Notifications
Clear all
Topic starter
24/06/2026 9:20 pm
TL;DR: Workforce identity verification is gaining traction because help desk impersonation, onboarding fraud, and deepfake-enabled hiring scams are exploiting manual recovery and verification flows, according to 1Kosmos and Gartner analyst Akif Khan. The underlying issue is that legacy identity checks assume visual documents and human review remain trustworthy enough to establish access, which no longer holds.
NHIMG editorial — based on content published by 1Kosmos: workforce identity verification and the IDV imperative
By the numbers:
- More than 100 US companies in aerospace, defense, retail, and technology have fallen prey to North Korean nation-state attackers leveraging falsified identity information and deepfake technology.
- The average cost of a data breach topped $4.88 million in 2024.
Questions worth separating out
Q: How should security teams handle identity proofing for account recovery flows?
A: Use stronger verification than the access being restored warrants, especially for privileged users, remote workers, and third parties.
Q: Why do legacy MFA controls fail to stop workforce impersonation attacks?
A: Legacy MFA proves a session factor, not the legitimacy of the person behind the request.
Q: What do organisations get wrong about employee onboarding security?
A: They treat onboarding as an administrative task instead of a trust decision.
Practitioner guidance
- Redesign high-risk account recovery flows Move password reset and account recovery for privileged or remote users into higher-assurance verification paths that cannot be satisfied with email-only or SMS-only evidence.
- Separate proofing from authentication Do not treat MFA success as proof of identity.
- Audit onboarding steps for spoofable evidence Review where HR and IT teams accept scanned documents, screenshots, or messaging-app submissions, then replace them with verified workflows for high-risk hires and contractors.
What's in the full article
1Kosmos's full article covers the operational detail this post intentionally leaves for the source:
- Specific examples of workforce identity verification workflows for onboarding and account recovery
- The vendor's implementation framing for remote worker verification across different environments
- More detail on certification claims and supported standards for identity proofing
- Concentrix partnership context and the operational positioning around workforce authentication
👉 Read 1Kosmos's analysis of workforce identity verification for onboarding and recovery risk →
Workforce identity verification: what IAM teams need to know?
Explore further
25/06/2026 6:30 am
Workforce identity verification is becoming an access governance control, not a user-experience feature. The article's core lesson is that help desk recovery and onboarding are now attack surfaces, not administrative steps. Once identity proofing is bypassed, the attacker does not need to break in again because the identity event itself creates legitimacy. Practitioners should treat workforce IDV as part of access governance.
A few things that frame the scale:
- Only 19.6% of security professionals express strong confidence in their organisation's ability to securely manage non-human workload identities, according to The 2024 Non-Human Identity Security Report.
- 88.5% of organisations acknowledge that their non-human IAM practices lag behind or are merely on par with their human identity and access management efforts.
A question worth separating out:
Q: Who should own identity verification decisions across HR and IT support?
A: Ownership should sit with the identity and access function, with HR and service desk teams operating inside defined approval and escalation rules. If verification outcomes can directly create or restore access, accountability has to be explicit and auditable. Shared responsibility without clear ownership leaves recovery and onboarding exposed.
👉 Read our full editorial: Workforce identity verification is closing help desk fraud gaps
