Data Center Tailgating Detection: Linking Badge Events to Video

Data center tailgating detection is the practice of checking every badge event at a controlled door against video, so operators can see whether one authorized person entered or someone followed them in. A badge reader logs that a credential was used. Only the camera shows how many people passed, who they were, and where they went. Linking the two turns access logs into verifiable, auditable evidence.

Key takeaways

• Tailgating and piggybacking defeat badge readers without touching them. The access log looks clean while an unbadged person is inside.
• In a 2019 Boon Edam survey, 71% of respondents believed they were vulnerable to a tailgating breach and 74% did not track tailgating at all.
• PCI DSS v4.0 Requirement 9.2.1.1 calls for monitoring sensitive-area entry with video or access control mechanisms, correlating the data, and keeping it at least three months.
• Vestibules and turnstiles delay; video plus badge correlation verifies and documents. Most sites need both.
• AI on existing CCTV can flag restricted-zone entry, after-hours activity, and loitering near entrances, and lets teams search footage in plain English. People still verify and decide.

What is tailgating in a data center, and how is it different from piggybacking?

Tailgating is when an unauthorized person follows an authorized person through a controlled door without presenting their own credential. In a data center, it usually happens at the lobby, the white-space door, or a customer cage.

Piggybacking is the same entry with the authorized person's consent, such as holding the door for a colleague. The distinction matters for training, but the access log looks identical: one valid read, more than one person.

Related terms you will meet in audits and vendor calls:

• Badge event: a single access control system (ACS) record, such as a granted read, denied read, door forced, or door held open.
• Anti-passback: an ACS rule that rejects a credential used to enter an area it has not first exited.
• Security vestibule (mantrap): a space between two interlocked doors, where the second will not open until the first has closed and the person is authenticated.
• Badge-to-video correlation: linking each badge event to the cameras covering that door and the matching time window.

Why does tailgating matter so much in data centers?

Data centers concentrate value behind a few doors. One unbadged person in a colocation hall can reach other customers' cages, cross-connects, or storage media, and the badge log will not show it.

The problem is rarely measured. A survey by entrance maker Boon Edam, reported by Building Design + Construction in October 2019, found 71% of security professionals believed they were vulnerable to a tailgating breach, 69% thought such breaches were steady or rising, and 74% did not track tailgating. If you do not track it, you cannot show an auditor it is under control.

A December 2019 Uptime Institute report, summarized in a January 2021 Uptime Journal article, found about one in five data centers had seen attempted unauthorized access over five years. Most owners and operators named unauthorized activity inside the data center as the greatest physical threat to IT.

Valid credentials are not a guarantee either. In November 2025, the Loudoun Times-Mirror reported that an IT services employee working at a colocation facility in Ashburn, Virginia, was sentenced for walking out with about $1.9 million in data storage devices between September 2023 and December 2024. That was not tailgating, but it shows the gap: the access log answers "whose badge?", while video answers "what did they do?"

Exposure is growing in every region. A July 2025 ResearchAndMarkets report counted 117 existing and 55 upcoming colocation data centers across Africa, with about 1.4 GW of upcoming capacity. New halls mean more contractors, deliveries, and doors held open during fit-out, from Johannesburg and Lagos to Frankfurt and Northern Virginia.

What do PCI DSS, ISO 27001, SOC 2, and data center standards require?

No major framework says "buy an anti-tailgating turnstile." They require you to restrict physical access, monitor it, and prove it. Confirm interpretation with your assessor, but these are the clauses compliance leads cite most:

• PCI DSS v4.0, Requirement 9. Requirement 9.2.1 calls for facility entry controls around systems in the cardholder data environment (CDE). Requirement 9.2.1.1 calls for monitoring individual access to sensitive areas with video cameras, access control mechanisms, or both; reviewing and correlating that data; protecting the devices from tampering; and keeping the data at least three months unless law restricts it. Requirement 9.3.2 covers visitor authorization and escort (Basis Theory, October 2023).
• ISO/IEC 27001:2022, Annex A section 7. Controls 7.1 (physical security perimeters), 7.2 (physical entry), and 7.3 (securing offices, rooms and facilities) cover entry. Control 7.4, physical security monitoring, was new in 2022, and auditors may check whether secure areas are monitored, for example via CCTV (Advisera).
• SOC 2, Trust Services Criteria CC6.4. The criterion asks the entity to restrict physical access to facilities and protected information assets, naming data center facilities as an example (Cyberday).
• NIST SP 800-53 Rev. 5, PE-6. PE-6 covers monitoring physical access and reviewing access logs. Enhancement PE-6(3) adds video surveillance with defined review and retention periods (CSF Tools).
• ANSI/TIA-942-C. The TIA data center infrastructure standard's third revision, released in May 2024, clarified security requirements (Belden, June 2024).
• EN 50600-2-5:2021. The European security systems standard applies Protection Classes 1 to 4 in a layered model and lists access control and video surveillance among its technical systems (iTeh Standards).

The common thread: frameworks expect a reviewed record of who entered sensitive areas. A badge log with no video context cannot show that the person who badged was the only one who walked in.

Which anti-tailgating controls work in a data center?

Anti-tailgating is a layered problem. Barriers limit entry to one person at a time; monitoring catches what gets past them and creates evidence. Use this as a starting point, not a design specification.

• Security vestibule (mantrap). What it does well: Interlocked doors force one authenticated entry at a time; Where it falls short: Space, cost, slower throughput; still needs monitoring.
• Full-height turnstile. What it does well: Strong physical barrier at perimeter; Where it falls short: Awkward for equipment carts, deliveries, accessibility.
• Optical turnstile. What it does well: Fast lobby flow; detects some multiple-person passes; Where it falls short: Low barrier; relies on staff responding to alarms.
• Guard post. What it does well: Human judgment, visitor checks, escort enforcement; Where it falls short: Cost, fatigue, cannot watch every door.
• Anti-passback rules. What it does well: Stop badges being passed back or reused; Where it falls short: Does not detect a second person following.
• Badge-to-video correlation. What it does well: Verifies each event, builds audit evidence; Where it falls short: Depends on camera placement, time sync, review process.

Most data centers combine a vestibule or turnstile at the perimeter and white-space entrance with video review tied to the access log. The weak points are usually doors without vestibules: loading docks, shipping and receiving, cage doors, and emergency exits propped during maintenance.

How does badge-to-video correlation detect tailgating?

Correlation links each access event to the right cameras and time window, so an operator reviews a short clip instead of a raw log line. Our explainer on access control and video correlation covers the general mechanics. For tailgating, the workflow looks like this:

1. An access event fires. A granted read, door held open, or door forced alarm comes from the ACS.
2. The event maps to cameras. Each door has a camera on the reader side and ideally one on the secure side.
3. The system pulls the time window. Operators see the seconds before the read and after the door closes.
4. An operator verifies. Did one person pass, or two? Was the second an escorted visitor, or alone?
5. The operator records a disposition. Cleared, escorted visitor, policy reminder, or escalated incident.
6. The record is kept. Clip, event, and disposition form the audit trail an assessor will ask for.

Three basics make or break this: synchronized time (NTP) across cameras, NVRs, and access controllers; cameras that show the reader and door swing, not just the corridor; and an accurate door-to-camera mapping kept current.

What should you ask any vendor about counting people per badge event?

Some systems try to count people per badge event and alert when the count exceeds one. If that matters to you, test it on your own doors. Questions to ask any vendor:

• How are carts, trolleys, and equipment cases handled?
• How does it handle two people passing close together, in either direction?
• How do camera angle, low light, and occlusion at the door frame affect results?
• Will you run it on recorded footage from our doors and share the misses?
• What does an operator see when the count and badge read do not match?

Treat any count as a prompt for human review, not proof. A count with no clip attached is just another alarm.

What can Kote do at data center entrances and restricted areas?

Kote by Kotelab is an intelligence layer for existing CCTV. It connects to IP cameras and RTSP-capable NVR/DVR streams and surfaces configured events with site, zone, camera, time, and clip for human review. The Kote platform page shows how the layer fits together. For data center teams, the relevant capabilities are:

• Access-control correlation, so badge events are reviewed alongside matching footage.
• Unauthorized access and restricted-zone entry, configured around white space, cage rows, battery rooms, or loading areas.
• After-hours activity in areas that should be empty overnight or on weekends.
• Loitering near doors, docks, or perimeter gates.
• Multi-camera monitoring, to follow an event from the reader camera to adjacent views.
• Alerts routed to teams, with configured workflows for the GSOC, on-site guards, or facilities.

Natural-language video search is often the fastest way to answer an auditor or customer. Instead of scrubbing footage, an investigator can ask, "Did anyone tailgate through the main entrance?" (a query shown on the Kotelab homepage) or "Was anyone near the loading dock overnight?" Treat the results as clips to review, not a verdict. Our post on natural-language video search shows how it works.

Kote does not replace vestibules, turnstiles, or guards, and it does not lock doors. It surfaces events with context; your team verifies and decides. See how that division of labor works in why your next security operations hire might be an AI agent, or compare approaches in Kotelab vs Ambient.ai. The same badge-plus-video patterns apply to offices, covered in our guide to corporate campus after-hours security.

How do you turn tailgating alerts into audit evidence?

An auditor or colocation customer will not ask whether you have cameras. They will ask what happened at a specific door at a specific time, and what you did about it. Plan the evidence before the incident:

• Keep event, clip, and disposition together so they can be retrieved as one package.
• Set retention by requirement. PCI DSS 9.2.1.1 sets a three-month minimum for monitoring data in sensitive CDE areas; contracts and local law may require longer, or limit it. Add a legal-hold process.
• Separate permissions by role for live view, search, export, and administration, and log every search and export.
• Protect chain of custody. Exported incident clips should carry time, camera, and site metadata.
• Review monthly. Sample dispositions and track confirmed tailgating events by door.

Ask vendors for the same assurance you give your auditor. Kotelab lists AES-256 encryption and ISO 27001, has SOC 2 Type 2 in progress, supports customer-configurable retention, and does not sell or use customer video for advertising. See the Kotelab security page and the Legal and Trust Center.

How should you handle privacy for entrance video?

Entrance cameras record employees, contractors, customers' staff, and visitors. The UK Information Commissioner's Office says video surveillance should be lawful, necessary, and proportionate, and is a supporting tool rather than a fix for organizational problems (ICO guidance, November 2024). Data protection laws in other regions set comparable expectations. In practice:

• Define the purpose (verifying access to secure areas) and keep monitoring tied to it.
• Post clear notices and tell colocation customers how shared-area footage is handled.
• Point cameras at doors and access paths, not desks or break areas.
• Involve HR, legal, and works councils where relevant, and run a data protection impact assessment where expected.
• Ask any vendor whether biometric identification, such as facial recognition, is involved.

Our privacy policy explains how customer data is handled.

How do you pilot data center tailgating detection?

Start small, at the doors that matter most, and measure against your own baseline:

1. Define the operational need. Pick three to five doors, such as the white-space entrance, one cage row, and the loading dock. Name the events and who owns each.
2. Review the camera estate. Confirm each door has a camera on the reader and door swing, streams are reachable over RTSP, and time is synchronized. Our NVR and AI compatibility checklist covers what to check.
3. Connect access events. Map doors to cameras and confirm timestamps line up with video.
4. Configure and evaluate with operators. Run for several weeks; operators review flagged events, record dispositions, and note misses or noise.
5. Measure your own numbers. Track time to verify, door alarms cleared without dispatch, confirmed tailgating per door, and time to answer an auditor.
6. Decide next steps. Adjust zones, fix camera placement, then expand to other halls or sites.

Frequently asked questions

What is the difference between tailgating and piggybacking?

Tailgating is when someone follows an authorized person through a controlled door without that person's knowledge. Piggybacking is the same entry with the authorized person's consent, such as holding the door. Both leave one badge read in the log for two or more people, so both need video to verify.

Does PCI DSS require video cameras at data center doors?

PCI DSS v4.0 Requirement 9.2.1.1 allows video cameras, physical access control mechanisms, or both to monitor individual access to sensitive areas in the cardholder data environment. The data must be reviewed, correlated with other entries, protected from tampering, and kept for at least three months unless law restricts it. Your Qualified Security Assessor confirms how this applies to your facility.

Can anti-passback stop tailgating?

Not on its own. Anti-passback stops a credential from being reused to enter an area it has not exited. It does not detect a second person walking in behind a valid read, so pair it with vestibules or turnstiles and video review.

Is a mantrap enough to prevent tailgating?

A security vestibule (mantrap) is one of the strongest physical controls, because interlocked doors limit entry to one authenticated person at a time. It still needs monitoring: interlocks can fail, and loading docks and cage doors rarely have one.

How does AI help with data center tailgating detection?

AI video analytics on existing cameras can surface restricted-zone entry, after-hours activity, and loitering near doors, and link access events to the matching footage. Natural-language search lets investigators ask questions like "Was anyone near the loading dock overnight?" instead of scrubbing video. Operators still verify each event and decide on the response.

Do we need new cameras to start?

Usually not. If your IP cameras or NVR/DVR streams are RTSP-capable and cover the reader and door swing, an intelligence layer can use them. A camera estate review shows which doors need an extra view.

See tailgating detection on your own doors

The fastest way to judge badge-to-video correlation is on your own footage. Bring three doors, a week of access events, and your auditors' questions. Talk to the Kotelab team to scope a pilot on your existing CCTV.