SHRM26 Debrief · Talent Management & Acquisition · #2759

HR + Cybersecurity: Partnering to Protect Hiring Integrity and Workforce Trust

with Matthew Moynahan

▶ Watch on the SHRM portal ~71 min, distilled

fake candidatesdeepfakesnation-state cyberattacks

"Hiring is the new attack surface."

What it was about

HR and cybersecurity must become strategic partners. Nation-state actors and organized crime are now running synthetic and fraudulent candidates through the hiring process at industrial scale, and the attack has shifted from technical vulnerabilities to attacks on human trust and perception, which existing identity-verification and IAM systems were never designed to catch.

By the numbers

$100 million

Cost to MGM from a social-engineering help-desk impersonation attack

80% of all breaches

Share of breaches attributed to stolen credentials

1.2 billion people / 100 million verified users / less than 10% verified

LinkedIn's platform size versus how few users are actually identity-verified

Key notes

Treat your talent acquisition and HR teams as part of the security organization, since hiring is now a direct attack surface for nation-state actors and organized crime.
Watch for clusters of candidates sharing the same mailing address, phone number, or slightly varied name/resume details — a sign of one person or group running many synthetic personas (a 'polymorphic virus' pattern applied to hiring).
Recognize that one-time identity verification (I-9, background check, passport review) only proves identity at a single moment and cannot catch deepfake substitution that happens later in the interview or employment lifecycle.

The contrarian takeThe instinct to abandon remote hiring and revert to all in-person interviews is the wrong response; the speaker argues companies should keep candidates on camera rather than go fully physical, and instead layer in continuous identity-verification technology, since video interviews plus proper verification beat a one-time in-person check.

Take this back Monday

Do this for your team

Add one unscripted, personal question (favorite restaurant, etc.) to every interview to spot coached or synthetic candidates.

Say this in your next leadership meeting

Hiring is now the attack surface, so recruiting has to work with security to continuously verify candidates, not just check IDs once at the start.

Watch out for

Assuming AI itself is causing more people to lie on resumes, rather than recognizing the real driver is organized-crime and nation-state actors industrializing fake-candidate submissions.
Relying on outdated deepfake-detection tricks like waving a hand in front of the face or flashing a light for a liveness check — modern deepfakes now defeat both.
Treating identity verification as a one-time gate at hire instead of a continuous verification process across every interview and interaction.

Fun fact · Matthew Moynahan

He's led two different cybersecurity companies as CEO through major on-premises-to-cloud business transformations.

If this landed, see these

↳ Go deeperThe Art and Science of the Interview - Navigating Pay Transparency, AI Bias, and other Hiring LandminesExtends the attack-surface idea: frontline managers now need AI-fraud and bias literacy too.⇄ The counterpointNegotiating Job Offers: Master These New Strategies to Win Over In-Demand CandidatesComplicates the security-first mindset: too much verification friction can cost you the candidate.✦ The unexpected oneThe Benefit That Quietly Shapes How Work Gets DoneSame lesson, different eyes: what looks fine on the surface often hides the real signal.