Generative artificial intelligence (AI) has made much of what recruiters rely on easy to fake. A polished CV may describe experience the candidate lacks, and a confident answer to a technical question may come from a prompt rather than their own knowledge. Even a video interview no longer gives the assurance it once did.
For years, organisations have treated recruitment as an HR process, and cybersecurity entered only when the new employee received a laptop and access to corporate systems. That separation is getting harder to justify, because security teams now face a problem that starts before an employee has joined.
Recruitment is part of the attack surface
Using AI to improve an application or prepare for an interview does not make someone a security threat. The concern starts when technology is deliberately used to defeat the checks an organisation relies on to establish someone’s identity or capability.
Generative AI can produce applications tailored to a specific vacancy and help candidates answer technical questions they would otherwise struggle with. Synthetic media and voice technology add ways to manipulate remote interactions.
Remote recruitment has also removed some of the physical checks that organisations once took for granted. An organisation can now recruit, interview and onboard someone without meeting them in person. Remote hiring can be done securely, but processes designed for an earlier era may no longer provide enough assurance.
The attacker does not need to break in
Most cybersecurity strategies aim to stop unauthorised people from reaching systems. Recruitment opens another route: persuading the organisation to hand over legitimate access.
A successful candidate receives a corporate identity, an email account, a laptop and access to internal systems. Depending on the role, they could eventually handle customer information, source code or financial data. An attacker who establishes themselves as a trusted identity has no need to steal an existing employee’s credentials.
That should concern chief information security officers, because identity has become one of the most important security controls in modern organisations. Organisations invest heavily in protecting identities once they exist, but that protection depends on confidence in how each identity was established.
AI makes deception easier to scale
AI has not invented phishing or social engineering, but it has improved the quality and speed of both. Recruitment fraud follows the same pattern. Building a credible professional history, preparing convincing answers and keeping up a false persona once took a great deal of time and effort. AI removes some of that burden, and it weakens the cues people have long used to judge whether somebody is genuine.
Training recruiters to “spot AI” is therefore unlikely to hold up. The technology keeps improving, and honest candidates will use AI in their working lives anyway. Organisations are better off verifying identity and capability directly, and granting access to match.
HR and cybersecurity need to meet earlier
Not every candidate should be treated as a potential attacker, and security controls should match the risk a position carries. Roles that involve sensitive systems, privileged access or valuable data deserve closer attention from security teams.
Identity verification is the obvious starting point. Organisations should know how identities are checked during recruitment and whether those checks still hold up for remote hiring. Practical assessments matter more for technical roles. The aim is to confirm that the person being hired has the skills the organisation expects.
Onboarding is the next checkpoint, which is centred around the point that access should follow what somebody needs to perform their role. Privileged access needs tighter controls, and unusual behaviour after onboarding deserves attention even though the individual passed recruitment. Established principles such as least privilege and continuous monitoring apply from day one.
Security starts before day one
Recruitment and cybersecurity can’t run as separate processes – at least not anymore. For roles that give access to sensitive systems and data, security has to begin before the person ever joins.
Share