What Is Piggybacking? Security Definition

Imagine you live in an apartment building that has a locked front door. You use your key card to open the door and walk inside. As you walk through, a stranger slips in right behind you before the door closes.

You did not invite them, but you did not stop them either. That is piggybacking, someone riding on your permission to get into a place they are not supposed to be. In the digital world, piggybacking works the same way.

For example, you log into your work computer at a coffee shop and then step away to get your drink. While you are gone, a stranger sits down and uses your open session to check emails or steal files. They did not hack your password.

They just used the fact that you were already logged in. This is not the same as a hacker breaking into a system with advanced tools. Piggybacking relies on human behavior, trust, distraction, or politeness.

In offices, it often happens at security doors where people hold the door for someone they assume belongs there. In networks, piggybacking can mean an attacker connects to your Wi-Fi or VPN after you have already authenticated, essentially riding your valid session into the protected network. Security teams worry about piggybacking because it bypasses many technical defenses.

If an attacker can piggyback their way in, they do not need to crack a password or exploit a software bug. They just need to be near the right person at the right time. That makes piggybacking a social engineering threat as much as a physical security one.

Training people to be aware of their surroundings and to never share or leave sessions open is the main defense against piggybacking.

In information security, piggybacking is an attack vector where an unauthorized entity gains access to a restricted system, network, or physical area by taking advantage of an authorized user’s authenticated session, credentials, or physical passage. It is classified as a social engineering technique because it exploits human behavior rather than technical vulnerabilities. In physical security, piggybacking (often called tailgating) occurs when an unauthorized person follows an authorized person through a secured entry point, such as a door requiring a badge or biometric scan.

This bypasses access control systems like keycards, proximity readers, or PIN pads because the system only registers one entry event, but two people enter. In network security, piggybacking can involve an attacker connecting to a trusted network after an authorized user has already established a VPN tunnel or authenticated into a wireless network. For example, if a user logs into a corporate Wi-Fi network using WPA2-Enterprise with 802.

1X authentication, the user’s device is authenticated by a RADIUS server. If the user’s device is compromised or if the attacker captures the session tokens, the attacker can piggyback on that authenticated session without needing their own credentials. In operating systems, piggybacking can refer to session hijacking, where an attacker takes over an idle but authenticated session on a shared workstation.

For instance, in a Windows environment, if a user locks their workstation but does not log off, an attacker who gains physical access to the machine can sometimes bypass the lock screen or use tools to dump the session. More commonly, piggybacking describes the scenario where an authorized user authenticates to a system, then walks away, allowing an unauthorized user to interact with the system while the session is still active. This is why security policies enforce automatic session locks after a period of inactivity and require users to log off or lock their workstations before leaving them unattended.

From a compliance standpoint, standards such as PCI DSS, HIPAA, and ISO 27001 require organizations to implement controls against piggybacking, including visitor management systems, mantrap portals, and security awareness training. The attack is differentiated from impersonation or credential theft because the attacker does not need to know the victim’s password or biometric data. The victim’s own legitimate access is the vector.

In exam contexts, piggybacking is often contrasted with social engineering attacks like phishing or shoulder surfing, but it is unique in that it relies on physical or logical proximity to an active authorized session rather than deception or information gathering. Professionals must understand that piggybacking threats exist at multiple layers: physical perimeter, network perimeter, and session management. Mitigation includes using two-factor authentication, zero trust architectures, mantrap entry systems, and strict session timeout policies.

Piggybacking is a core concept in the Security+ and CISSP exam domains related to access control and social engineering.

Piggybacking matters because it directly undermines the entire concept of access control. Access control systems are designed to ensure that only authorized individuals can enter a space or use a resource. When piggybacking occurs, the system works correctly but the human using it bypasses the security.

That means all the money spent on biometric readers, VPN gateways, smart cards, and authentication servers can be rendered useless by a single moment of carelessness. In practical IT terms, piggybacking is a leading cause of data breaches in physical environments like data centers, research labs, and government facilities. Attackers know that it is often easier to follow a legitimate employee through a door than to crack a firewall or find a software vulnerability.

For IT professionals, understanding piggybacking is crucial because it changes how you design security policies. You cannot just focus on technical controls. You must also train users to challenge strangers, hold doors properly, and lock their workstations.

Many organizations use mantraps, small rooms with two doors where only one person can pass at a time, to physically prevent piggybacking. In network design, zero trust architecture assumes that no user or device is inherently trustworthy, which means even if an attacker piggybacks into the network, they still face authentication challenges for every resource they try to access. From a compliance perspective, standards like PCI DSS require organizations to implement physical security controls to prevent piggybacking.

For example, PCI DSS Requirement 9.1.1 states that organizations must use video cameras and access control mechanisms to monitor entry points. If you are an IT auditor or security professional, you need to test for piggybacking vulnerabilities during assessments.

That includes walking around buildings to see if employees hold doors for strangers and checking if workstations lock automatically. Piggybacking also appears in incident response. If an unauthorized person is found inside a secure area, you must trace how they got in.

Often, the answer is that they piggybacked behind an employee. This leads to retraining and sometimes disciplinary action. Piggybacking matters because it is a low-tech threat that can defeat high-tech defenses.

Ignoring it leaves your organization vulnerable to intrusion, data theft, and compliance penalties.

On certification exams, piggybacking appears mainly in scenario-based multiple-choice questions. The most common pattern is a description of a person following an employee through a secured door without swiping their own badge. The question will ask you to identify the type of attack or the best countermeasure.

For example, a Security+ question might read: An employee holds the door for a person who claims they forgot their badge. The person gains access to the restricted area. Which type of social engineering attack is this?

The correct answer is piggybacking (or tailgating, depending on the exam). Another pattern involves an unattended workstation. A question might describe a user logging into a computer and then leaving the desk without locking it.

An unauthorized person uses the computer to access sensitive files. The question asks what security principle was violated. The answer is piggybacking or session hijacking. In CISSP, you may see a question about which physical security control prevents piggybacking.

The options might include a mantrap, access control list, firewall, or encryption. The correct answer is mantrap because it requires one person to pass through before the next door opens. Another common question type is a comparison.

The question lists two terms and asks which scenario represents piggybacking versus shoulder surfing or impersonation. For example: Which of the following describes piggybacking? Option A: looking over someone’s shoulder to see their password.

Option B: using a valid user’s open session on an unattended computer. Option C: calling a help desk and pretending to be an employee. Option D: sending a fake email to trick someone into revealing credentials.

The correct answer is B. In CEH, you might see a question about the reconnaissance phase where an attacker gains physical access by piggybacking. The question asks which attack vector is being used.

You must select social engineering. Some questions integrate piggybacking into a larger incident response scenario. For instance, a data breach occurred and the investigation found that an unauthorized person accessed the server room.

The logs show only one badge swipe at the time. The question asks what most likely happened. The answer is that the attacker piggybacked behind an authorized employee. In performance-based questions (PBQs), especially in Security+, you might be asked to drag and drop the correct countermeasure for each attack type.

Piggybacking would be paired with a mantrap or security awareness training. Sometimes questions will ask you to identify the most effective control from a list. The trick is to remember that technical controls like video cameras help detect piggybacking but do not prevent it.

Prevention comes from physical barriers like mantraps or turnstiles. Always read the question carefully to see if it asks for detection, prevention, or mitigation. Finally, watch for multi-step questions.

A scenario might describe an attacker who piggybacks into a building, then accesses an unattended workstation, then uses a privilege escalation exploit. The question might ask for the initial attack vector, which is piggybacking.

Piggybacking is a security threat that every IT professional must understand because it directly targets the human element of security. In practice, piggybacking can happen in several ways, and each requires a different mitigation strategy. Let's start with physical piggybacking.

In any building with badge readers, the door control system logs every swipe. But if two people enter on one swipe, only one person is logged. Security cameras can catch the act, but they are a detective control, not a preventive one.

The best prevention is a mantrap: a small room with two doors. The first door opens only after authentication, and the second door will not open until the first door is closed and the person is alone. This forces single entry.

Other physical controls include turnstiles that block two people from passing, and security guards who challenge anyone not badging in. For digital piggybacking, the main control is automatic session timeout. Every operating system and application should be configured to lock the screen after a set period of inactivity, typically 5 to 15 minutes.

Group Policy in Windows or screensaver settings in macOS can enforce this. In environments with high security, users are required to lock their workstation manually before stepping away, using the Windows Key + L shortcut. Another digital piggybacking risk involves VPN and network access.

If a user leaves their VPN client active while stepping away, an attacker at the same location could use that VPN session. This is especially dangerous in public places like coffee shops or airports. The mitigation is to use VPN clients that require frequent re-authentication or that detect changes in network location.

In zero trust architectures, every request is re-authenticated regardless of the user's previous session, which eliminates the value of piggybacking on a session. What can go wrong? If users are not trained, they will hold doors for strangers.

If workstations are not configured to lock, attackers can walk up and use them. If mantraps are not installed, piggybacking at entry points is easy. In penetration testing, piggybacking is one of the first techniques testers try because it often works.

As a professional, you should include piggybacking testing in your security assessments. Walk through your building and note how many times you can enter a secure area without badging. Check if there are policies against holding doors and if they are enforced.

Also, review your organization's incident logs for any entries where physical access was granted without a badge swipe. That is a red flag for piggybacking. Finally, remember that piggybacking can also occur virtually, such as when an attacker uses a shared computer that a previous user did not log off.

In healthcare, this is a HIPAA violation. In finance, it can lead to regulatory fines. The lesson is clear: technical controls like encryption and firewalls are important, but they do not stop someone from holding the door for a stranger.

That is why security awareness training must emphasize not just policy, but practical habits like locking screens and challenging unknown people.