Cyber security now starts at the job interview, according to Richard Ford, CTO at the cyber services firm Integrity360.
For years, businesses have treated recruitment as primarily an HR process, with cyber security usually entering the picture later when a new employee receives a laptop, credentials and access to company systems. That separation is becoming harder to justify.
Generative AI is changing what organisations can reasonably trust during recruitment. A convincing CV no longer necessarily demonstrates someoneโs experience. A polished answer to a technical question may not demonstrate their knowledge. Even seeing and speaking to somebody during a remote interview may not provide the assurance it once did. For security teams, this creates a problem that starts before an employee has even joined the business.
Using AI to improve an application or prepare for an interview does not automatically make someone a security threat. The concern begins when technology is deliberately used to defeat the checks an organisation relies upon to establish someoneโs identity or capability.
Generative AI can produce convincing applications tailored to specific vacancies. It can help someone respond to technical questions they might otherwise struggle to answer. Synthetic media and voice technology create further possibilities for manipulating remote interactions.
These capabilities matter because remote recruitment has removed some of the physical checks that businesses once took for granted. An organisation may recruit, interview and onboard someone without meeting them face to face. That does not make remote hiring inherently insecure, but it does mean businesses need to reconsider whether recruitment processes designed for a different era still provide enough assurance.
The attacker doesnโt need to break in
Most cyber security strategies are built around preventing unauthorised people from gaining access to systems. Recruitment presents a different possibility. What happens if someone convinces the organisation to give them legitimate access?
A successful candidate may receive a corporate identity, email account, laptop and access to internal systems. Depending on their role, they could eventually work with customer information, source code, financial data or other sensitive assets.
This makes recruitment particularly interesting from a security perspective. The attacker does not necessarily need to compromise an existing employeeโs credentials if they can successfully establish themselves as a trusted identity. That should matter to CISOs because identity has become one of the most important security controls within modern organisations. Businesses are investing heavily in protecting identities once they exist, but that protection needs to start with confidence in how the identity was established.
AI makes deception easier to scale
There is a parallel here with what we are seeing elsewhere in cybercrime. AI has not invented phishing or social engineering, it has however improved the quality and efficiency of these attacks. The same principle applies to recruitment fraud.
Creating a credible professional history, preparing convincing responses and maintaining a false persona traditionally required significant time and effort. AI can reduce some of that burden. It also weakens some of the signals people have traditionally relied upon when deciding whether something feels genuine. This is why simply training recruiters to โspot AIโ is unlikely to be a sustainable solution. The technology will continue to improve, and genuine candidates will increasingly use AI as part of their working lives anyway.
Organisations need to move from trying to identify whether AI has been used towards verifying the things that actually matter. Is this person who they claim to be? Do they genuinely possess the capabilities required for the role? Should they receive the level of access associated with it?
HR and cyber security need to meet earlier
None of this means every candidate should be treated as a potential attacker. Security controls should be proportionate to the risk associated with the position. However, recruitment for roles involving sensitive systems, privileged access or valuable data deserves greater attention from security teams.
Identity verification is an obvious starting point. Organisations should understand how identities are checked during recruitment and whether those controls remain appropriate for remote hiring. Practical assessments can also become more important, particularly for technical roles. The objective should not be catching candidates using AI, but establishing that the person being hired genuinely has the skills the organisation expects them to have.
Onboarding then becomes another important security checkpoint. Access should be based on what somebody actually needs to perform their role rather than granted broadly for convenience. Privileged access deserves tighter controls, while unusual behaviour following onboarding should not be ignored simply because an individual has passed the recruitment process. This is where established principles such as least privilege and continuous monitoring become particularly valuable.
Trust needs to be established differently
AI is forcing businesses to reconsider some basic assumptions about trust. We are already seeing this with phishing and social engineering, where a well-written email or familiar voice can no longer provide the reassurance it once did. Recruitment is now facing the same problem.
We therefore need to stop thinking of recruitment and cyber security as separate processes. For roles that provide access to sensitive systems and data, security needs to start before the person joins, not once their account has been created.
