The First Login Happens Before Day One: Identity Proofing at the Hiring Door

In 2024 a security awareness company hired a principal software engineer. The candidate had a clean background check, passed reference verification, and got through four video interviews. His profile photo looked normal, which is not surprising, because it started life as stock imagery and was altered with AI. His identity belonged to a real person in the United States, but he was not that person. He was a North Korean operative.

The company caught him quickly, and not through HR. Its endpoint detection tooling flagged suspicious activity on his account shortly after his company laptop arrived, and the security team contained the device. The company's CEO said no data was accessed or compromised ^{[1]Security Boulevard. (2024). KnowBe4 unknowingly hires fake North Korean IT worker}.

That story gets retold as a hiring failure. I think it is better understood as an identity failure that happened before the first account was ever created. This post is about the part of the identity lifecycle most programs ignore: the stretch between "someone applied" and "someone got a laptop."

The joiner process starts earlier than the ticket

If you work in identity, you know the joiner-mover-leaver model. I covered the lifecycle in the IAM playbook, so I will not repeat it here. The point worth adding is where "joiner" really begins.

Most organizations start the clock when HR files an onboarding request. Everything upstream, the resume, the interviews, the offer, is treated as a people process rather than a security control. But by the time that ticket fires, the identity team is being asked to create an account for a person whose existence nobody has actually verified to a defensible standard.

That verification has a name: identity proofing. NIST's digital identity guidelines (SP 800-63A) break it into three steps ^{[2]NIST. (2025). Digital Identity Guidelines: Enrollment and Identity Proofing (SP 800-63A, within SP 800-63-4)}:

• Resolution: collect evidence and attributes to establish that a unique, real identity exists.
• Validation: confirm the evidence is authentic and accurate.
• Verification: confirm the applicant is the rightful owner of that evidence.

Now compare that with a typical remote hire. The resume is a claim. A background check might validate some attributes. A video call feels like verification, but it is the weakest link, because the person on screen is the thing being faked.

NIST is blunt about this. It notes that attackers increasingly pair digital injection attacks with generative AI, feeding forged video between the camera and whatever is judging it, and that all remote proofing types are vulnerable. Countermeasures it describes include detecting virtual cameras, analyzing media for manipulation, binding to known devices and adding random prompts that a human has to respond to live ^{[2]NIST. (2025). Digital Identity Guidelines: Enrollment and Identity Proofing (SP 800-63A, within SP 800-63-4)}. Notice that a standard handshake over Zoom is not on that list.

For completeness, NIST defines three assurance levels. At the low end, IAL1 supports the real-world existence of the identity. IAL2 demands stronger evidence and verification that the applicant owns it. IAL3 requires a trained agent and an on-site attended session, plus a biometric ^{[2]NIST. (2025). Digital Identity Guidelines: Enrollment and Identity Proofing (SP 800-63A, within SP 800-63-4)}. Most companies hire at something closer to "IAL zero," and then hand over production access.

This is not a rare edge case

It is tempting to file this under "exotic nation-state problem." The numbers say otherwise.

• Gartner predicts that by 2028, one in four candidate profiles worldwide could be fake. In its survey of 3,000 candidates, 6% admitted to interview fraud, meaning they either posed as someone else or had someone pose as them ^{[3]HR Dive. (2025, Aug. 8). By 2028, 1 in 4 candidate profiles will be fake, Gartner predicts}.
• Checkr surveyed 3,000 U.S. hiring managers in 2025. 31% said they had interviewed a candidate who was later revealed to be using a fake identity, and 35% said someone other than the listed applicant had taken part in a virtual interview. Only 19% were extremely confident their process would catch a fraudulent applicant ^{[4]Checkr. (2025, Sept. 16). The Hiring Hoax: What 3,000 managers revealed about AI & identity fraud in 2025}.
• The U.S. Department of Justice announced enforcement actions in November 2025 tied to North Korean remote IT worker schemes. It described more than 136 U.S. companies affected, more than 18 stolen American identities, and more than $2.2 million in revenue to the North Korean government, with facilitators in the U.S. and Ukraine who hosted company laptops to fake a domestic presence ^{[5]Crowell & Moring. (2025, Nov.). DOJ announces major enforcement actions targeting North Korean remote IT worker schemes}.

Gartner's number is a prediction, and you should treat it as one. But even the most conservative reading of the survey data points to the same thing: the interview is no longer proof of identity.

The FBI has also warned that these workers have moved beyond collecting paychecks to data theft and extortion ^{[6]ITPro. (2025, Jan. 28). FBI issues guidance for enterprises as fake North Korean IT workers wreak havoc}. That is why I frame this as a security problem and not a recruiting inconvenience. A fake employee is an insider who was granted access on purpose.

A hiring pipeline built in layers

No single control fixes this, and Gartner's own guidance is to use a multi-layered strategy ^{[3]HR Dive. (2025, Aug. 8). By 2028, 1 in 4 candidate profiles will be fake, Gartner predicts}. Here is how I would map controls onto each stage, borrowing from the FBI and DOJ guidance as well as NIST ^{[2]NIST. (2025). Digital Identity Guidelines: Enrollment and Identity Proofing (SP 800-63A, within SP 800-63-4)[5]Crowell & Moring. (2025, Nov.). DOJ announces major enforcement actions targeting North Korean remote IT worker schemes[6]ITPro. (2025, Jan. 28). FBI issues guidance for enterprises as fake North Korean IT workers wreak havoc}.

Two notes on this.

First, the last two rows are where identity engineers already live. Least privilege, device trust and behavioral monitoring are standard tools. The shift is applying them to a brand-new human the same way you would to a new service account: start narrow, expand as trust is earned. A probationary access tier for new remote hires is a perfectly reasonable use of the mover logic you already run.

Second, staffing agencies and talent marketplaces are third parties. The DOJ guidance specifically calls for tightening vendor due diligence there, because contractors and gig-based IT roles are where verification is thinnest ^{[5]Crowell & Moring. (2025, Nov.). DOJ announces major enforcement actions targeting North Korean remote IT worker schemes}. If an agency vouches for a candidate, ask how they proofed them.

One caution for anyone building this: candidate verification touches privacy and employment law. Biometric checks in particular are regulated, and Illinois' BIPA, to name the one close to home for me in Chicago, requires notice and consent. Involve HR and counsel before you add a liveness step, and apply the same checks to every candidate in a role so the process is fair as well as secure.

What changes when you are the candidate

If you are the one applying, none of this is bad news. It is an opening, because being easy to verify is quickly becoming a competitive advantage.

Hiring managers are drowning in applications that look polished and say little. ISC2's 2025 hiring study, which surveyed 929 cybersecurity hiring managers, offers a useful picture of what they respond to ^{[7]ISC2. (2025, June). 2025 Cybersecurity Hiring Trends}:

• 90% would consider a candidate with only IT work experience, and 89% would consider one with only an entry-level security certification, over one who has only a degree.
• 84% of organizations use skills-based assessments or tests for entry- and junior-level applicants.
• Teamwork, problem-solving and analytical thinking rank among the top five skills managers value, ahead of cloud and data security.
• 54% of managers have passed on a candidate because of their social media activity.

Layer in what I hear from people who hire for identity and security roles, and a consistent pattern emerges. Here is how I would use it.

Write a resume that sounds like a person. AI can help you tidy it, but boilerplate is easy to spot, and it gives reviewers no reason to believe the story is yours. Specific details, in your own voice, are hard to fake.

Back every keyword with a sentence of evidence. Listing a platform you have never touched invites exactly the follow-up question you cannot answer. If you ran a handful of scripts against a directory, say that, and do not call it deep experience. Honesty costs you a few interviews. Getting caught costs you the one you wanted.

Tailor to the job in front of you. A resume is an argument for one role. Decide deliberately which credentials help that argument, and bring up the rest in conversation if they matter.

Show attitude and aptitude. Expect scenario questions designed to see how you behave under pressure, such as being handed two top priorities by two different leaders. The strong answer is to raise the conflict openly and early. Another favorite: "here is a system you have never seen; master it quickly." The strong answer is not bluffing, it is a clear plan for how you would learn it and a willingness to try.

Make yourself verifiable. Keep your LinkedIn consistent with your resume, publish your lab notes or scripts, have references who will pick up the phone, and be comfortable on camera and, when the process calls for it, in person. In a market full of ghosts, a visible track record is proof of life.

Do not ignore the credential reality check. ISC2 found that many managers list requirements early-career candidates cannot meet, including about a third who expect a CISSP for entry-level roles, even though that certification requires five years of experience ^{[7]ISC2. (2025, June). 2025 Cybersecurity Hiring Trends}. If you see that, apply anyway, but spend your energy on hands-on proof rather than on chasing a single credential.

What I would do on Monday

If you hire: ask your security team whether anyone besides HR is involved in verifying remote candidates. Then pick two controls from the table, probably the offer-stage ID check and the first-90-days monitoring, and pilot them on one role.

If you work in identity or security: offer to help HR design a proofing step, and review how new-hire access is provisioned. Start narrow, and tie broader access to a trust milestone.

If you are job hunting: audit your own footprint. Does your resume, LinkedIn and public work tell one consistent, verifiable story? If not, fix that this week.

The identity lifecycle does not begin when the account is created. It begins when someone asks to be trusted. The sooner we treat that moment as a security decision, the fewer strangers we will hand the keys to.

References

1. Security Boulevard. (2024). KnowBe4 unknowingly hires fake North Korean IT worker. https://securityboulevard.com/2024/07/knowbe4-unknowingly-hires-fake-north-korean-it-worker/
2. NIST. (2025). Digital Identity Guidelines: Enrollment and Identity Proofing (SP 800-63A, within SP 800-63-4). https://pages.nist.gov/800-63-4/sp800-63a.html
3. HR Dive. (2025, Aug. 8). By 2028, 1 in 4 candidate profiles will be fake, Gartner predicts. https://www.hrdive.com/news/fake-job-candidates-ai/757126/
4. Checkr. (2025, Sept. 16). The Hiring Hoax: What 3,000 managers revealed about AI & identity fraud in 2025. https://checkr.com/resources/articles/hiring-hoax-manager-survey-2025
5. Crowell & Moring. (2025, Nov.). DOJ announces major enforcement actions targeting North Korean remote IT worker schemes. https://www.crowell.com/en/insights/client-alerts/doj-announces-major-enforcement-actions-targeting-north-korean-remote-it-worker-schemes
6. ITPro. (2025, Jan. 28). FBI issues guidance for enterprises as fake North Korean IT workers wreak havoc. https://www.itpro.com/security/fbi-issues-guidance-for-enterprises-as-fake-north-korean-it-workers-wreak-havoc
7. ISC2. (2025, June). 2025 Cybersecurity Hiring Trends. https://www.isc2.org/insights/2025/06/cybersecurity-hiring-trends-study