Hi-vis jackets. A convincing story. Zero questions asked.
We walked into the C-suite, photographed credentials, ran network scans, and walked out with a corporate laptop. Nobody raised the alarm. That’s what a tailgating attack looks like when it works. The weakest layer isn’t your locks or your badges. It’s trust.
The Swarm’s latest engagement started in London. Two operators posed as contractors, there to count sockets and switches. Hi-vis jackets, a clipboard, and quiet confidence got them past the front door unchallenged. That’s the shape of most physical social engineering: look boring enough, and nobody stops to ask questions.
The approach
We’d done our homework. A vishing attack targeting staff gave us floorplans, routines, and the location of sensitive zones.
That’s classic pretexting attack groundwork: build the false identity long before you ever need it. Armed with that intelligence, we headed straight for the executive floor.
The executive floor housed the C-suite. Access restricted. High value.
The only thing standing between us and the executive offices? A polite receptionist waved us through without an escort, ID checks, or a second thought.
The tailgating attack escalates
A locked corridor on the internal staircase to the floor below briefly slowed our advance. Rather than retreat, we went back to reception.
That set up the next problem: get past a locked door without raising the one flag that could end the engagement. This time, we asked for broader access.
The result? Building-wide access spanning the executive floor and several floors around it. Freshly issued staff passes. No ID required.
This tailgating attack had already cleared its toughest checkpoint at reception. Everything after that was just momentum.
The run of the house
With passes in hand, we moved unrestricted:
- Observing staff and security protocols
- Viewing sensitive documents left on desks
- Photographing credentials and access points
- Running network scans from a booked focus room
All without raising suspicion. Every layer of security fell to a well-timed question or a nod of assumed authority.
The breach
As operations drew to a close, two final moves proved just how severe the exposure was.
The downstream effect: we lifted a building entry pass from an unattended desk, unnoticed. On top of which, an unlocked corporate laptop gave us immediate access to internal systems. We messaged our point of contact directly from the user’s Teams account. The laptop’s owner spent that time searching the floor for it.
What we proved
A convincing pretext, sharp reconnaissance, and a hi-vis jacket bought full access to the executive floor and every floor around it: sensitive documents, privileged systems, freely issued passes.
No challenges. No questions asked. Not even a request for ID.
The weakest link wasn’t the locks, the badges, or the network security. It was trust. Misplaced trust opens every door.
This engagement proved a simple truth: physical security only holds if every person enforces it, every time.
The reality check
No system flagged any of this. Not the locked corridor, not the reissued passes, not two contractors nobody in the building had seen before. Every check that should have caught a tailgating attack depended on one person deciding, in the moment, whether a story sounded plausible enough.
That’s not a technology gap. It’s a process one. Nobody at reception was trained to verify identity independent of confidence, and nobody enforced ID checks once passes started appearing outside the normal process. Fix the second, and the first stops mattering nearly as much.
Physical social engineering doesn’t need a zero-day. It needs one person who doesn’t want to seem rude.
What would an attacker find if they walked through your door today?
Ask your reception desk what happens when someone waves a lanyard and tells a good story. If the honest answer is “they’d probably get let through”, you’ve already found your weakest control.
The Swarm runs tailgating attacks, pretexting calls, and full physical social engineering campaigns as part of Constant Cyber Attack™, testing every layer, digital, physical, and social, before someone without a badge decides to test it for you. Contact CovertSwarm to find out more.