A survey of 500 senior IT and security decision-makers in the UK has found a significant gap between where candidate fraud happens and who is held responsible for stopping it. Entrust’s research shows that 27% of organisations have recently investigated candidate fraud, yet only 9% of companies assign primary responsibility for combating ‘workforce identity security’ to HR or the CHRO.
Instead, responsibility defaults to security and IT leaders. According to the research, 43% of organisations give this role to CISOs, 21% to CIOs, and 23% to IT teams. Just 3% pursue a shared responsibility model. With HR excluded from up to 91% of workplace identity security decisions, a gap opens that attackers can exploit.
The scale of incidents rising
The research found that 89% of organisations have experienced an identity-related incident or near miss in the past two years. Beyond candidate fraud, the incidents tracked include:
- Employee impersonation: investigated by 32% of organisations
- Access abuse tied to onboarding or role changes: 26%
- Contractor, partner and temporary worker access concerns: only 29% report being “very confident” in verification
Fully remote organisations report the highest rates of impersonation, insider threats and candidate fraud, each at 36%.
Security leaders rank candidate fraud lower than phishing
Adam Dimopoulos, CISO at Entrust, observed that “organisations have long understood the risks of identity-based attacks, but AI is accelerating the scale and sophistication of these threats while employee verification and access management have not kept pace.”
Yet security leaders surveyed are not treating candidate fraud as a top priority. Phishing and social engineering rank highest at 45% of security concerns, with stolen passwords at 40%. Candidate fraud, despite affecting 27% of the organisations surveyed, concerns only 25% of IT and security decision-makers.
Confidence in verifying identity at key moments is low. Only 38% of leaders report high confidence in verifying candidates at hiring, and 41% at onboarding. Confidence falls further for remote and hybrid access (31%) and contractor and temporary worker access (29%), the lowest in the study.
Manual verification and weak controls expose organisations
Most organisations rely on usernames and passwords (45%) or multi-factor authentication using security keys or passkeys (43%) to verify access. A further 26% use manual IT or HR verification as a primary method. The research describes this as a judgment call made under pressure, vulnerable to deepfaked video interviews, cloned voices and forged documents.
The research warns that neither passwords nor MFA verify the person using the credential—only the credential or device itself. The report expects boards to begin asking about deepfake and synthetic identity risks as attackers targeting hired identities continue to collect pay for months and quietly take source code and customer data.
Read the original: Entrust
Paul Gray is the publisher of Talent Acquisition Professional and its sister titles at Black and White Trading Ltd, including HRreview and Workplace Wellbeing Professional. He oversees the editorial programme for UK in-house talent acquisition teams.
