Access Control Vestibules Explained: Mantraps and Tailgating for Security+

An access control vestibule is a small enclosed space with two interlocking doors, positioned so that only one can be open at a time. A person enters, the outer door closes and locks, they authenticate, and only then does the inner door open.

It is a physical control that exists for one reason: to make sure exactly one authenticated person enters at a time.

You may know it as a mantrap, which is the older term. CompTIA now uses "access control vestibule" in its objectives, and both appear in exam answer choices, so recognize them as the same thing.

The Problem It Solves

Badge readers and locked doors stop people without credentials. They do nothing about tailgating and piggybacking, which is how people actually get into buildings they should not be in.

The distinction between those two terms is tested:

• Tailgating — following an authorized person through a door without their knowledge or consent. Slipping in behind someone.
• Piggybacking — the authorized person knowingly holds the door. Usually not malice; usually politeness, especially when the follower is carrying boxes, wearing a courier uniform, or looks like they belong.

Both defeat a badge reader completely, and neither is solved by better locks or stronger credentials. A vestibule solves them physically. The second door will not open while the first is open, so there is nowhere for a second person to stand unnoticed.

How They Work in Practice

Implementations vary in strictness.

Interlocking doors are the baseline — an electromechanical interlock prevents both being unlocked simultaneously.

Weight or volume sensors in the floor detect two people in a space sized for one, and hold both doors until security responds.

Optical or lidar occupancy detection counts people crossing the threshold, which is more reliable than weight for distinguishing a person from a heavy bag.

Two-factor authentication at the inner door — badge plus PIN, or badge plus biometric — because the vestibule controls how many people pass while authentication controls who.

Guard-controlled release, where an officer observes and releases the inner door manually. Higher assurance, higher cost, and slower.

Where They Are Used and What They Cost

You find them at data centre entrances, bank vaults and cash-handling areas, secure laboratories, government and classified facilities, and server rooms in regulated industries.

You do not find them at ordinary office entrances, for good reasons. They are expensive to build, they create a throughput bottleneck — one person every ten to fifteen seconds does not work for a thousand-person building at nine in the morning — they need accessibility provision for wheelchairs and mobility aids, and they require a documented fail-safe path for fire evacuation.

That last point deserves emphasis, because it is a genuine exam concept. Physical security controls must fail safe for life safety: in a fire alarm or power loss, doors unlock so people can get out, even though that means the security control is bypassed. Fail secure — locking on failure — is appropriate for a safe or a server cabinet, not for a door people stand behind. When a question pits life safety against security, life safety wins.

Where It Fits Among Physical Controls

Physical security is layered, and a vestibule is one layer among several: fencing and bollards, lighting, security guards, cameras and video surveillance, badge readers, turnstiles, locks, signage, and sensors.

Worth distinguishing the neighbours:

• Turnstile — permits one person at a time and is much faster and cheaper, but offers no authentication pause and is easier to defeat by jumping.
• Bollard — stops vehicles, not people.
• Security guard — the only control with judgement, and the only one that can challenge someone who looks wrong.
• Camera — detective, not preventive. It records the tailgating; it does not stop it.

That last distinction is the control-type question CompTIA loves: a vestibule is preventive and physical, a camera is detective, a warning sign is deterrent.

Security+ (SY0-701) Exam Tips

• Access control vestibule and mantrap are the same thing. Recognize both.
• Its purpose is preventing tailgating and piggybacking. If a scenario describes someone following an employee through a secure door, this is the control.
• Tailgating is without consent; piggybacking is with it.
• It is a preventive physical control. Be ready to classify controls as preventive, detective, deterrent, corrective, or compensating.
• Fail-safe for life safety. Doors must release in an emergency.
• Know the alternatives — turnstiles, guards, cameras — and when each is the better answer. For a high-traffic lobby, a vestibule is usually the wrong choice.
• Security awareness training is the complementary control, because the social pressure not to shut a door on someone is the real vulnerability.

SecurityX and A+ Angles

SecurityX (CAS-005) approaches it as facility design — layering physical controls around asset criticality, balancing throughput against assurance, and satisfying regulatory requirements for data centre access.

A+ (220-1201/1202) covers it in the physical security list alongside badge readers, key fobs, biometric locks, cable locks, and privacy screens. Recall level only.

Key Takeaways

• An access control vestibule is two interlocking doors that admit one authenticated person at a time.
• "Mantrap" is the older name for the same control.
• It exists to defeat tailgating and piggybacking, which badge readers cannot.
• Tailgating is without the employee's knowledge; piggybacking is with it.
• It is a preventive physical control, unlike a camera, which is detective.
• It must fail safe — life safety overrides the security function.
• Throughput is the limiting factor, which is why they guard data centres rather than lobbies.

Related reading: Insider threats