How Infrared Door Sensors Become a Secret Entry Point

The infrared sensor on your perimeter door might be the easiest way in.

Most perimeter doors use an infrared sensor on the inside to detect people walking up to exit, and automatically unlock for them. It's a convenience feature most building owners never think twice about. The problem is that with a can of compressed air and a small gap between the doors, that same sensor can be triggered from the outside. In the short video below, we show exactly how it works and what to do about it.

Watch the full conversation

Why this matters

A locked door feels like a closed door. That's the whole point of having one. But the locking mechanism is only one piece of a working perimeter, and on a lot of commercial buildings the weakest piece isn't the lock at all. It's the exit sensor that was added for convenience and never thought of as a security control. When that sensor can be tricked from the outside, the lock might as well not be there.

This isn't a theoretical problem. It's one of the more reliable ways our physical security testers get into client buildings, and it works against organizations of every size, including ones that have invested heavily in access control elsewhere.

How the bypass works

Most automatic exit sensors are passive infrared. They watch for movement and heat signatures on the inside of the door, and when they see something approaching they signal the lock to release. The assumption baked into the design is that nothing on the outside can reach the sensor's field of view.

That assumption falls apart if there's any gap between the doors, between the door and the frame, or under the door itself. A short blast of compressed air through that gap is enough to cause the temperature change the sensor is watching for. The sensor reports motion, the lock releases, and the door opens from the outside as if someone were walking up from the inside. There's no force involved, no tool that looks suspicious, and no trace left behind.

What to do about it

There are two ways to close this gap, and either one works. Pick whichever is easier to implement on your building.

Eliminate the gaps. Astragals, weather stripping, and properly aligned door frames cut off the path that compressed air or other tools need to reach the sensor. This is usually the cheaper fix, and on doors that are also being addressed for energy efficiency or sound dampening it's something the facilities team may already be planning.

Add a second technology to the unlock decision. Dual-technology setups require more than one signal before the lock will release. That might mean pairing the infrared sensor with a motion detector mounted elsewhere, a floor mat that registers weight, or another sensor that an outside-the-door bypass can't easily reach. Infrared alone never opens the door.

How common this really is

If you've never had your physical perimeter tested by an outside team, there's a good chance this issue exists somewhere on your building and nobody has flagged it. It rarely shows up in standard security reviews because the lock itself is doing exactly what it's supposed to do. The flaw lives in how the lock interacts with the rest of the door, and you only catch it by sending someone to actually try the bypass. That's the value of putting your facilities through a real physical security assessment instead of trusting that the equipment specs alone tell the whole story.

Physical Security