doors on most sites are a single leaf with a reader, watched by a camera that records everything and counts nothing. When an auditor asks how the site knows that only authorized people entered the data hall, the honest answer is often that it does not.
The frameworks that data centers are audited against name the gap. NIST SP 800-53 describes vestibules as designed to stop the following of authorized people through controlled doors, "also known as piggybacking or tailgating," which "results in unauthorized access to the facility." A SOC 2 examination tests that physical access to data center facilities is restricted to authorized personnel (Trust Services Criteria, CC6.4), and PCI DSS requires that entry to sensitive areas be monitored on camera or by access control and the data reviewed.
“Dock door left unsecured after delivery — confirm and lock.”
Unacknowledged alerts escalate to the backup contact after the configured window.
The camera counts what the reader cannot
Tailgating detection watches the door and counts the confirmed people who cross the threshold on each entry event, from tracked objects rather than raw motion, so two people close together are two and not a blob.
- When more than one person enters on a single event, the detection fires, the frame is recorded, and the person designated for that door is notified through the channel set for that camera.
- No integration with the access control system is needed to detect the event on camera; where badge logs are available they can be paired, so an alert shows the badge used and the count seen.
- A notification window per camera sets who is told and when; a lobby door at nine in the morning and a data hall door at two at night carry different rules, and the detection runs in both regardless.
- The cross-camera journey map follows the second person from the door onward so the response knows where they went, and attribute extraction describes them by clothing rather than by face.
- On a patrol round, the door is a checklist stop, door closed, nobody in the vestibule, reader unobstructed, with a frame per answer in the report.
The event is logged with its frame whether or not anyone acts on it, which is what an auditor asks for after the fact.
Tailgating detection
Two or more people through on one entry event, at the door where the badge log shows one.
DetectionZone intrusion detection
A person inside the cage or the data hall itself, whichever door they came through and however they got past it.
DetectionCross-camera journey map
Where the second person went after the door, camera by camera, for the response and for the report.
DetectionCamera tampering detection
A door camera covered, moved or gone dark, raised the same day rather than found at the audit.
- Door closed and latchedCompliant
- No person in vestibuleCompliant
- Reader and camera unobstructedCompliant
- Door not propped or heldNot compliant
A failed item is resolved as Fixed or Pending before the round can close.
What a secure-entrance round checks
Propped doors were the second most common failure in the same ASIS survey, at 50 percent, and a propped door is what a camera round is good at. A secure-entrance sequence visits every controlled door on a schedule and asks whether it is closed and latched, whether anyone is waiting in the vestibule, whether the reader and the camera are unobstructed, and whether the door has been wedged, tied or held. Between rounds, the detection watches the entry events themselves.
The report per round gives the audit a record of the doors as found, with a frame per item and the person notified on each failure. Unauthorized access detection covers the zones behind the doors, and virtual patrolling for compliance evidence covers building the round from the obligation backwards.
A check found Not Compliant captures a snapshot and messages the guard designated for that camera; on a manual round the operator chooses to send it, on an automated round it goes on its own. The item stays Pending until it is marked Fixed, which captures the after frame, and the report shows both.
Why this matters, in published figures
From the security professionals' association, the US standards body and the accountants' institute whose criteria SOC 2 reports are written against. Camzify publishes no figures of its own.
- 61%
- Security professionals who had experienced tailgating or piggybacking in the previous six months, the most common access control failure in the ASIS International survey deployed in September 2023 (1,022 participants, 705 of whom answered this question). Only 8 percent had experienced none of the failures listed.
- Source: ASIS International, The Essentials of Access Control, 2023
- 50%
- Respondents in the same survey who had faced propped doors in the prior six months, the second most common failure after tailgating. Fake or stolen credentials (8 percent) and breaking and entering (15 percent) were encountered less often.
- Source: ASIS International, 2023 access control research report (PDF)
- PE-3(8)
- NIST SP 800-53 Rev. 5 describes access control vestibules as "designed to prevent unauthorized individuals from following authorized individuals into facilities with controlled access. This activity, also known as piggybacking or tailgating, results in unauthorized access to the facility." The base control PE-3 also requires physical access audit logs at defined entry and exit points.
- Source: NIST SP 800-53 Rev. 5
- CC6.4
- The AICPA Trust Services Criteria that SOC 2 examinations test against: "The entity restricts physical access to facilities and protected information assets (for example, data center facilities, backup media storage, and other sensitive locations) to authorized personnel to meet the entity's objectives."
- Source: AICPA, 2017 Trust Services Criteria (revised points of focus 2022)
What it will not do
Tailgating detection tells a person that two came through on one badge. What follows is theirs.
- It will not stop the door or lock anyone in; it is a detection on a camera, not an interlock, and a vestibule remains the control that physically prevents a second entry.
- It will not tell whether the second person was authorized; a colleague who should have badged looks the same as a stranger, and pairing with the badge log is what separates them.
- It will not count reliably from a camera that cannot see each entrant; a doorway view with a clear line of sight to the threshold is the condition, and a wide ceiling view is not.
- It will not recognize a face; the second person is described by clothing and carried objects if they are followed at all.
- It will not satisfy a control on its own; the auditor decides whether the log of events and the round reports meet the clause.
We publish no detection rates for tailgating, and our own SOC 2 Type II and ISO 27001 certifications are in progress and not held. The trust page sets out both.
Industries where this applies
Frequently asked questions
Ready to patrol your site 24/7?
Book a 15-minute demo and see a live patrol run on your own cameras.