The threat walked in through the front door. Not through a zero-day exploit or a phishing campaign, but through a job application, a Zoom interview, and a welcome email with onboarding instructions. Workforce onboarding has quietly become one of the most overlooked attack surfaces in the enterprise, and it’s too big a problem for HR to solve alone.
That’s what Liminal’s Workforce Onboarding Demo Day made undeniable. Moderated by Filip Verley, Liminal’s Chief Innovation Officer, and Jennie Berry, President at Liminal, the session brought together eight vendors to demonstrate how they’re tackling synthetic identities, deepfakes, proxy candidates, and the insider fraud that follows when a fraudulent hire gets day-one access to your systems.
Here’s what we learned.
The threat has moved well beyond resume fraud
Jennie framed it plainly in her opening remarks: “Workforce onboarding has quietly become a new attack surface.”
The data backs her up. The DOJ’s 2024 indictments revealed fraudulent workers being hired remotely, issued company laptops, and using those devices to funnel money and intelligence to hostile nation-states. A joint FBI and CISA advisory followed, warning U.S. companies about North Korean nationals posing as remote IT workers at scale. Taylor Liggett, Chief Growth Officer at ID.me, added real weight to that during the session: across the employers it supports, the company has blocked 134 North Korean attacks in the past year alone.
This is not just an outlier problem for large tech firms. We’re hearing it directly from practitioners across the board — smaller teams, mid-market companies, organizations that assumed they were too small to be a target.
What’s changed is the capability of the tools available to bad actors. Deepfake video, AI-generated voice, real-time interview coaching software, and fabricated digital personas now give fraudulent candidates a realistic shot at getting through screening. Once they’re past onboarding and inside your systems, the damage is done.
Vendors are converging on the same architecture
Across eight very different products, the same pattern emerged: a persistent, biometric-anchored identity established early in the candidate journey, then carried forward across every subsequent touchpoint.
The old model was point-in-time. You run a background check. You do an I-9. You’re done. The new model is continuous. Identity established at application, confirmed at interview, verified at offer, re-checked on day one, and reasserted whenever someone touches a high-risk system. Liminal’s own Workforce IAM research backs this shift: 96% of practitioners anticipate prioritizing behavioral signals and session-based scoring within two years, with continuous verification set to become the baseline expectation.
Several vendors showed this end-to-end. HYPR‘s CEO and Co-founder, Bojan Simic, demonstrated a multi-factor onboarding flow that issues an enterprise passkey (a biometric-bound, non-shareable credential) and then layers on ongoing verification using dynamic questions drawn from the employee’s actual activity in Slack, Google Calendar, and Jira. The point: a credential that proves you are who you are today, not just who you were when you applied.
Peter James, Chief Product Officer at iProov, showed deepfake detection running live during a video interview, plus a biometric profile created at onboarding that can authenticate a frontline worker to a shared device with nothing but a face scan. No username, no password, no shared PIN scribbled on a Post-It note in a back office.
Adding to that, Socure’s Senior Solutions Consultant, Franco Summa, demonstrated passive identity checks running in the background at the application stage, before a recruiter ever sees a resume. When the signals flag risk, the candidate is routed into document verification automatically. When they don’t, the experience remains invisible. Everything is written back into the ATS in real time.
The attack surface is wider than most teams realize
Several vendors went beyond biometrics to surface less obvious risks.
Donovan Stevens, Principal Sales Engineer at SpyCloud, showed something genuinely striking: using criminal underground data, infostealers, and breach records to cross-reference whether a candidate is who they claim to be. An email address tied to a device infected with malware. Seven LinkedIn profiles using the same password pattern. Workday applications filed across dozens of companies from a single infected machine. The digital exhaust left by fraudulent actors often contradicts the persona they’re presenting.
His framing: “If they’ve been online long enough, they’re in our data.”
Incode’s Harsha Balakrishnan, Growth Lead, demonstrated a dynamic QR code that device-binds a verification session, meaning if someone shares a link for another person to complete on their behalf (a common pattern in North Korean proxy schemes), the session is immediately killed. It’s a precise technical countermeasure for collusion attacks that document checks alone can’t catch.
Lauren Furey, Principal Product Manager at Proof, showed how a single verified identity record can accumulate trust across the hiring lifecycle, with a persistent identity that follows the candidate through application, multiple interviews, I-9, and day-one access. The identity doesn’t have to be re-established at every checkpoint. It’s carried forward and pressure-tested when needed.
HR can’t be expected to solve this alone
One of the clearest themes across the session was organizational, not technical.
Jennie made it explicit: “HR teams are under intense pressure to fill hard-to-hire roles quickly. They are not trained fraud analysts. They are not cybersecurity experts. They shouldn’t be expected to be.”
The solution isn’t to train recruiters to spot deepfakes. It’s to build systems that surface risk signals without adding friction to the candidate experience or slowing down hiring velocity. Most of the vendors on stage have built exactly that: passive checks that run invisibly at the application stage, with escalation paths that engage candidates only when signals warrant it. The urgency is real: Liminal research finds that 94% of security professionals are focused on mitigating credential-related threats like stolen passwords and MFA bypass, yet only 44% of employees are actually using biometrics, passkeys, or FIDO2 as their primary login method. The tools exist. Adoption is the gap.
Michael Engle, Co-Founder at 1Kosmos framed the procurement conversation well: “The bad actors are attacking hiring processes, interviewing processes, and help desk calls. Every ingress point into your organization needs deterministic proof of identity. Not a token. Not an authenticator on a phone. Deterministic proof.”
The implication for enterprise security teams is straightforward: if you’re not involved in the conversation about onboarding, you’re exposed. Scattered Spider didn’t hack MGM through a zero-day. They social-engineered the help desk.
What the convergence actually means
A few years ago, identity proofing, access governance, and fraud detection were separate conversations. They’re not anymore.
What this Demo Day made clear is that the workforce identity market is converging toward a single architectural pattern: a biometric-anchored credential established at the earliest possible point in the candidate lifecycle, portable enough to carry across every subsequent system, and continuous enough to reassert trust whenever access risk is elevated.
The vendors taking market share understand that HR and security need to be in the same conversation, that candidate experience and fraud prevention are not in opposition, and that onboarding is just the first checkpoint, not the last.
The gap between what most organizations are doing today (point-in-time checks, manual I-9s, passwords emailed to personal accounts) and what the threat environment requires is significant. The tools to close that gap exist. The question is how fast organizations move.
Missed the live session? Watch the full Workforce Onboarding Demo Day recording, including all eight vendor demos and Q&A, on our Demo Day page. For deeper data on how enterprises are approaching workforce identity, read Liminal’s Index for Workforce Identity and Access Management.
