Employee onboarding is now part of the attack surface

At a glance

What this is: NHI Mgmt Group's analysis, drawing on 1Kosmos's blog post: Hiring fraud, deepfakes, and stolen identities turn employee onboarding into an identity security exposure.

Why it matters: It matters because identity teams and HR now have to verify people before credentials are granted, not after traditional onboarding checks are complete.

By the numbers:

• By 2028, one in four candidate profiles worldwide will be fake, according to Gartner research cited by 1Kosmos.
• Amazon blocked more than 1,800 suspected North Korean job applications between April 2024 and December 2025, according to Gartner research cited by 1Kosmos.

Context

Employee onboarding is the point at which a real person is turned into a trusted workforce identity, with credentials, device access, and system permissions attached to that trust decision. In this article, the primary governance problem is that the trust decision is happening too late, after candidates have already passed interviews, references, and background checks.

That delay creates an identity security gap that HR workflows were never designed to close on their own. The article frames the issue as a collaboration problem between CHRO and CISO functions, because the threat now includes stolen identities, fabricated documents, deepfakes, and state-backed actors who can pass conventional hiring controls.

Key questions

Q: What breaks when employee onboarding is treated as a normal HR process?

A: The control breaks at the trust boundary. If identity is not proven before credentials are issued, a fraudulent applicant can become a sanctioned insider with valid access, a managed device, and the ability to blend into ordinary employee workflows. That turns recruitment into an access path rather than a screening process.

Q: Why do deepfakes and impersonation attempts complicate hiring security?

A: Deepfakes and impersonation attempts weaken the assumption that a candidate record corresponds to a real person. Traditional manual checks were built for smaller-scale fraud and are not reliable against synthetic media or coached interviews. Automated proofing and liveness verification help restore an evidence trail that can be audited and enforced.

Q: How can security teams tell whether onboarding secret delivery is actually working?

A: A working process leaves a clear record of who generated the password, who retrieved it, when it expired, and whether the secret was exposed in chat or email. If you cannot trace those events end to end, delivery is happening outside governance.

Q: Should identity verification happen at offer acceptance or at hire?

A: The strongest point is before credentials are granted, but the article supports earlier checks as well, subject to local rules. Moving verification to offer acceptance or even hiring-manager interviews reduces the chance that a fake candidate reaches the access stage at all.

Technical breakdown

How fake candidate identities bypass hiring controls

The article describes a layered deception chain rather than a single weak check. Attackers use stolen identities, fabricated government documents, AI-generated photos, and deepfake video to look plausible across multiple stages of recruitment. Because each control is evaluated in isolation, a candidate can pass references, background checks, and interview screens without any one step being able to prove who is actually behind the application. The technical issue is not only document fraud. It is the absence of strong identity binding between the applicant, the interview session, and the person who later receives credentials.

Practical implication: move identity proofing into the hiring process before account creation, not after offer acceptance.

Why onboarding credentials create an insider foothold

Once a fraudulent hire receives credentials, the threat model changes from external impersonation to trusted internal access. The article shows how company-issued laptops, VPN access, and normal employee permissions can become the foothold for malware loading, lateral movement, data theft, or persistence. This is why traditional perimeter controls do not help much. The attacker is no longer arriving through a hostile channel; they are arriving through a legitimate identity lifecycle event with sanctioned access and a corporate device in hand.

Practical implication: treat credential issuance as the security control point and verify identity before access is granted.

How laptop farms and remote work conceal identity abuse

The article also points to a supporting infrastructure layer, including domestic facilitators and laptop farms. These arrangements let remote operators use company hardware while masking geography, time zone, and device ownership signals. That means location-based trust, standard shift patterns, and ordinary employee behavior analytics can all be manipulated. The issue is not just who was hired, but how the hired identity is operationalised after onboarding. In practical terms, onboarding fraud can become durable because the attacker is embedded in a legitimate employment and device workflow.

Practical implication: correlate identity proofing with device, network, and behavioral signals instead of relying on interview confidence alone.

Threat narrative

Attacker objective: The attacker wants legitimate employee access that can be used to steal data, plant malware, and maintain a trusted internal position for longer-term operations.

1. Entry occurs when a state-backed applicant uses stolen identities, fabricated documents, and deepfake interviews to pass recruitment screens and enter the hiring funnel.
2. Credential access begins when the fraudulent hire is given company-issued hardware, account credentials, and normal employee access after onboarding.
3. Escalation follows when the insider uses that trusted access to install malware, move laterally, or establish persistence inside corporate systems.
4. Impact is the theft of intellectual property, covert footholds for future operations, and in some cases support for sanctioned-state objectives.

Breaches seen in the wild

• JumpCloud breach 2023: North Korean hackers breached JumpCloud and abused its device commands framework against a few customers; all admin API keys were reset.
• Cloudflare Thanksgiving breach 2023: One service token and three service accounts left unrotated after the Okta breach gave a nation-state attacker access to Cloudflare's Atlassian systems.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Employee onboarding is now a pre-credential identity security problem, not an HR-only workflow. The article shows that background checks, references, and interviews can all be satisfied by a person who is not the real operator. That shifts onboarding from a process of administrative completion to a trust establishment event. Practitioners should treat the hiring funnel as part of identity governance, because the attack begins before the account ever exists.

Identity proofing must happen before credential issuance because the false employee is already an insider at the moment of access grant. Traditional controls assume the person behind the record has already been validated sufficiently. That assumption breaks when stolen identities and deepfakes are used to enter the workforce. The implication is not simply stronger onboarding checks, but a redefinition of where trust is created in the lifecycle.

CISO and CHRO collaboration is a control boundary issue, not just an operating model issue. HR owns recruitment mechanics, but security owns the risk created when a bad actor receives access. The article makes clear that neither team can solve this alone. Identity governance has to span recruitment, verification, access issuance, and insider-risk monitoring if the attack surface is to shrink.

Access without early verification creates identity blast radius. Once a fraudulent hire receives credentials and a managed device, the exposure expands from one compromised profile to potential lateral movement, data theft, and persistent access. That is why the decisive control is not post-hire monitoring alone. Practitioners need to narrow the blast radius by proving identity earlier and tying trust to the offer and hire decisions, not to after-the-fact detection.

Hiring fraud is becoming a repeatable state-sponsored tradecraft pattern, not a one-off exception. The combination of stolen identities, deepfake interviews, and laptop farms shows an industrialised method for converting employment processes into access paths. That makes workforce identity a governance domain in its own right. Security leaders should assume the adversary is optimising the recruitment lifecycle, which means defenders have to do the same.

What this signals

Identity proofing is moving upstream in the workforce lifecycle: organisations can no longer assume that background checks and interview panels are sufficient to establish trust. The practical shift is to verify the person before account creation, because access issuance is now the point where the attack becomes operational.

The deeper pattern is an identity blast radius problem. Once a fraudulent hire receives a laptop and credentials, the compromise is no longer limited to one bad application, because the attacker can operate as a normal employee while pursuing persistence, theft, or malware deployment.

For practitioners

• Introduce pre-credential identity verification Verify applicants at the offer or hire stage before any account, laptop, or VPN access is issued. Use document authentication plus live biometric matching so the access decision is tied to the actual person, not the application record.
• Shift recruitment risk ownership into CISO-CHRO governance Create a shared control model where HR owns process execution and security defines verification thresholds, escalation triggers, and suspicious-behaviour response for new hires.
• Extend insider-risk monitoring to new employees Watch for unauthorized remote access tools, abrupt location changes, impossible work patterns, or device behaviour that suggests the employee identity is being used by someone else.
• Correlate identity checks with device and behavioural signals Do not rely on interview performance or reference checks alone. Compare identity proofing results with device posture, login geography, and early-session activity before broad access is granted.

Key takeaways

• Employee onboarding has become an identity security control point because fake applicants can now pass standard HR screens and still receive trusted access.
• The article cites large-scale evidence of the problem, including a Gartner planning assumption that one in four candidate profiles could be fake by 2028.
• The control that matters most is early identity verification, because once credentials are issued the attacker is already inside the organisation.

Key terms

• Employee Identity Proofing: Employee identity proofing is the process of verifying that a job candidate or new hire is the real person claiming the identity. In this article’s context, it has to happen before credentials are issued, because onboarding fraud becomes an access problem once trust is converted into accounts and devices.
• Hiring Attack Surface: A hiring attack surface is the set of recruitment steps that can be abused to gain trusted access, including interviews, background checks, offer acceptance, and account provisioning. For workforce identity, it is the point where deception becomes operational if verification is too late.
• Deepfake Recruitment Fraud: Deepfake recruitment fraud uses synthetic media, stolen identities, and manipulated documents to convince an organisation that a candidate is legitimate. The risk is not merely impersonation. It is the conversion of hiring trust into internal access and long-lived insider presence.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.