Topic starter
24/06/2026 6:58 pm
TL;DR: Gartner says one in four candidate profiles worldwide could be fake by 2028, while real cases such as KnowBe4 and suspected North Korean applicants at Amazon show how stolen identities and deepfakes can get through hiring controls, according to 1Kosmos. The governance gap starts before onboarding, where identity verification must move earlier than traditional HR and security checks.
Editorial analysis by NHI Mgmt Group, based on content published by 1Kosmos: “How Nation-State Actors Are Threatening Your Hiring Process”.
By the numbers:
- By 2028, one in four candidate profiles worldwide will be fake, according to Gartner research cited by 1Kosmos.
- Amazon blocked more than 1,800 suspected North Korean job applications between April 2024 and December 2025, according to Gartner research cited by 1Kosmos.
Key questions
Q: What breaks when employee onboarding is treated as a normal HR process?
A: The control breaks at the trust boundary.
Q: Why do deepfakes and impersonation attempts complicate hiring security?
A: Deepfakes and impersonation attempts weaken the assumption that a candidate record corresponds to a real person.
Q: How can security teams tell whether onboarding secret delivery is actually working?
A: A working process leaves a clear record of who generated the password, who retrieved it, when it expired, and whether the secret was exposed in chat or email.
Practitioner guidance
- Introduce pre-credential identity verification Verify applicants at the offer or hire stage before any account, laptop, or VPN access is issued.
- Shift recruitment risk ownership into CISO-CHRO governance Create a shared control model where HR owns process execution and security defines verification thresholds, escalation triggers, and suspicious-behaviour response for new hires.
- Extend insider-risk monitoring to new employees Watch for unauthorized remote access tools, abrupt location changes, impossible work patterns, or device behaviour that suggests the employee identity is being used by someone else.
Bottom line: Employee onboarding has become an identity security control point because fake applicants can now pass standard HR screens and still receive trusted access.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 4:02 am
Employee onboarding is now a pre-credential identity security problem, not an HR-only workflow. The article shows that background checks, references, and interviews can all be satisfied by a person who is not the real operator. That shifts onboarding from a process of administrative completion to a trust establishment event. Practitioners should treat the hiring funnel as part of identity governance, because the attack begins before the account ever exists.
A question worth separating out:
Q: Should identity verification happen at offer acceptance or at hire?
A: The strongest point is before credentials are granted, but the article supports earlier checks as well, subject to local rules. Moving verification to offer acceptance or even hiring-manager interviews reduces the chance that a fake candidate reaches the access stage at all.
👉 Read our full editorial: Employee onboarding is now part of the attack surface