Human instinct caught 68% of pre-hire candidate fraud in HYPR's own survey
HYPR's September 15 survey of 500 US HR executives puts average unmonitored access for a fraudulent hire at 5.73 days, and the report's own detection figures undercut its chief executive's line about human intuition.
The Watch · Security desk
What happened
- Nearly all of the HR executives HYPR surveyed, 98%, said they had encountered candidate fraud first hand, and 89% said their concern had risen over the past two years.
- Fraudulent candidates clear pre-hire screening and take up the role in 42% of cases, according to the report.
- 98% of fraudulent hires already hold company credentials by the time post-hire fraud is detected, against the 96% of HR leaders who said their organization would catch it.
- CISA updated its Insider Threat Mitigation Guide on September 9, describing actors who use AI tools to apply for and obtain remote IT jobs with privileged access.
Why it matters
- Who's exposed exposure The entry path runs through the onboarding queue: a candidate who passes a remote interview is handed working credentials by IT, and the access stays live until a colleague or an audit flags the behaviour.
- What it costs cost Identity verification and MFA money is released after a breach in about 60% of cases, so the spending follows the incident.
- What doesn't add up contradiction The two published accounts size the pre-credential gap differently, and a defender planning containment has to decide whether the window is a fortnight or a quarter.
- Who has to decide decision Buyers weighing identity proofing at onboarding are deciding on HR recollection, because the survey measures where staff say fraud was noticed and not how any control performed.
Next story · Security · 10h ago
CISA adds Atlassian Data Center flaw CVE-2026-21589 to its exploited-vulnerabilities listConfirmed2 publishers
Among fraudulent candidates caught during the hiring process, 68% were identified by human instinct [4]. Screening accounted for 52% of pre-hire detections, interviews 45%, onboarding 42% and technical assessments 41% [5]. Companies logged an average of 2.2 checkpoints per fraud incident [14]. HYPR called that "a set of disconnected checks operating in silos" and wrote that "clearing an earlier stage offers no guarantee of identity assurance" [7][8].
"Human intuition is not a security control," HYPR chief executive and co-founder Bojan Simic said [16]. In his company's data it is the control catching most pre-hire fraud. Third-party security tools detected 53% of identity-based and AI-driven threats, and the other 47% surfaced through employee reports, internal audits and external alerts [15][25].
The credentials get issued after that. "Adversaries no longer need to breach a network when they can pass a remote interview and receive authentic credentials directly from IT," Simic said [6]. Of the fraudulent hires who start work, 3% are identified on the day they are hired, 32% within one to three days, 45% within four to six days, and 20% run for up to three weeks [12]. Multiply the pass rate by that last share and 8.4% of all fraudulent candidates hold issued credentials for as long as three weeks [26].
The two published accounts of the report size the same gap differently. Help Net Security's write-up describes a 90-day period between hiring and onboarding as the blind spot [27]. The day counts reported by Infosecurity Magazine put the entire post-hire detection distribution inside three weeks [12].
The confidence and credential figures also count different populations. One is stated confidence across all 500 respondents [2]; the other describes only the hires found to be fraudulent after onboarding [3].
Ownership explains the timing. 53% of the HR executives said they own hiring identity risk before an offer is accepted, 19% assigned it to talent acquisition, 10% each to compliance and legal and to security, and 7% to IT [17]. HYPR said this suggests many organizations assume IT and security only take responsibility for candidate identity risk after the hire [18]. In the report's account, HR owns recruitment, IT and security step in once the new hire has access, and the period between the two belongs to no one [19]. Most companies then need one to three weeks to resolve a hiring fraud incident [20].
North Korean actors have used employment at Western firms for data theft and subsequent extortion in recent years, according to Infosecurity Magazine [21]. Simic said there are "vastly more fraudulent workers embedded in organizations than current data reflects" [28]. The survey records what 500 US HR executives report [2].
What to watch
- Whether HYPR publishes sector sample sizes and the question wording behind the 42% pre-hire pass rate.
- Whether CISA's updated Insider Threat Mitigation Guide turns identity proofing at onboarding into a contractor requirement.
- Any indictment that puts a counted number of embedded fraudulent workers against Simic's claim that there are vastly more than the data shows.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence34
- Adoption26
- Hype gap+38
- Incentives84
- Confidence52
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
HYPR published its State of HR Identity Fraud Detection report on September 15, 2026.
- [2]
The study surveyed 500 US HR executives; 98% said they had experienced candidate fraud first hand.
- [3]
By the time post-hire identity fraud is detected, 98% of fraudulent hires have already received company credentials.
- [4]
Among fraudulent candidates detected during the hiring process, 68% are identified by human instinct.
- [5]
Screening (52%) and interviews (45%) are the most common pre-hire detection points, followed by onboarding (42%) and technical assessments (41%).
- [6]
"Adversaries no longer need to breach a network when they can pass a remote interview and receive authentic credentials directly from IT," said Bojan Simic, CEO of HYPR.
- [7]
HYPR wrote that a process catching fraud at every different stage "isn't really a security funnel" but "a set of disconnected checks operating in silos."
- [8]
HYPR wrote: "Because no single stage reliably stops candidate fraud, clearing an earlier stage offers no guarantee of identity assurance."
- [9]
Around 60% of identity verification and multi-factor authentication budgets are authorized only reactively, following a security breach.
- [10]
96% of HR leaders believe their organization would detect candidate fraud.
- [11]
Fraudulent candidates successfully navigate pre-hire screening and take up their roles in 42% of cases.
- [12]
Of fraudulent hires, 3% are detected on the same day they are officially hired, 32% within one to three days, 45% within four to six days, and 20% go undetected for up to three weeks.
- [13]
Fraudulent hires have an average of 5.73 days of unmonitored access to corporate networks.
- [14]
Companies identified an average of 2.2 checkpoints across fraud incidents.
- [15]
Across identity-based and AI-driven attacks, third-party security tools detect only 53% of threats; the remaining cases depend on manual discovery through employee reports, internal audits and external alerts.
- [16]
"Human intuition is not a security control," said Bojan Simic, CEO of HYPR.
- [17]
53% of HR executives surveyed took ownership for hiring identity risk before an offer is accepted, while 19% said talent acquisition is responsible, 10% compliance/legal, 10% security and 7% IT.
- [18]
HYPR said the ownership split suggests many organizations operate with the assumption that IT and security only take responsibility for candidate identity risk post hire.
- [19]
HR typically takes responsibility during recruitment while IT and security step in once a new hire receives access, and the period between these points has no defined owner.
- [20]
Most companies require at least one to three weeks to resolve a hiring fraud incident, creating costs through delayed hiring, backfilling, lost productivity, security exposure, compliance risk and team disruption.
- [21]
Gaining employment at Western firms has been a tactic extensively used by North Korean actors in recent years for purposes such as data theft and subsequent extortion.
- [22]
On September 9, CISA released an update to its Insider Threat Mitigation Guide highlighting how malicious actors use AI tools to apply for and obtain remote IT jobs to gain privileged access into enterprises.
- [23]
89% of the surveyed HR executives expressed heightened concern over hiring fraud in the past two years.
- [24]
IT and telecommunications, the most technically equipped sector in the study, relied on manual observation more heavily than any other group surveyed.
- [25]
47% of identity-based and AI-driven threats depend on manual discovery.
- [26]
8.4% of all fraudulent candidates hold issued corporate credentials for as long as three weeks.
- [27]
According to Help Net Security's account of the report, a 90-day period between hiring and onboarding is creating a blind spot in enterprise identity security.
- [28]
Simic said the lack of purpose-built verification technology means the industry is blind to the problem and that "there are vastly more fraudulent workers embedded in organizations than current data reflects."
Sources
2 independent publishers whose own reporting we read for this story.
- helpnetsecurity.com98% of fraudulent hires have company credentials by the time they’re caught
1 article · September 17, 2026
- infosecurity-magazine.comMost Fraudulent Hires Receive Credentials Before Detection
1 article · September 15, 2026
Topics and entities
Entities
- North Korean remote IT worker scheme
- Insider Threat Mitigation Guide
- CISA
- State of HR Identity Fraud Detection report