What onboarding mistakes can let cybercriminals into a company’s systems before a new hire has even settled in? The biggest risks are granting too much access too soon, treating multifactor authentication (MFA) as optional, sending setup details through unverified channels, and letting help-desk staff reset accounts without strong identity checks. “Before their first coffee” is a headline device—not evidence that first-morning compromises are common. The practical fix is to secure the whole employee account lifecycle: joining, role changes, recovery requests, and departure.
How onboarding creates an account-security risk
Onboarding brings together identity information, new accounts, access approvals, devices, and support requests. If those steps are rushed or handled through informal channels, a legitimate new hire may receive excessive permissions—or a criminal impersonating that employee may persuade staff to change login details.
As an Amazon Associate I earn from qualifying purchases.
The FBI Internet Crime Complaint Center (IC3) describes criminals posing as employees and contacting IT or help-desk staff to update login information. It also warns about phishing pages that masquerade as employer portals to collect credentials or personal data. These are documented attack patterns, not evidence that onboarding is a frequent initial breach point. In Verizon Business’s 2025 Data Breach Investigations Report, compromised credentials were an initial access vector in 22% of the breaches reviewed; that figure applies to the report’s broader breach sample, not specifically to onboarding. FBI IC3’s 2024 warning and Verizon’s 2025 DBIR provide context for why account controls matter.
Free tools Windows power users keep installed
One-click scans. No signup required.
Common onboarding mistakes—and how to correct them
Giving a new hire broad access by default
Convenience can lead to copying a predecessor’s permissions or adding someone to a group that grants far more access than the role requires. Instead, define role-based access profiles and grant only the accounts and permissions needed for the employee’s work. Privileged access should require explicit approval, have a clear business reason, and be limited to the people who need it.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Microsoft says HR-driven provisioning can reduce excessive access and access that is no longer required. Its Entra documentation describes automating account creation, updates, and deletion through joiner-mover-leaver processes. Automation helps enforce a policy; it does not replace designing roles or checking whether assigned permissions are appropriate. Microsoft’s provisioning overview explains its approach.
Making MFA optional or relying on weak fallbacks
Require MFA for business accounts, including email, file storage, and remote access. Prioritize administrators and employees who handle sensitive data when strengthening coverage. CISA ranks physical security keys highest among the methods in its guidance, followed by authenticator apps with number matching, authenticator apps with one-time codes, biometrics used with another method, and text or email codes. It identifies text or email codes as the weakest of those listed choices. This is a ranking of the described methods, not a guarantee that every identity platform supports every option.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
A FIDO2 security key can be a phishing-resistant MFA option. Before selecting a model, confirm that it works with the organization’s identity provider, operating systems, managed devices, and available ports or connection types. Decide how staff enroll a replacement key and recover access if a key is lost; a secure primary method is less useful if recovery quietly falls back to an easily intercepted code. CISA’s MFA guidance describes the methods and their relative strength.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteSending setup links or credentials through an unverified channel
A convincing message or fake employer portal can capture a new hire’s credentials or personal information. Give employees a known route to the official onboarding portal—for example, a link available through an established company directory or other independently verifiable channel. Do not rely on an unexpected message as proof that a link is legitimate.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Tell employees and support staff never to disclose passwords, PINs, or one-time codes in response to unsolicited calls, texts, or emails. If someone requests a code or personal information, independently contact the organization through a verified service line or a directory entry already known to the employee. The FBI IC3 advises independently verifying requests rather than trusting the contact details supplied in the message or call. Read the FBI IC3 public service announcement, “Cyber Criminals Target Victims Using Social Engineering Techniques” (2024).
Letting help-desk resets bypass identity checks
Account recovery can be an attack path: someone impersonating an employee may try to persuade IT or help-desk staff to change login information. The FBI specifically recommends educating help-desk and customer-support staff about social engineering and phishing.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Set verification steps before staff reset MFA, change contact details, or alter login information. Use established identity-verification procedures and independently verified contact details; do not treat familiarity with an employee’s name, title, or manager as sufficient proof. Requests that fail verification should stop and be escalated rather than handled as exceptions under time pressure.
Ignoring role changes and departures
Access that was appropriate for one job can become excessive after a team move, while accounts that remain active after departure can preserve access no longer needed. Treat joining, moving roles, and leaving as connected account-lifecycle events. Microsoft documents automated provisioning and deprovisioning, including account creation, updates, and deletion. Connect employment-status changes to account workflows where practical, log changes, and review exceptions so a failed or delayed workflow does not silently leave access in place.
Best Value
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
CISA and the National Security Agency recommend reducing, restricting, auditing, and monitoring administrative privileges. Apply those controls throughout the lifecycle: limit who can administer systems, keep records of privilege changes, and review privileged accounts rather than assuming that an earlier approval remains appropriate indefinitely. CISA and NSA’s identity and access management recommendations cover administrative-account protections.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Build a safer onboarding workflow
- Start from an authoritative employment record. Use a reliable HR or workforce source to trigger account creation and record the employee’s role, manager, and start status.
- Assign a role-based access profile. Grant only the applications and permissions required for the job. Route privileged access through a separate approval and record the reason.
- Enroll MFA before granting routine access. Require MFA on business accounts and prioritize phishing-resistant options for administrators and sensitive roles. Provide documented enrollment, replacement, and recovery procedures.
- Deliver onboarding through a verified route. Direct employees to the known company portal or an independently verifiable channel. Do not ask them to send passwords or one-time codes to staff.
- Train both new hires and support staff. Explain how to verify unexpected requests, where to report suspected phishing, and how help-desk staff must validate account recovery or contact-detail changes.
- Review access after setup and at lifecycle changes. Check actual permissions after onboarding, then revisit them when a person changes role or leaves. Record provisioning and deprovisioning changes and investigate exceptions.
What to compare when choosing controls
MFA methods
Compare phishing resistance, employee usability, recovery if a device is lost, and compatibility with the identity provider and managed devices. CISA’s ordering is useful guidance for the methods it discusses, but the best implementable choice depends on platform support and the organization’s recovery design.
Identity and lifecycle-management tools
Assess whether a service integrates with the organization’s HR source and applications, supports role-based least privilege, covers provisioning and deprovisioning, offers approval workflows, and provides useful audit records. Microsoft documents these capabilities for Entra; that documentation does not establish that one vendor is best for every organization. Product selection should follow the systems and lifecycle controls the organization actually needs.
Recommended Free Tools
What the broader credential data can—and cannot—tell you
Verizon Business’s 2025 DBIR reports several credential-related findings beyond the 22% initial-access figure. In its infostealer-infected-device data, the median share of a user’s passwords that were distinct across services was 49%. In the SSO-provider logs it analyzed, credential stuffing made up a median 19% of daily authentication attempts, with 12% for small businesses and 25% for enterprises. These figures describe the report’s particular datasets and are not rates for new hires, onboarding attacks, or all organizations. They support attention to account security, but they should not be presented as evidence that onboarding itself is a measured breach trend. Verizon Business, 2025 DBIR.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
