The threat on HR: Detecting adversaries inside the remote workforce

The rapid shift toward remote work and globally distributed development teams has introduced a new and largely unmonitored attack surface: the workforce itself. Beyond traditional insider threats, organisations are increasingly exposed to adversaries who seek employment to gain legitimate access to systems, data, and intellectual property.

This session examines how both nation-state and financially motivated actors emulate legitimate remote workers to infiltrate enterprise environments. Drawing on observed patterns and case studies, it explores how adversaries bypass hiring and verification processes, operate through layered infrastructure and remote access tooling, and maintain persistent access while blending into normal workforce activity.

Rather than focusing solely on process or policy, this session bridges workforce risk with technical detection. It highlights the types of artefacts these operations can leave behind, including inconsistencies in network behaviour, infrastructure usage, and endpoint interaction patterns.

Attendees will gain a clearer understanding of how this threat manifests in modern environments, where traditional controls fall short, and how security teams can begin to identify and investigate potential indicators of adversary presence within their own workforce.