With client permission, we test buildings the way intruders enter them. Not over fences at night: through lobbies at ten in the morning. The kit is unglamorous: a hi-vis vest, a ladder, a clipboard, a confident apology. Across sites and sectors the pattern holds with embarrassing consistency: politeness beats policy on the first attempt.
The site that fails is polite. The site that passes has made challenging someone a compliment.
Three doors, three stories
The lobby: a vest and a ladder pass as facilities work almost anywhere; nobody challenges a person who looks mid-task. The dock: a pallet and a printed delivery note open more doors than any badge; docks are managed for throughput, not identity. The smoking door: propped for convenience, unalarmed, and known to every regular within a month. None of these is exotic. All of them appear in our findings, year after year, at sites with excellent awareness training.
Why training decays and design does not
Vigilance is a perishable good: a warm lecture in January is a held-open door by March. Architecture does not decay. Mantraps and anti-tailgate detection make the polite failure mechanically impossible. Dock interlocks separate the driver from the interior. Alarmed delay on convenience doors converts propping from habit into incident. Legacy proximity credentials, which can be cloned in seconds with pocket hardware, get retired in favor of modern encrypted credentials and tamper-aware readers.
The culture control
- Empower the challenge: officers and staff are explicitly backed, in writing, to stop anyone without a visible badge, including executives.
- Run the CEO test: leadership gets tailgated too, and thanks the person who stops them, publicly.
- Measure challenge rate: exercises score how often testers are stopped, and the number is trended like any detector.
- Test quarterly: the lobby, the dock, and whichever door the smokers own this season.
We have tested many polite lobbies, always with permission. Yours can learn quietly, before someone else teaches it.