Your next cyber-attack could start with a polite “after you”.

Someone arrives at your office wearing a high-vis jacket and a hard hat, carrying a clipboard and looking slightly inconvenienced. They’re here to check the meter, look at a fault or meet someone from facilities. An employee holds the door. Nobody wants to delay a contractor who clearly has somewhere to be.

Within seconds, an assumption has become an access decision.

While security leaders debate AI-enabled threats, an attacker may only need a convincing story and someone willing to help. That deserves a share of the boardroom time currently going on more sophisticated scenarios.

Why Looking the Part Works

The high-vis jacket works because it gives someone a believable reason to be there. A uniform, a familiar supplier name or a claim of urgency can put people off asking questions, especially when they’re busy or not sure whether challenging a visitor is their job.

The same trick works in other channels too. An email that seems to come from the finance director, a caller claiming to be from IT support, a visitor who says the building manager is expecting them. Each relies on someone accepting authority at face value.

Once inside, someone could find an unlocked workstation, confidential documents or a device they can walk off with. A network socket might give them another way in, depending on the controls behind it. Getting past reception is no guarantee of a compromise, though it brings an attacker a step closer to systems and information.

Attackers don’t care where facilities ends and IT or security begins, so our defenses have to work across all three.

Give People Something to Say and Do

Telling employees to “be more vigilant” leaves them guessing. What are they looking for, what do they say and who backs them up if the visitor gets impatient?

Training should give people a response they can use. Question, check and report.

Question an unexpected request. Check it through an established route. Report concerns promptly, even if nothing appears to have happened.

With a visitor, that might mean contacting the named host through the internal directory and confirming the appointment before letting them in. A badge or work order helps, though it shouldn’t settle the question on its own.

Employees also need a polite line they can use without it feeling like a confrontation, such as: “Let me contact reception and get someone to help you.”

Nobody should have to put themselves at risk, so there needs to be a clear route to reception or security and someone there to respond.

Make Verification Normal

This is much harder to keep up when leaders treat themselves as the exception.

When a senior executive strolls past access checks because everyone knows them, staff learn that status beats procedure. And if a receptionist gets criticized for holding up an important visitor, that lesson will outlast any awareness campaign.

Leaders should be seen following the same rules and backing employees who check unfamiliar requests. Checking who someone is should come across as good service.

The same goes for mistakes. Anyone who realises they’ve let in an unverified visitor should feel able to say so straight away. If they’re worried about embarrassment or blame, they may stay quiet, and the chance to investigate is lost.

The UK’s National Cyber Security Centre’s (NCSC) guidance makes the same point: people need easy ways to report and confidence that incidents will be investigated so the organization can learn and improve. 

Test the Journey Beyond Reception

Even good awareness won’t cover every weakness, so visitor controls should sit alongside locked workstations, restricted access to sensitive areas and technical controls that limit what an unfamiliar device or compromised account can reach.

Security teams should look at the whole journey. If someone comes in through a loading bay, where can they get to? If a contractor needs one room, what stops them reaching the next? And when their contract ends, who takes away their building pass and system access?

Facilities, HR, IT and security need to own these questions together. Otherwise, each team ticks off its own checklist and the gaps between them stay open.

Authorized physical and social engineering exercises can test those handovers. They show where verification breaks down, whether concerns reach the right person and how quickly the organization responds.

What you want at the end is something specific to fix, such as a clearer escalation route, a changed access process or a technical control that limits exposure, plus evidence that the next attempt would be harder.

Don’t Lose Sight of the Basics

AI needs serious attention, and security leaders still have to assess new capabilities and adapt their defenses.

They also need to ask whether established controls work under everyday pressure, when reception is busy, a delivery is late and someone sounds convincing.

The high-vis jacket is a reminder that an attack can start with something ordinary. A good security program gives people the confidence to pause, check the request and get help.

Looking like you belong should never be enough to get you in.