Cyberpediaby Brain
ENDEFR

Escorting a visitor without a badge

A person without a badge on the premises may be preparing an intrusion or plugging in a rigged device. The polite reflex: walk them to reception.

In 30 seconds

Where it happens
In a corridor, near a door, in a meeting room or an open-plan office, when someone moves around alone without a visible badge.
What the attacker wants
To get in and plug in a device3.
The reflex
Ask politely who the person is here to see, walk them to reception without leaving them alone, then alert reception or security.
If it has already happened
If you left a stranger alone or answered their questions, report it to reception, to security or to the IT team.

What it is

A person walking through the offices without a visible badge is not necessarily an intruder: they may be a lost visitor or a new colleague. They may also be someone counting on employees' politeness to get further than reception.

This page explains why the situation counts as social engineering and what an employee can do without confrontation: approach the person courteously, walk them back to reception, and alert reception or security.

Straight answers

Why does a simple visitor without a badge raise a cybersecurity problem?

NIST defines social engineering as deceiving a person to obtain sensitive information, unauthorized access or fraud, by gaining their trust1. A person without a badge may be looking for access obtained through an employee's trust.

What can someone who has entered the premises do?

The sources cited here mostly describe the addition of hardware. MITRE describes attackers who physically introduce accessories, network hardware or other devices into a system or network to gain access to it3. The functions cited range from passive network sniffing to keystroke injection and the addition of a wireless access point3.

Is it a theoretical risk?

MITRE notes that public references to use by attacker groups are rare, but that many audit teams use it for initial access3. One case is cited: the DarkVishnya group physically connected a Bash Bunny, a Raspberry Pi, netbooks and cheap laptops to an organization's environment to reach its local network3.

Should you be wary of someone who seems legitimate?

Yes, politely. CISA describes an attacker who looks harmless and respectable, and who may pose as a new employee, a repair person or a researcher, even presenting credentials to support that identity2. Appearance therefore proves nothing2. Only a check with reception or with the person being visited provides proof.

What should you say, exactly?

One simple sentence is enough, for example: "Hello, can I help you? Who are you here to see? I'll walk you to reception." The tone stays that of a favor, not of a check. The aim is not to leave the person alone and to hand the verification over to reception.

1How it works1 min

A visitor with an appointment goes through reception, where their identity and the person they are here to see can be checked. A person without a badge on the upper floors has bypassed that step, deliberately or not. The employee cannot decide between the two cases, and does not have to: reception has the information to do so.

CISA reminds readers that every member of the community, friends, families, colleagues or neighbors, is a first line of defense for public safety6.

The IT risk comes next. A device plugged into the company network can add functions that a simple storage medium does not offer3. Removable media also remain a way for malware to spread: MITRE describes malware copied onto a medium that runs on insertion through the Autorun feature, including on networks disconnected from the Internet4. The same text states that mobile devices, even USB charging cables, can be used to infect a computer4.

2What you do1 min
  • Approach the person promptly and courteously, asking who they are here to see.
  • Walk them to reception rather than pointing out the way, and do not leave them alone on the way.
  • Tell reception or security what happened, even if everything seems normal.
  • If the person claims to belong to a known organization, verification goes through reception or through a contact you already know. CISA advises verifying identity directly with the organization and being wary of unsolicited visits from people asking about employees or internal information2.
  • Do not answer questions about the company's organization, its teams or its network until you are certain of the other person's authority2.
3Pitfalls2 min

The fake contractor. CISA lists the repair person among the roles an attacker may play2. MITRE, for its part, observes that organizations often give outside contractors broad access to their internal systems, for example for air conditioning, elevators or physical security, and that this trust relationship sometimes receives less scrutiny than usual access5. Faced with someone who says they are a contractor, verification goes through reception, not through appearance.

Information that builds up. An attacker who does not get enough information from one person may approach another in the same organization, relying on what the first one said to seem more credible2. An innocuous answer given in a corridor can be used in the next conversation.

Embarrassment. Fearing to offend a visitor is natural. The wording that helps: offer to walk the person, which remains a gesture of hospitality. NIST describes social engineering as gaining the person's trust1.

Following someone through. Letting a person in behind you at a badge-controlled door spares them the stop at reception. The rule stays the same: a person with neither badge nor escort is directed to reception.

Urgency or claimed authority. CISA points out, about emails, that a false sense of urgency is used to push someone to act without examining2. The same caution applies face to face: reception checks, however much of a hurry the person claims to be in.

Fact sheet

Identifier
CP-542
Wing
5. Office life and reflexes
Brain skill
Outsmarting Social Engineering (outsmart_social_engineering)
Brain reflex
cr-047
Diagram
G5 · Employee Decision Tree
Languages
de, en, fr
Sources
6 sources checked on 3 November 2026
Sources6 sources
  1. NIST, “social engineering - Glossary | CSRC”. https://csrc.nist.gov/glossary/term/social_engineering (accessed 3 November 2026)
  2. CISA, “Avoiding Social Engineering and Phishing Attacks”, 1 February 2021. https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks (accessed 3 November 2026)
  3. MITRE ATT&CK, “Hardware Additions, Technique T1200 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1200/ (accessed 3 November 2026)
  4. MITRE ATT&CK, “Replication Through Removable Media, Technique T1091 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1091/ (accessed 3 November 2026)
  5. MITRE ATT&CK, “Trusted Relationship, Technique T1199 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1199/ (accessed 3 November 2026)
  6. CISA, “Physical Security | Cybersecurity and Infrastructure Security Agency CISA”. https://www.cisa.gov/topics/physical-security (accessed 3 November 2026)

Cite this article

Brain, “Escorting a visitor without a badge”, Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/escorting-visitor-without-badge-reception/

BibTeX 
@misc{brain_cp542_en_2026,
  author = {Brain},
  title = {Escorting a visitor without a badge},
  year = {2026},
  howpublished = {Cyberpedia},
  url = {https://startbrain.io/cyberpedia/en/articles/escorting-visitor-without-badge-reception/},
  note = {CC BY 4.0}
}
CC BY 4.0 licence