Your next costly cyber incident could begin with a job application

A cyberattack does not always begin with a suspicious link. Sometimes it begins with an excellent CV, a confident interview and a new employee asking when their laptop will arrive. Recruitment is now part of the security perimeter.

When we think about cyber threats, we tend to picture external attackers.

Someone is trying to break through the firewall, steal a password or persuade an employee to open an attachment called “Urgent invoice final FINAL.pdf”.

But there is another route into the business.

The attacker can apply for a job.

A successful candidate may receive a company device, internal credentials and access to sensitive systems. They may be introduced to colleagues who assume they have already been checked. From that point, much of their access is legitimate.

That is what makes AI recruitment fraud so serious.

The recruitment process can create its own security breach

A fake employee does not need to hack their way into the organisation.

We may create the account for them.

We may courier the laptop to them.

We may invite them to the morning meeting and apologise because their admin permissions are taking slightly longer than expected.

The initial failure happens when we accept a false identity or fabricated history. The cyber incident begins after the person is trusted.

In July 2026, The Times reported that more than 700 suspected North Korean bots had attempted to secure remote jobs at a major UK bank during June. The applicants reportedly used polished CVs, credible technical answers and convincing video interviews.

The alleged campaign started with recruitment, rather than malware.

That should change how we define the edge of the business.

Hiring and security decisions are linked

Recruitment teams ask whether someone can perform the role.

Security teams ask whether someone should have access to particular systems.

Those questions cannot be separated.

A software engineer with production access presents a different risk from an employee using basic internal tools. A finance hire with payment permissions requires different controls from someone with no access to financial systems.

We believe screening should reflect the level of access attached to the role.

A risk-based background screening programme can combine identity, employment, qualification, criminal record or financial checks where they are relevant and legally permitted.

The first question should always be the simplest: do we know who this person is?

The cost of getting it wrong can be enormous

The Recruitment and Employment Confederation has estimated that a poor mid-level hire on £42,000 could cost more than £132,000.

That is before a cyber incident enters the picture.

A deliberate insider may expose customer information, copy intellectual property, misuse payment systems or create access for other attackers. The business may need forensic support, legal advice, system remediation and regulatory reporting.

Operations may be interrupted while accounts are disabled and activity is reviewed. Customers and partners may need to be contacted. Senior leaders may need to explain how an unverified person gained trusted access.

Nobody enjoys that meeting.

AI recruitment fraud creates a combination of salary loss, recruitment cost and cyber exposure. It can also damage the confidence of customers, employees and investors.

Screening and access management should connect

Completing a background check is useful. Connecting the result to onboarding is better.

IT should know whether required checks have been completed. Privileged access should require approval. Discrepancies in identity, address or employment history should be resolved before equipment is dispatched.

The verified identity should remain linked to the employee record after hiring.

Our article on why some background screening misses identity risk explains why checking a career history is insufficient when the identity behind it remains uncertain.

An employment history check can also confirm whether claimed roles and dates match information supplied by previous employers.

Recruitment is part of cyber security now

AI recruitment fraud sits between HR, security, fraud prevention and IT.

If each team assumes another team has verified the candidate, gaps appear. Those gaps are exactly what a dishonest applicant needs.

Before we trust someone with business systems, we need evidence that they are the person they claim to be and that the professional history supporting the decision is accurate.

That protects us from an expensive hiring mistake. It also reduces the chance of inviting a cyber threat inside and giving it a calendar invite.

Explore Veremark’s background screening solution to introduce tighter verification checks and reduce the cyber and financial risks attached to new hires.