Recruiters spend their days doing exactly what security training tells everyone else not to do. They open CVs from people they have never met, click portfolio links, reply to unknown numbers and log in to a long list of platforms, often from wherever the next interview happens to be.
That openness is part of the job. Telling consultants to avoid unfamiliar senders is not a workable policy when the next message could be a good candidate. A useful security routine lets them assess applications while controlling where files go, who can access them and what happens when something looks wrong.
Why recruitment teams are worth attacking
A recruitment team holds a concentrated store of personal data: names, addresses, employment histories, right-to-work documents and salary expectations. Recruiters are also easy to reach, because their contact details are published so candidates can find them. That makes it simple to send a message that looks routine.
Working away from the desk
Coffee meetings, client visits and hot desks often involve someone else's Wi-Fi. HTTPS protects the content exchanged with properly configured websites, but the network can still see some information about where your device connects. Confirm the network name with staff and stop if a sign-in page asks you to install unfamiliar software or certificates.
Use the connection method your organisation has approved. For an independent recruiter considering a free VPN, the benefit is an encrypted tunnel for traffic routed through the service, which reduces local network visibility. It does not make a fake login safe or replace the security settings your IT team manages. Review the provider's data practices and your client obligations before using it for work; employees should not install a personal VPN to bypass company policy.
A password-protected phone hotspot is another option when mobile coverage and your data allowance permit. Test access before a client meeting, rather than discovering at the table that the applicant tracking system (ATS) or its sign-in verification is unavailable.
The physical setting matters too. Candidate files and salary details are easy to read over a shoulder in a busy café or on a train. A privacy screen filter costs little, and locking the laptop every time you step away, even for a minute, should become automatic. If you take calls about candidates in public, avoid saying full names and personal details aloud.
One recruiter, a dozen logins
A typical recruiter might use an ATS, LinkedIn Recruiter, two or three job boards, a CRM, a video interview tool and an email account before lunch. If any of those share a password, one leak becomes many.
Each account needs its own password. The practical way to manage that is with strong, unique passwords stored in a password manager, so nobody has to remember them. The National Cyber Security Centre also suggests combining three random words for passwords you do need to type from memory, such as the one that unlocks the password manager itself.
A password manager also helps with phishing. It checks the website address before offering a saved password, which helps with look-alike login pages. If autofill unexpectedly fails, check the address before copying a password manually. Do not override that warning by pasting the password into an unverified page.
Shared team logins deserve particular attention. When five consultants use one job board account, it is harder to tell who changed what, and a departing employee still knows the password. Individual accounts, even where they cost more, make access easier to manage and remove.
Email is the account that unlocks the rest
If an attacker gets into a recruiter's email, the NCSC warns that they can reset the passwords for other accounts linked to it. That turns one compromised inbox into access to the ATS, the job boards and the CRM.
Turn on two-step verification for email first, then for every platform that offers it. Use the strongest method your organisation and platform support; phishing-resistant options such as security keys or passkeys are worth prioritising where available. It also helps to agree that any unusual request arriving by email, such as a client asking to change billing details or a colleague asking for a candidate export, is confirmed by phone before anyone acts.
Treat CVs and links as unknown files
CVs arrive as attachments from people recruiters do not know, which makes them an ideal disguise. A malicious document may ask the reader to enable macros or editing to "view the content properly". A CV should not require active code to be read. Stop and ask for a standard PDF or another approved format rather than following those prompts.
A few habits reduce the risk:
-
Use your approved, updated ATS or document viewer. Previewing a file is not a guarantee that it is harmless.
-
Never enable macros on a document from a candidate.
-
Be cautious with portfolio links that ask you to sign in before you can see anything.
-
Escalate suspicious file requests without judging a candidate solely on an unfamiliar email address or an unusual CV format.
The same caution applies to messages that appear to come from clients. A "new job brief" sent from a personal email address, or a shared document that asks you to sign in with your work account, should be checked with the client directly using contact details you already hold.
Keep candidate files inside the process
A secure login helps little if CVs are then copied into personal email, open shared folders or unapproved AI tools. Agree where applications, interview notes and identity documents belong, and give access only to people who need it for the role.
Before sharing a shortlist, check both the recipients and the fields included. A client may need employment history and interview notes without needing a full identity-document scan. Apply the organisation's retention schedule to old exports as well as the ATS; deleting a record in one system does not remove a spreadsheet saved elsewhere.
When a consultant leaves, revoke access to the relevant accounts and shared folders. If a platform forces a shared credential, record who controls it and change it when access should end. Treat that as a limitation to manage, rather than an invisible exception.
Make it easy to report a problem
Choose one contact for suspected phishing, misdirected candidate files and unexpected account activity, with a backup route if work email is unavailable. Staff should preserve the message and report what happened, including whether they opened a file or entered a password, without forwarding candidate data widely.
Under UK GDPR, an organisation acting as controller must notify the Information Commissioner's Office of a personal data breach without undue delay and within 72 hours of becoming aware, unless it is unlikely to result in a risk to people's rights and freedoms. Staff should report concerns internally straight away; assessing the reporting duty belongs to the person responsible for data protection.
Start the review with email protection, account access and the document-handling process. Then assign the remaining gaps to named owners. Some changes are simple; others need IT support or a budget. The aim is to let recruiters do their job with clear boundaries, rather than asking each consultant to make security decisions alone.
