Topic starter
11/07/2026 8:38 pm
TL;DR: Hiring has become a cyber attack surface as fake candidates use AI-generated resumes, synthetic voices and deepfakes to enter organisations, according to Incode, while Gartner projects that by 2028 one in four job candidates could be fake. Traditional hiring controls assume the applicant is a real person, and that assumption is now breaking.
Editorial analysis by NHI Mgmt Group, based on content published by Incode: “The New Threat Surface: How Hiring Became a Vector for Attack”.
By the numbers:
- By 2028, one in four job candidates could be fake, according to Gartner research cited by Incode.
Key questions
Q: What fails when hiring assumes every candidate is a real person?
A: The failure is identity assurance, not just recruitment process quality.
Q: Why do fake candidates create insider risk so quickly?
A: Because the organisation grants trust early.
Q: What are the signs that a video interview may be using a deepfake?
A: Warning signs include mismatched mouth movement and speech, unnatural facial alignment, and other visual artifacts that suggest spoofing.
Practitioner guidance
- Tighten candidate identity proofing Require stronger verification at application and interview stages, including document checks, liveness signals and cross-checks against claimed identity data before offer decisions.
- Separate hiring trust from access entitlement Prevent offer, onboarding and system access from progressing until candidate assurance reaches a defined threshold that security and HR both accept.
- Train recruiters on deepfake indicators Teach interviewers to flag video glitches, unnatural eye movement, lip-sync mismatch and inconsistent voice timing as escalation triggers, not proof on their own.
Bottom line: Hiring fraud is now an identity security problem because attackers can use synthetic applicants to enter organisations through normal recruitment channels.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 9:06 pm
Candidate verification has become an access control, not a pre-hire formality. The hiring pipeline now decides whether a person is treated as trusted before they ever touch internal systems. That means identity proofing, liveness testing and fraud detection belong in the same governance conversation as onboarding, privileged access and insider risk. The practitioner conclusion is simple: if the applicant is not real, every downstream entitlement is built on false trust.
A question worth separating out:
Q: How should organisations govern candidate verification across HR and security?
A: Treat candidate verification as a shared control with defined ownership, escalation paths and stop points. HR can manage process flow, but security should define the identity assurance threshold, the fraud indicators that trigger review and the conditions under which onboarding must pause. That keeps hiring from becoming an ungoverned access channel.
👉 Read our full editorial: Hiring fraud has become a frontline identity security risk