Beyond the Perimeter: How North Korea’s IT Worker Program Underscores the Need to Future-Proof Onboarding and Access

Cybersecurity has long focused on keeping attackers out. But the latest threat from North Korea shows what happens when the attacker is already inside.

Recent analysis from Okta uncovered more than 130 identities tied to North Korean IT workers attempting thousands of job interviews with companies worldwide. What began as a way to funnel foreign currency to the regime has evolved into a large-scale deception campaign aimed at embedding sanctioned workers deep inside legitimate organizations.

The pattern is alarming not because it relies on advanced malware, but because it exploits trust. It targets the weakest link in the modern enterprise: remote hiring, identity verification, and access control that stop short of proving who someone really is.

This is what every organization needs to understand. The perimeter is no longer where the risk begins or ends - it’s all about identity.

Start the Defense at the Top of the Funnel

Most enterprises think about identity verification once a candidate is close to an offer. By then, it may be too late. The flood of fraudulent resumes hitting recruiters’ inboxes every day is proof that the problem begins much earlier.

One of the strongest defenses is verifying identity when a resume is first submitted. Requiring government ID verification up front screens out fake identities before they ever reach a recruiter. It’s a simple filter that protects human time and company data while signaling that authenticity matters.

That same assurance should continue through the onboarding funnel. During interviews, verified identity can confirm that the person on camera is the same one who applied. And before Day One, a human-in-the-loop check ensures that no impostor ever receives credentials or system access.

This multi-stage workflow — verify at submission, confirm at interview, prove before completing onboarding — prevents fraud from slipping through at any layer. Proof’s platform supports each of these stages with verifiable identity assurance.

A New Kind of Insider

For years, North Korean operatives have taken contract jobs under false names, posing as remote developers, QA testers, or project managers. Okta’s research shows that the program has now expanded far beyond big tech. Roughly a quarter of targets were outside the United States, spanning finance, healthcare, government, and outsourcing.

The tactics are simple but effective. Fraudulent resumes, deep-faked interviews, and proxy logins from borrowed accounts allow impostors to bypass normal processes. Some do it for income, others to collect credentials, source code, or proprietary data. All of it strengthens the regime’s financial and cyber capabilities while undermining the trust fabric that global remote work depends on.

What makes this threat so potent is that it doesn’t need to break through a firewall. It only needs to look like everyone else.

Where Defenses Break Down

Traditional security controls are built for external threats, not impostors who start as approved hires. Recruiters rely on paper credentials, not verified identity. Onboarding processes stop once HR has checked the right boxes. Contractors and offshore teams often use shared accounts or VPNs that make it impossible to tell who’s behind the screen.

Remote work has normalized behaviors that once signaled risk. Candidates with obscured video, inconsistent time zones, or VPN logins are seen as routine. Even when something feels off, responsibility is fragmented across HR, IT, and security. By the time anyone notices, access has already been granted.

This is not a failure of process. It’s a failure of proof. Most enterprises still treat identity as a point-in-time event: once someone is hired, they are trusted indefinitely. That model no longer works.

Building a Stronger Chain of Trust

To counter deception at this level, organizations need to shift from static trust to continuous assurance. The question is no longer “Did this person pass a background check?” but “Can we prove this person is who they say they are, right now, in this action?”

Start by embedding verified identity into the onboarding process. Resume screening and background checks should be paired with digital identity verification that validates real government-issued IDs and detects reused or falsified data.

Next, carry that assurance forward into the workplace. Apply zero-trust principles to people, not just devices. Grant access in stages and re-verify identity before any sensitive action such as code pushes, fund transfers, or administrative changes.

Continuous behavioral monitoring can detect patterns that human eyes miss: sign-ins from unexpected locations, changes in typing cadence, or abnormal data movement. These are early signals of compromise that turn trust from a vulnerability into a control.

Finally, treat insider threat response as a core security discipline. Have clear playbooks for suspending credentials, isolating sessions, and escalating investigations that involve deception or sanction violations. The faster you can re-prove identity, the faster you can contain damage.

Proof’s Perspective: Continuous Identity for a Continuous Threat

At Proof, we believe the only sustainable defense is one built on verified identity. When every action on a platform is linked to a proven human, impostors lose their advantage. Our technology gives enterprises the ability to verify, record, and authorize identity with certainty in real time so trust becomes measurable, not assumed.

This isn’t just about preventing fraud. It’s about ensuring that every action inside your organization is identity-assured. That’s what keeps the chain of trust intact even as threats evolve.

Future-proofing means building systems that can adapt to deception. The DPRK IT worker campaign is only the latest example of how trust can be weaponized. The companies that win are the ones that treat identity as a living, breathing signal — verified continuously, not occasionally.

How to Future Proof Your Organization Now

Step 1: Begin with an honest audit of how your company validates identity. If your screening process relies on forms, PDFs, or visual checks, it’s already behind the threat curve. Train internal teams to recognize digital red flags and escalate anomalies instead of normalizing them.

Step 2: Review how access is provisioned and de-provisioned. Many insider risks persist simply because accounts stay active after contractors leave. Connect access decisions to verified identity, not just job titles.

Step 3: Finally, invest in continuous verification for high-risk actions. Whether it’s a code merge, fund movement, or policy change, the ability to confirm the real human behind the click is what stops insider threats from becoming insider incidents.

Nation-state actors are no longer hacking in. They are applying in. The only defense that scales with this threat is identity assurance that never stops verifying. If your business depends on people you may never meet in person, it’s time to talk to Proof about securing your chain of trust. 

Disclaimer: Proof’s products are designed solely for identity verification and fraud prevention. They are not to be used to evaluate a candidate’s qualifications, character, or suitability for employment.