Insider Threat: Your next hire might be a breach

Most insider threat programmes start from the same assumption: the person was trustworthy when they joined, and something changed. Resentment, pressure, a better offer from a competitor. That model is incomplete. Increasingly, the problem is that the person was never who they claimed to be, and the first day on the payroll is the day the access begins.

Hiring is now part of your attack surface. The recruitment pipeline hands out identities, equipment, credentials and trust in a matter of days. If it can be gamed, an attacker does not need to break in. They can be onboarded.

Four ways a hire becomes a breach

The fraudulent identity. The candidate uses a stolen or fabricated identity, sometimes with AI-generated photos and polished credentials, to get a remote job. The best documented example is the North Korean IT worker scheme, which US agencies have warned about since 2022. In June 2025 the US Justice Department announced actions including searches of 29 so-called laptop farms across 16 states, and reported that operatives had obtained jobs at more than 100 US companies.
The proxy candidate. One person passes the interviews and a different person does the work, or the interview itself is assisted by a real-time AI tool or a deepfake. FBI guidance notes that an individual is sometimes employed only to pass the initial interview while someone else performs the job.
The malicious insider. A genuine employee or contractor who joins, or turns, with the intent to steal data, sabotage systems, or sell access. Motives range from financial gain to grievance to recruitment by a competitor or criminal group.
The negligent or compromised insider. Not malicious, but their credentials, device or habits give an attacker the access anyway. This is the most common category and the one least related to hiring, which is why it should not be the only one you plan for.

Scale deserves care. Gartner has forecast that by 2028 as many as one in four candidate profiles worldwide could be fake. That is a prediction, not a measurement. In the same research, 6% of the 3,000 candidates surveyed admitted to some form of interview fraud, either posing as someone else or having someone pose as them. The real prevalence in your applicant pool is unknown, which is precisely the reason to verify rather than assume.

What the KnowBe4 case teaches

In 2024, the security awareness company KnowBe4 disclosed that it had hired a principal software engineer who turned out to be a North Korean operative. The hire had passed four video interviews, a background check and reference checks, using a stolen US identity and an AI-enhanced photo. The company reportedly shipped the laptop to an address later linked to a so-called laptop farm.

What caught the problem was not the hiring process but endpoint detection. The device started loading malware as soon as it was set up, the security operations centre was alerted, and the account was contained. KnowBe4 reported that no data was lost or exfiltrated. Two lessons follow. First, standard hiring checks are not designed to defeat a determined identity fraud. Second, an organization that does not rely on a single layer, and that watches new devices from the first minute, can limit the damage even when the first layer fails. If that can happen to a security vendor, it can happen to almost anyone.

Why this is not only an HR problem

Recruiters are not equipped to detect state-grade identity fraud, and they should not be asked to carry it alone. But security teams that are absent from hiring only meet the problem after the laptop is already in the post. The control has to be shared: HR owns the process, security defines what must be verified and monitored, IT controls equipment and access, legal handles the compliance exposure, and the hiring manager is told what to look for.

There is also a legal dimension. US advisories have warned that unknowingly paying a sanctioned worker can expose a company to sanctions liability. Whatever your jurisdiction, payments to the wrong person are a compliance event as well as a security one.

Identity in depth: controls across the employment lifecycle

The FBI has stressed that no single indicator reliably identifies a fraudulent worker and recommends layered controls across the whole employment lifecycle. In practice, that looks like this.

Before the offer

Verify identity properly: check documents for inconsistencies, use an identity verification service where appropriate, and confirm that the person on video matches the document.
Contact former employers and educational institutions directly, using contact details you found yourself rather than those the candidate supplied.
For sensitive roles, require at least one in-person or witnessed step. Require cameras on, with unobscured backgrounds, during video interviews.
Watch for patterns, not single flags: reluctance to appear on camera, location or time-zone inconsistencies, requests to ship equipment to a different address, or to be paid to a third party.

On day one

Ship equipment only to a verified address, and consider an in-person or supervised first-login step for higher-risk roles.
Block unmanaged remote-access tools and hardware that let someone else operate the device, and enforce managed device posture.
Start with least privilege and widen access as the person is established, rather than granting a full role on arrival.

After onboarding

Monitor new devices closely in the first weeks: endpoint detection, unusual remote-access activity, impossible-travel or location anomalies, and unusual data movement.
Separate duties for critical actions such as production access, code release and payment changes.
Follow the same lifecycle on exit: revoke access promptly, retrieve devices, and review what the departing person could reach.

Proportionate, lawful and fair

These controls involve personal data, and in the EU they sit under GDPR and, in many countries, works council and employment-law requirements. Monitoring should be transparent, proportionate to the role and risk, and documented, with a data protection impact assessment where appropriate. It should be applied to roles and risk levels, not to individuals on suspicion.

Equally important, build the process around verifiable behaviours and documents, never around nationality or ethnicity. Profiling by origin is discriminatory, unlawful in many places, and ineffective, since the fraud exists precisely to look like a legitimate hire from anywhere. The goal is a process that treats every candidate for a given role the same way.

Making it operational

Add an insider-risk scenario to your tabletop exercises: the new hire turns out to be fraudulent. Who finds out, who decides, and how fast is access cut and legal informed?
Define which roles are high-risk, such as administrators, developers with production access, and finance, and apply stronger verification to those first.
Train recruiters and hiring managers on the common patterns, and give them a way to escalate concerns without fear of being wrong.
Measure it: time from hire to first monitored review, number of exceptions to the verification process, and time to revoke access on exit.

None of this requires treating every candidate as a suspect. It requires accepting that identity is the foundation of every other control, and that your organization hands out identity at the point of hire.

If you would like help designing an insider-risk programme, or including a hiring-fraud scenario in a tabletop exercise, get in touch through the consultation form.

Sources and further reading

These sources are news and vendor coverage of public advisories. Check the original US government and Gartner publications for exact wording and dates before citing them.