Most Americans have never heard the term behind the vulnerability — even as it becomes one of the costliest risks facing the infrastructure powering the AI boom
CUPERTINO, Calif., Aug. 25, 2026 /PRNewswire/ -- As AI-driven demand turns data centers into some of the most valuable, and most targeted, real estate in the country, a new national survey finds the physical vulnerability at the center of that risk has almost no public name. The first independent U.S. study measuring public awareness of tailgating finds that 58% of Americans have never heard the term used to describe an unauthorized person following someone else through a secured door — even as the tactic threatens infrastructure now worth billions of dollars in enterprise risk.
More than half of the roughly 17 hyperscale data center operators headquartered in the United States now rely on Alcatraz AI to secure physical access to their facilities, a concentration of trust that underscores how much is riding on getting physical security right as this infrastructure becomes mission-critical.
The mismatch matters because the badge and key-card systems that gate most corporate real estate in the U.S. have changed little since the 1990s. They authenticate a credential, not a person — a single valid badge swipe opens the door regardless of how many people walk through it. While U.S. companies have spent the past decade building layered defenses against network intrusion — multi-factor authentication, breach detection, zero-trust architecture — physical access control has largely stood still.
"Every company in America spent a decade spending billions on cybersecurity and locking down the network. We never locked down the door. How is it possible that most security still relies on a key card or badge — a 30-year-old piece of technology? This study confirms what security directors already know: buildings are vulnerable unless we empower them by upgrading technology and making the door intelligent."
— Tina D'Agostin, CEO of Alcatraz AI, who previously led physical security efforts for Chase Center and Salesforce Tower while at Johnson Controls, a $23.6 billion company and a global leader in physical security solutions
The stakes for enterprise risk
The average global cost of a data breach is $4.44 million per incident, rising to $10.22 million in the United States, according to IBM's 2025 Cost of a Data Breach Report — with the largest share of that cost driven by downtime, reputational damage, and the expense of winning back or replacing clients.
Only 12% of Americans think a building's technology or access control system bears primary responsibility for stopping an intruder — 47% still assume it's a person on duty, a mismatch with where most enterprise security budgets actually go.
76.8% of Americans either don't believe secured buildings can reliably detect an unauthorized entry (50.3%) or aren't sure (26.5%).
13% of Americans admit to sharing a badge, key card or access code with a coworker or someone else — a physical-world parallel to the password-sharing risk companies have spent years training employees against, with none of the same institutional attention.
"Hyperscale operators are among the top tech companies in the world. Of the roughly 17 hyperscale operators headquartered in the U.S., Alcatraz has signed over half of them and has rapidly become the standard to secure access to their facilities. While I'm prohibited from naming our clients, they include the largest tech companies in the world."
— Greg Sarrail, Senior VP, Alcatraz AI
Alcatraz AI has emerged as a category leader in the sectors where security standards are highest and certifications hardest to earn: hyperscale data centers, financial institutions, airports, and nuclear and energy infrastructure. Its client base extends beyond hyperscalers to Fortune 100 companies, universities, hospitals, professional sports teams in the NFL and NBA, and wealthy private individuals.
"Data centers use Alcatraz because the cost of a data breach is extremely expensive," says Sarrail. "They have to deploy the best technologies in access control." It took one tech giant four years to test Alcatraz alongside a dozen other technologies; after rigorous testing, Alcatraz was the only one chosen. Sarrail says preventing unauthorized access is critical for data centers that provide co-location services, where multiple clients are housed in a single facility. "They are ensuring that the right people have entered the right spaces — not just the right building, but the right data halls and server racks — with an auditable record of who touched what, and when," he says.
The fix: making the door intelligent
Alcatraz AI argues security breaches aren't a staffing problem — it's a technology problem. Badge and card systems are blind and make a simple yes or no decision. If a valid card is presented, it opens the door. It has no way to tell whether the person walking through is the one who owns the badge or someone who simply followed an authorized swipe through the entrance.
"Most access control reliant on badge or card technology is blind and binary: it only opens a door. It is completely unintelligent. Alcatraz harnesses AI technology to make the door intelligent without compromising employee privacy. The Rock recognizes whether someone belongs or someone doesn't. It provides real-time alerts to catch tailgating, and tells security personnel when and where a breach has occurred. Most importantly, our patented technology means employees are 100% anonymous. That is what distinguishes our tech from every other biometric on the market. And, it's magic. People just walk seamlessly from parking lot to elevator to their office. No swiping. No hassle."
— Tina D'Agostin, CEO, Alcatraz AI
Alcatraz AI's facial authentication platform is designed to work alongside a company's existing access control infrastructure rather than replace it — installing without a rip-and-replace and operational on day one — while anonymizing every face it recognizes. No photographs, no personal information stored, ever.
This summer's highest-profile physical security failures — unauthorized breaches at Harvard, UCLA, and 30 Rockefeller Center — all trace back to the same mechanism measured in this study: a valid credential, and no way to detect who followed behind it. The stakes are the same whether the door leads to a dorm room or a data center floor.
Alcatraz AI will share additional findings from this research, along with a second national study timed to the 25th anniversary of September 11 examining public sentiment on physical security since 2001, in the lead-up to and during GSX 2026, the security industry's largest annual conference, held September 14–16 in Atlanta.
About Alcatraz AI
Alcatraz is an AI-powered physical access control company headquartered in Cupertino, California. Its flagship product, the Rock™, replaces badge-based and legacy biometric security with fully anonymized facial authentication and real-time tailgating detection.
Alcatraz AI is trusted where security standards are highest and certifications hardest to earn: hyperscale data centers, financial institutions, airports, and nuclear and energy infrastructure. Its technology protects professional sports teams from the NBA to the NFL, Fortune 100 companies, universities, stadiums, and private individuals.
Share this article