Zero Trust principles have profoundly reshaped enterprise security, driving significant investments in securing identities and systems. Yet, a persistent and often underestimated vulnerability remains: human error, particularly during the critical stages of onboarding and service desk interactions. These processes represent natural pressure points where agents, often with limited context, must make high-impact access decisions. Attackers need only convince one individual they are legitimate to gain a foothold, turning the traditional security model on its head. ### The Fraudulent Identity Problem The **FBI** has repeatedly warned about foreign adversaries, such as North Korean IT workers, leveraging stolen or fraudulent identities to secure remote positions and infiltrate corporate networks. These sophisticated schemes involve false identity documents, proxy infrastructure, and even U.S.-based facilitators to appear as legitimate job applicants. Unlike conventional intrusion methods where attackers steal existing credentials, these onboarding attacks involve the organization itself creating credentials for the attacker, who has successfully navigated the hiring process. This fundamentally shifts the point of compromise. The **FBI** now recommends stringent identity verification throughout the hiring process and employment of remote workers. The broader takeaway is clear: organizations must apply the same level of scrutiny to *creating* an identity as they do to *authenticating* an existing one. ### Strong MFA Has a Weak Point: Enrollment Once a new employee is onboarded, the service desk plays a crucial role in account setup. This includes activating accounts, issuing initial credentials, enrolling Multi-Factor Authentication (MFA), registering passkeys or security keys, and configuring corporate devices. If a fraudulent individual reaches this stage, even robust authentication methods won't correct the initial mistake. The attacker could end up with a fully legitimate account, secured by MFA and linked to a trusted device, all issued through standard organizational processes. Users are particularly vulnerable during this credential bootstrapping phase, often relying on weaker authentication before phishing-resistant credentials are fully registered. Attackers exploiting this window can interfere with enrollment, establish persistent access, and compromise the account before stronger controls are fully implemented. ### Day One Needs its Own Identity Verification Layer Authentication typically verifies control of a credential linked to an account. Identity proofing, however, asks a more fundamental question: Is the person in front of you the individual the organization *intends* to grant that account to? For existing employees, trusted factors like enrolled authenticators or registered devices often provide sufficient assurance for service desk requests. New hires, lacking corporate devices or established authentication factors, present a unique challenge. This necessitates a dedicated verification process for "Day One," especially when sensitive system access or the registration of foundational credentials is imminent. Strong identity proofing methods, such as validating government-issued identity documents combined with biometric liveness checks, can provide crucial assurance before the organization begins to issue trust. ### Make Identity Verification Part of the Workflow Solutions like **Specops Secure Onboarding** integrate identity verification as a mandatory step in the onboarding process, removing the subjective judgment from service desk agents. Since onboarding is the initial point of trust creation, any weakness here compromises all subsequent security controls. **Specops Secure Onboarding** combines government-issued document scanning and validation with biometric liveness detection for new hires. This provides a higher level of assurance that the individual being onboarded is genuinely who they claim to be, *before* credentials, MFA methods, devices, or application access are granted. The same principle extends post-onboarding. When an employee later contacts the service desk for assistance, **Specops Secure Onboarding** requires identity verification using trusted authentication factors before an agent can proceed. This automates the verification process, eliminating guesswork and making it an integral part of the workflow. ### Zero Trust Should Start Before the First Login Organizations have significantly improved user verification *within* their environments. The next logical step is to extend this rigorous approach to the very moment those identities are created. Trust should not be automatically granted simply because an onboarding email reached the correct inbox or a service desk agent found a caller convincing. Identity must be robustly established *before* credentials and access are issued, and then re-verified for sensitive support requests. This proactive approach ensures that the foundation of an organization's security is solid from the outset.