From Interview to Day One: How Incode Secures the Full Employee Identity Lifecycle

Hiring pipelines have become a documented attack vector. The candidate who interviews for a role is not always the person who shows up on day one, and organizations are discovering that gap only after access has already been granted.

CISOs are raising the alarm. Synthetic identities, deepfake-assisted interviews, and proxy candidates are no longer edge cases. They are repeatable, scalable, and increasingly hard to detect using the identity assumptions most enterprises still rely on.

In this live demo session at Liminal's Demo Day: Workforce Onboarding in the Digital Age, Incode walked through an end-to-end demonstration of how identity verification can be embedded across the full employee journey, from a candidate applying through Workday, to an employee activating their Okta account, to a user recovering access through Microsoft Entra.

The most important insight from our session is that identity risk is not confined to a single moment. It spans every handoff in the employee lifecycle. The organizations best positioned to address it are treating identity as a continuous, reusable signal, not a one-time check that expires the moment it is performed.

Our session explores what that looks like in practice, from ATS integrations to IAM onboarding flows, and how teams across HR, IT, and security can share confidence in who is actually on the other side of every interaction.

Speakers

Harsha Balakrishnan, Workforce Growth Lead, Incode.

Key takeaways

• Identity verification can be triggered at every stage of the hiring process without leaving the ATS. Using Incode's Workday Studio integration, recruiters can initiate both passive risk checks and full document verification directly from within a job requisition, at application, interview, or offer stage, without asking candidates to use a separate platform or install an app.

• Passive, non-document checks at the application stage surface risk signals before the first interview. At the point of application, Incode runs silent checks against the phone number and email address on the applicant profile, flagging name mismatches, known bad domains, and voice-over-IP numbers. Talent teams use these as risk context during the interview process, not as automatic disqualifiers.

• The first full verification creates an identity that travels with the individual permanently. When a candidate completes document authentication plus a selfie liveness check for the first time, Incode establishes a biometric record behind the scenes. Every subsequent verification, at a later hiring stage, at IAM activation, or at credential recovery, requires only a selfie. The candidate never has to re-upload an ID document.

• IAM onboarding can be tied to the same identity established during hiring. When a new employee receives their Okta activation email, Incode prompts a selfie check rather than a full re-verification. The face captured is compared against the biometric template from the candidate stage. If it matches, the employee can set up their password and MFA factors, with full confidence that the person activating the account is the same one who went through the interview process.

• Credential recovery is as high-risk as initial access, and requires the same assurance. The demo showed Incode embedded in Microsoft Entra's forgot-password flow. Rather than allowing a reset based solely on email ownership, employees must verify their face before any credential change is made, closing the social engineering path that attackers have repeatedly used to gain access through help desk and self-service IAM workflows.

• Dynamic QR codes prevent session sharing and collusion attacks in real time. Incode's verification sessions use QR codes that refresh every ten seconds and bind to the first device that scans them. If a second device opens the same session, it is terminated immediately. During the live demo, an attendee scanned the on-screen QR code and the session was killed on the spot. This feature was built specifically in response to North Korean IT workers and other proxy actors who share verification links with off-site accomplices to defeat remote hiring controls.

• Deepfake and injection detection run continuously throughout every session, not just at document capture. Incode's Deepsight technology performs both client-side and server-side checks to identify AI-generated video, real-time face injection, and synthetic identity artifacts throughout the verification flow. In independent testing by Purdue University, Deepsight ranked first among deepfake detection solutions evaluated.

• Virtual interview links can be secured with identity verification before a candidate ever joins the session. Recruiters can input any meeting link into Incode's candidate verification module and generate an obfuscated version. To access the actual meeting, the candidate must first verify who they are, ensuring that the person who joins a technical assessment or interview is the person who was invited.

The standard for hiring has changed. The tools need to catch up. Remote work eliminated the physical checkpoints that organizations relied on for decades. A handshake, a badge scan, an in-person interview, these weren't just formalities. They were identity verification. That layer is gone, and bad actors have taken full advantage of the gap. Incode Workforce Candidate Verification closes it.

By combining government ID verification, biometric matching, liveness detection, and proprietary deepfake detection into a single hiring workflow, organizations can confirm that every candidate is exactly who they claim to be before day one. The threat is real. The technology to address it exists. The only question is whether your hiring process is ready.