What the frontline security officer sees that the software does not
Abstract. The access control point is where insider risk is most often caught or missed, and the licensed security officer is the control that stands there. This article examines how tailgating, badge sharing and social pressure defeat well-designed entry systems, and sets out practical measures for officers and supervisors protecting critical facilities.
Introduction
A facility can spend millions on turnstiles, biometrics and cameras and still be undone by a person holding a door open for a colleague. Public debate about security tends to picture an outside attacker forcing a way in. The harder problem is the person who is already trusted: the employee, the contractor, the vendor, the cleaner.
This article argues that the entrance is the place where that trust is tested every day, usually by a single officer at a desk or a gate. Technology records who badged in. Only a person can notice who walked in behind them, who looked nervous, or who claimed an authority they did not have.
The discussion is written for the licensed security guard community and applies to any critical facility, including data centres, utilities and government sites. It is deliberately general. It describes common practice and recurring failure patterns, not the arrangements of any particular site.
1. The trusted-person problem
An insider is anyone with legitimate access who can harm the organisation, whether by intent or by accident. Most insider risk frameworks separate insiders into three broad types:
- Malicious insiders deliberately steal, sabotage or leak, often motivated by grievance, money or coercion.
- Negligent insiders cause harm through carelessness: propping a door, lending a badge, skipping a procedure because it is inconvenient.
- Compromised insiders are used by someone else, through manipulation, pretexting or stolen credentials.
For the officer at the entrance, the second and third groups matter most. Malicious insiders are rare and usually hard to spot from a desk. Negligent and manipulated insiders are common, and their behaviour is visible at the threshold: the badge handed to a friend, the unfamiliar “engineer” who knows the right names, the colleague in a hurry who expects the door to be held.
The central lesson is that “inside” does not mean “safe”. A badge proves that a credential was issued. It does not prove that the person presenting it is the person it was issued to, that they are there for a legitimate reason today, or that they are acting freely.
2. The threshold as a control point
Critical facilities rarely rely on one door. Defence in depth stacks several layers, each designed to deter, detect, delay or deny. This is the logic behind the physical controls in ISO/IEC 27001:2022 Annex A (International Organization for Standardization [ISO] & International Electrotechnical Commission [IEC], 2022b), and it echoes the layered thinking in Crime Prevention Through Environmental Design (CPTED) (ISO, 2021).
What is easy to forget is that every layer carries an assumption about the person who has just passed the one before it. When an earlier layer is weak, the later ones inherit its mistake.
| Layer | What it assumes |
|---|---|
| Perimeter and gate | Nobody is trusted yet; the aim is to deter, detect and delay. |
| Lobby and reception | A visitor until identity and purpose are checked. The officer’s first real chance to challenge. |
| Mantrap or controlled door | The credential holder is the right person, entering alone. Tailgating defeats this assumption. |
| Secured white space | Everyone inside belongs, so one lapse upstream exposes the most valuable assets. |
The entry point at the secured door is where insider risk is most concentrated. By that stage a person has already been accepted by the outer layers, so they are presumed to belong, and a single tailgating event hands them everything behind it.
3. Tailgating and piggybacking
Tailgating means following an authorised person through a controlled door without presenting a credential. Piggybacking is similar, except the authorised person knowingly lets the other through. In practice the two blur, and both succeed for human reasons rather than technical ones.
- Courtesy. Most people are taught to hold a door for the person behind them. Challenging that instinct feels rude.
- Hurry. Delivery windows, shift changes and maintenance deadlines create pressure to wave people through.
- Hierarchy. Staff hesitate to question someone who looks senior, or who carries a laptop bag and a confident manner.
- Familiarity. The regular contractor who has “always” been let in becomes invisible to the process.
- Diffusion of responsibility. Each person assumes someone else has checked.
These patterns are well documented in the social psychology of compliance. Robert Cialdini’s (2021) Influence describes how authority, social proof and reciprocity push people to comply without thinking, and a locked door that someone has just politely held open is a textbook case.
The practical conclusion is that tailgating cannot be solved by signage alone. It needs a culture in which challenging a stranger is expected and supported, and physical design, such as mantraps, optical turnstiles and anti-passback logic, that makes the safe action the easy one. Even then, the officer’s attention remains the final check, because every technical barrier has a way around it.
4. The human factor: challenging politely but firmly
Social engineering is the manipulation of people to bypass controls. At an entrance it rarely looks dramatic. It looks like a confident person with a plausible reason, a small emergency, or a name to drop.
Common pretexts include the “engineer” sent to fix something urgent, the visitor whose host is “on the way down”, the new starter whose badge “hasn’t been activated yet”, and the caller claiming to be a manager who instructs the desk to let someone in. Each exploits the same weakness: the officer feels pressure to be helpful and has no quick way to verify the claim.
The officer’s defence is a consistent routine, not suspicion of everyone. Useful habits include:
- Verify through a separate channel. Confirm a visitor with the host using a number from the official system, not one supplied by the visitor.
- Let procedure refuse, not the person. “The system needs this before I can let you through” depersonalises the refusal and protects the relationship.
- Hold the line under pressure. Urgency and authority are the two levers manipulators pull hardest. A genuine emergency can survive a thirty-second check.
- Offer a path, not just a no. Direct the person to the right contact so a legitimate visitor is helped and an illegitimate one gains nothing.
- Report anomalies even when nothing happened. An unsuccessful attempt is intelligence about what the next one may look like.
Mica Endsley’s (1995) model of situation awareness is a useful frame: perceive what is in the environment, understand what it means, and anticipate what happens next. An officer who notices that a visitor knows names but not the purpose of the visit has perceived something worth understanding.
This takes training and confidence. Officers who fear being blamed for an awkward refusal will wave people through. Management has to make clear, in words and in practice, that a polite challenge is always backed.
5. Governance: making the officer’s decision easier
A guard cannot carry the whole burden. The best frontline judgement fails when the surrounding process is vague, so governance is what turns individual vigilance into a reliable control. ISO/IEC 27001:2022 (Annex A, physical controls) and the guidance in ISO/IEC 27002:2022 treat physical entry, secure areas and monitoring as managed controls with defined owners, not informal habits (ISO & IEC, 2022a, 2022b).
Four areas deserve attention.
- Visitor and contractor management. Pre-registration, identity verification, visible badges that distinguish visitors from staff, and escort rules for sensitive areas. Contractors need time-limited access tied to a named sponsor.
- Access reviews. Permissions accumulate. Regular reviews remove access for people who have changed role, left, or no longer need it. A departed employee whose badge still works is an insider risk created by paperwork.
- Logging and review. Entry logs, camera footage and alarm records only help if someone reads them. Reviewing for patterns such as repeated failed attempts, out-of-hours entry or unusual door-forced alarms turns records into detection.
- Escalation paths. The officer should know exactly who to call, in what order, and what authority they have to deny entry. Ambiguity at that moment favours the intruder.
A risk-based approach ties these together. ISO 31000:2018 (ISO, 2018) gives a general framework for identifying, assessing and treating risk, and it is a natural fit for deciding which areas need the strictest entry controls and which can accept lighter ones. Insider risk should be an explicit line in that assessment, not an assumption that staff are safe by default.
Personnel security belongs here too. Insider risk is reduced by good recruitment screening, clear expectations, a healthy reporting culture and fair handling of staff concerns, as well as by physical controls.
6. The Malaysian context
Malaysia’s Cyber Security Act 2024 (Act 854) created a statutory framework for the protection of National Critical Information Infrastructure (NCII), administered with the National Cyber Security Agency (NACSA). Entities designated as NCII entities must follow sector-specific codes of practice issued by NCII sector leads, carry out risk assessments and audits, and notify incidents (Mayer Brown, 2024).
The Act is primarily about cyber security, but its practical effect reaches the front door. Data centres, utilities and other critical facilities depend on physical protection of the systems they host, and standards such as ISO/IEC 27001 treat physical entry control as part of the same assurance picture. A weak entrance undermines strong network controls.
For the guard force, three consequences follow:
- Higher expectations. Officers at designated or sensitive sites may be held to stricter procedures, audit and documentation than at an ordinary commercial site.
- Clearer accountability. Incident reporting duties mean that tailgating events, suspicious approaches and near-misses should be recorded accurately and escalated promptly.
- Professional standing. Private security in Malaysia operates under the Private Agencies Act 1971 (Act 27), with licences issued by the Ministry of Home Affairs (KDN). Amendments passed by the Dewan Rakyat in October 2025 are aimed at licence issuance and renewal (Bernama, 2025). As clients demand more from critical-site security, training and professional development become a differentiator for licensed officers.
This area of regulation is changing, so readers should check the current text of the Act, the applicable codes of practice and the status of the Private Agencies Act amendments.
7. Practical takeaways
For security officers
- [ ] Treat every door as a decision point, not a courtesy.
- [ ] Verify visitors and claims through an independent channel.
- [ ] Say “the procedure requires…” rather than “I don’t trust you”.
- [ ] Do not let urgency or apparent rank shorten a check.
- [ ] Record and report suspicious approaches, including failed ones.
- [ ] Know your escalation contacts and your authority to refuse entry.
For supervisors and managers
- [ ] Brief and back officers publicly when they challenge a senior person correctly.
- [ ] Run regular access reviews and remove stale permissions.
- [ ] Review logs for patterns, not only after incidents.
- [ ] Include insider risk explicitly in the site risk assessment.
- [ ] Test tailgating controls through authorised, supervised exercises and learn from the results.
- [ ] Provide scenario-based training, not just policy documents.
Conclusion
Insider threat is a trust problem, and trust is tested at the threshold. Technology can record, restrict and alert, but it cannot hold a polite conversation with a person who is lying. The licensed security officer can, and does, every shift. Organisations that equip officers with clear procedures, real authority and visible support turn the entrance from a weak point into a working control.
References
Bernama. (2025, October 9). Dewan Rakyat passes Private Agencies (Amendment) Bill 2025. https://web11.bernama.com/en/news.php?id=2476761
Cialdini, R. B. (2021). Influence, new and expanded: The psychology of persuasion. Harper Business.
Cyber Security Act 2024, Act 854 (Malaysia).
Endsley, M. R. (1995). Toward a theory of situation awareness in dynamic systems. Human Factors, 37(1), 32–64. https://doi.org/10.1518/001872095779049543
International Organization for Standardization. (2018). Risk management — Guidelines (ISO Standard No. 31000:2018).
International Organization for Standardization. (2021). Security and resilience — Protective security — Guidelines for crime prevention through environmental design (ISO Standard No. 22341:2021).
International Organization for Standardization & International Electrotechnical Commission. (2022a). Information security, cybersecurity and privacy protection — Information security controls (ISO/IEC Standard No. 27002:2022).
International Organization for Standardization & International Electrotechnical Commission. (2022b). Information security, cybersecurity and privacy protection — Information security management systems — Requirements (ISO/IEC Standard No. 27001:2022).
Mayer Brown. (2024, December 19). Malaysia’s new Cyber Security Act 2024: A summary and brief comparative analysis. https://www.mayerbrown.com/zh-hans/insights/publications/2024/12/malaysias-new-cyber-security-act-2024-a-summary-and-brief-comparative-analysis
Private Agencies Act 1971, Act 27 (Malaysia).
