Enterprise Identity Security Blind Spot: The 90-Day Hiring Fraud Gap A new report from HYPR reveals a critical vulnerability in enterprise identity security: the 90-day window between hiring and onboarding, where fraudulent employees can gain legitimate access to corporate systems. According to CEO Bojan Simic, attackers no longer need to breach networks when they can pass remote interviews and obtain authentic credentials directly from IT. The lack of purpose-built verification technology means many fraudulent hires go undetected, leaving organizations exposed. Fragmented Fraud Detection While 98% of HR leaders have encountered candidate fraud, 96% believe their organizations would catch it. Yet when fraud slips through pre-hire checks, malicious actors receive credentials and network access before detection. Fraud is most commonly identified during screening, interviews, onboarding, or technical assessments averaging just 2.2 checkpoints per incident. Identity verification tools are often limited to specific events (e.g., account creation, sensitive transactions), leaving gaps where fraudulent hires operate undetected. Recruitment platforms are beginning to integrate anti-fraud features, but third-party security tools detect only 53% of identity-based and AI-driven threats. The rest rely on manual discovery, such as employee reports or audits. Even in sectors with mandated automated controls, nearly half of threats depend on manual intervention. Sector-Specific Confidence Gaps Confidence in fraud detection varies by industry. IT and telecommunications, despite their technical capabilities, rely heavily on manual observation. Education shows the widest gap between concern and confidence, while manufacturing and utilities with in-person hiring practices report higher confidence. Sales, media, and marketing stand out as the only sector where confidence exceeds concern, leaning on employees to flag suspicious activity. Ownership Gaps and Attacker Exploitation Pre-hire identity risk ownership is often unclear in practice. HR typically handles recruitment, while IT and security take over once credentials are issued. The transition period between these stages lacks a defined owner, creating opportunities for attackers to embed themselves before detection. Even after hiring, fraud may only be discovered after credentials are already issued. Costs and Reactive Responses Resolving hiring fraud incidents takes one to three weeks, incurring financial and operational costs including delayed hiring, lost productivity, security risks, and compliance violations. By the time fraud is detected, 98% of malicious hires have already received company credentials. Organizations respond with an average of 2.52 measures per incident, such as implementing identity verification tools. However, identity security spending remains largely reactive, with 60% of investments triggered by breaches rather than proactive prevention.