The share of job applicants showing indicators consistent with state-sponsored infiltration, measured by one identity vendor across two consecutive years. Sevenfold, in twelve months.
Hiring is now an attack surface.
Pindrop internal analysis of applicant indicators, 2026 vs. prior-year comparable analysis.
The interviewer is not the worker
1 · Clear the gate
A proxy passes the interview and identity check using a genuine, borrowed identity.
2 · Hand off
A different person performs the work, inheriting full trust and privileged access.
3 · Exit clean
A performance issue triggers an HR-managed exit. Laptop returned, paycheck collected.
4 · Repeat
The operation resumes under a new identity. Nothing detects the pattern.
Every control sold into this market fires once, at the gate. The adversary's entire design is to be someone else after the gate.
IBM X-Force / Flare research on DPRK IT worker operations, 2026, via HR Executive.
Why the stack cannot see it
Every control runs against the identity presented. The scheme presents a real one.
| Identity proofing | Document and biometric match | Passes — the ID is genuine |
| Liveness / deepfake | Is a real human present | Passes — a real human is present |
| Criminal background | Search on name and SSN | Passes — it searches the victim's clean record |
| Employment verification | Did they work at X | Passes — the victim genuinely worked at X |
| In-person interview | Meet them face to face | Passes — proxies appear in person too |
One documented operation ran 68 real American identities across 300+ organisations. Nothing in the stack was broken. Everything in the stack was answered correctly.
Multi-country joint advisory, 31 Jul 2026; DOJ / NBC News, Chapman prosecution, Mar 2026.
We do not verify that a work history is true.
We test whether it is possible.
Two full-time roles, two incompatible locations, one calendar. Hours no person can work. A timeline that stops and silently resumes.
Sourced from payroll and statutory records — never from the candidate, and never from an employer the candidate nominated.
Identity tools verify the moment. We verify the interval.
The layer after the gate
Every control you already run fires once, at onboarding. This is what watches the interval after — no rip-and-replace, nothing new to manage.
Evidence, not accusation
OFAC penalties attach to the employer whether or not they knew. A documented screening program is a mitigating factor — its absence is aggravating.
Impossibility detection: employment timelines physically impossible for one human to have held.
Built so findings hold up, not just detect
FCRA-grade accuracy
We operate under CRA obligations — accuracy procedures, dispute handling, adverse-action workflow. The reason HR can say yes.
Never candidate-supplied
Every input comes from independent payroll and statutory records — never the candidate, never an employer they nominated.
A published precision bar
Every alert clears a published precision bar of ≥90%, analyst-confirmed. You never get an alert we can't stand behind.
Gets sharper over time
Every monitored quarter deepens timeline coverage across your privileged roles — a role we can't fully verify today keeps getting easier to.
Identity tools verify the moment you hire. This is what keeps watching afterward — without asking your team to do anything differently.
Find out how many of your privileged roles we can already verify.
Retrospective reports start under a quarter, before you commit to anything ongoing.