New-hire impersonation is exposing a gap in insider risk controls

At a glance

What this is: Proofpoint argues that new-hire impersonation is widening insider-risk exposure, especially in the first 90 days after hire when inherited access and limited visibility create a vulnerable operating window.

Why it matters: IAM, HR, and security teams need to treat onboarding as an identity governance problem, because candidate verification, access inheritance, and early monitoring now intersect with insider risk.

Context

New-hire impersonation is a governance problem before it is a fraud problem. When hiring decisions rely on digital interviews, remote screening, and inherited access, the organisation is trusting both the person and the identity presentation without enough independent verification. That creates a gap between employment workflow and identity control.

The article’s core identity-security angle is the first 90 days of employment. In that period, access is often broad, monitoring is often lighter than for established staff, and escalation paths may not yet be fully tuned between HR, IAM, and security. That combination makes early employment a predictable risk concentration, not an edge case.

Key questions

Q: What breaks when a new hire is impersonated during onboarding?

A: The organisation loses confidence that the account, the person, and the intended role all belong together. That creates a control gap between hiring, access provisioning, and insider-risk monitoring. If inherited access is granted before verification is complete, the attacker can operate as a legitimate user before anyone notices the identity mismatch.

Q: Why does the first 90 days after hire create more insider-risk exposure?

A: Because the organisation is still learning the person’s normal behaviour while often giving them broad initial access and lighter monitoring. That makes early activity hard to classify and gives a malicious insider a short but valuable window to exfiltrate data or establish trust. The risk is highest when onboarding and access governance are not tightly linked.

Q: What are the warning signs that a candidate identity may be synthetic?

A: Look for mismatches in employment history, non-working contact details, inconsistent location data, unnatural interview fluency, and hesitation when the interviewer shifts away from scripted topics. No single indicator proves fraud, but a cluster of small discrepancies should trigger deeper verification before the person receives access.

Q: How can IAM, HR, and security share responsibility for hire-to-access risk?

A: IAM, HR, and security should define who owns identity assurance before access is granted, who approves exceptions, and what evidence is required for different entitlement levels. That shared model prevents each team from assuming another already validated the candidate. The goal is one governance chain from recruitment to provisioning.

Technical breakdown

Deepfake-enabled candidate impersonation during hiring

Deepfake video, GenAI-assisted scripting, and mass application screening change the economics of impersonation. A hostile candidate no longer needs to be perfect in every answer, only credible enough to pass the organisation’s first filters. Remote interviewing amplifies the problem because teams lose the physical cues and contextual checks that used to expose inconsistency. The result is a weaker trust boundary around identity proofing, even when the organisation believes it is running a normal hiring process.

Practical implication: move identity verification controls earlier in the hiring workflow and do not treat interview performance as proof of real-world identity.

Hereditary rights and access gating in IAM

Hereditary rights are inherited access assignments copied from a previous employee into a new hire’s account or role. That approach reduces administration, but it also preserves old access patterns that may be broader than the new role needs. If access is granted before training, review, or manager validation, the account can be operational long before the person behind it has demonstrated legitimate need. This is where IAM becomes insider-risk control, not just provisioning automation.

Practical implication: gate inherited access by role validation and training completion, then review whether the copied entitlements are actually needed.

The first 90 days as an insider-risk window

The first 90 days matter because the organisation has not yet built enough behavioural baseline to distinguish normal learning from suspicious activity. A new hire may legitimately browse systems, ask for access, or make mistakes, but the same period is also attractive to a malicious insider who wants to move quickly before monitoring matures. Continuous monitoring in this window is therefore less about suspicion and more about compensating for low confidence in identity provenance and intent.

Practical implication: place every new starter into a higher-observability monitoring group until early-joiner behaviour and access needs stabilise.

Threat narrative

Attacker objective: The attacker aims to enter the organisation as a trusted new hire and use early access to steal data or establish an insider presence.

1. Entry begins with a convincing candidate persona created through deepfake media, GenAI-assisted answers, and screening evasion that gets the attacker into the hiring process.
2. Credential and access exposure follow when the organisation onboards the new hire and grants inherited rights before the person has earned or been validated for those entitlements.
3. Impact occurs when the impersonator uses early trust, broad visibility gaps, or under-monitored access to exfiltrate data or establish an insider foothold before controls mature.

Breaches seen in the wild

• Coinbase insider bribery breach 2025: Criminals bribed overseas Coinbase support agents to copy data on 69,461 customers, then tried to extort $20 million.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

New-hire impersonation is an identity governance failure, not only a hiring fraud problem. The issue is that organisations often verify whether a candidate can interview, not whether the same identity can safely receive access. Once the onboarding workflow begins, IAM and HR controls need to work together or the organisation is trusting a narrative rather than a person. Practitioners should treat onboarding identity assurance as part of insider-risk governance.

Hereditary rights create a standing trust assumption that no longer holds. Copying a predecessor’s access may be administratively efficient, but it embeds prior-role privilege into a new identity before the organisation has evidence that the access is appropriate. That is especially dangerous when training has not yet happened and when the new hire is remote. Practitioners should question inherited access as a default entitlement pattern.

The first 90 days are a distinct governance phase, not just a probation period. The article correctly frames early employment as a time when both accidental exposure and malicious behaviour can hide inside normal onboarding activity. Security teams should make the early-employment window visible in policy, monitoring, and escalation design. Practitioners should align insider-risk handling to the first 90 days as a formal control period.

Verification trust gap: the organisation assumes the interview identity, onboarding identity, and day-one identity are the same person. Deepfake-assisted impersonation breaks that assumption, and remote work makes the gap harder to notice. This is exactly where identity verification, access governance, and insider-risk monitoring converge. Practitioners should close the gap with stronger proofing, dynamic challenge steps, and tighter early-life access oversight.

What this signals

New-hire impersonation now sits at the boundary of identity verification and insider-risk management. Organisations that still treat candidate vetting as a front-end HR activity are missing the point. The control problem continues after the offer letter, because identity assurance and access governance have to stay aligned through onboarding and early employment.

Hereditary rights should be treated as provisional, not automatic. When a new hire receives the same access as the previous role holder, the organisation is inheriting someone else’s risk model as well as their entitlements. The safer approach is to make early access conditional on validation, training, and role confirmation.

The control objective is not to detect every bad actor on day one. It is to make impersonation expensive enough that the attacker cannot rely on rapid access and low scrutiny. That means higher observability, tighter gating, and explicit HR-security handoffs for the early employment window.

For practitioners

• Strengthen identity verification before offer and onboarding Use additional proofing checks for remote candidates, including live challenge questions, cross-checks of work history, and validation of contact details before employment begins.
• Remove automatic inheritance of predecessor access Review role templates so new hires do not receive the previous employee’s full entitlements by default, especially where sensitive data or admin access is involved.
• Treat the first 90 days as a high-observability period Place new starters into enhanced monitoring groups, with closer review of downloads, unusual data access, and anomalous collaboration patterns during early tenure.
• Delay sensitive access until training thresholds are met Require acceptable-use and data-handling training before granting access to sensitive systems, so inherited rights cannot be used immediately after onboarding.
• Create a clear HR and security escalation path Define who investigates candidate identity concerns, who can pause onboarding, and how suspicious behaviour is escalated when interview or day-one signals do not align.

Key takeaways

• New-hire impersonation turns onboarding into an identity assurance problem, not just a people process.
• The riskiest pattern is inherited access granted before training, validation, and monitoring are in place.
• The strongest control response is to tighten proofing, delay sensitive entitlements, and watch new starters more closely in the early employment window.

Key terms

• Hereditary Rights: Access copied from a predecessor or prior role holder during onboarding. It is convenient for administration, but risky when the new hire receives permissions before training, role-specific review, or sensitivity checks have been completed. In practice, it can expand early-life blast radius without any fresh risk assessment.
• Candidate Identity Verification: Candidate identity verification is the process of confirming that an applicant is the real person they claim to be before the hiring process advances. In practice, it combines evidence checks, liveness signals, and record updates so recruiters and security teams can rely on a shared, auditable identity state.
• First 90 Days Risk Window: The first 90 days risk window is the early employment period when a new hire’s behaviour, access needs, and trust signals are still being established. In that window, both accidental mistakes and malicious activity are harder to distinguish from normal onboarding activity.
• Insider-Risk Escalation Path: An insider-risk escalation path is the defined process for moving a concern from detection to investigation and response across HR, security, legal, and identity teams. Clear ownership matters because candidate impersonation and suspicious access decisions span multiple functions.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, human identity, and identity lifecycle controls that support stronger onboarding decisions. It helps practitioners connect identity assurance to insider-risk reduction across IAM, HR, and security workflows.