Imagine this: Your online habits—like the personal details you share on LinkedIn or geotagged Instagram posts—become part of a job application process. Or, your history of cybersecurity practices, including how often you reset passwords, your awareness of phishing schemes, and whether you use multi-factor authentication, is weighed as heavily as a reference check.
 

Artificial intelligence (AI) has already transformed job recruitment. Many companies use AI to screen candidate resumes, increase job posting visibility, and generate interview questions.

What if AI’s role in hiring went beyond efficiency? What if it became a gatekeeper for cybersecurity risk? AI-assisted hiring could go beyond streamlining recruitment to actively evaluating candidates for potential security risks. In security-sensitive industries like finance, healthcare and tech, we could see hiring standards that require proof of cyber-awareness, similar to background checks or credit scores.

AI could conduct digital assessments of potential employees, analyze their cybersecurity awareness and abilities, and assign them a cybersecurity score.

As with many emerging AI applications, there are positives and negatives to this process. In industries where data protection is paramount, cybersecurity scores would help companies protect themselves from potential threats. Security-sensitive roles in fields like finance, healthcare, and technology could require applicants to meet certain cybersecurity standards before even being considered for the role.

Prospective job candidates could also use their cybersecurity scores to set themselves apart from the crowd. Monitoring your cybersecurity score over time would also allow candidates to track their progress, identify areas where security improvements are needed, and share this progress as part of an interview process.

However, this scenario also raises some ethical concerns. Should employees — or potential employees — be judged based on their past cybersecurity behaviours? While organizations have legitimate concerns about protecting sensitive information, there’s a fine line between ensuring security and avoiding privacy invasion. Overly intrusive screening methods could raise ethical and legal questions, making it essential for companies to implement transparent, fair and unbiased evaluation processes.

Employers must also ensure that potential cybersecurity scores could not be manipulated or unfairly weighted during the evaluation process. Moreover, safeguards should be in place to prevent misuse of personal data, ensuring that security assessments respect privacy rights while effectively identifying genuine cyber risks.

There’s also a risk that AI could unfairly label candidates as security risks based on limited or incomplete data. For example, a candidate who occasionally forgot to update their password could be penalized in ways that don’t reflect their actual skills or abilities. This could create an unintentional “blacklist” effect, which would unfairly impact prospective job seekers throughout their careers.

Then, there’s the issue of privacy. How much personal information should employers have access to? If a cybersecurity score is tied to personal data — such as online activity or past behavior — there’s a danger that employers could exercise too much power to scrutinize potential employees. Employers have a responsibility to avoid collecting or misusing personal data obtained from public sources.

If used responsibly, AI has the potential to significantly enhance our ability to protect against cybersecurity threats. But hiring decisions should not be left entirely to algorithms. Companies need to ensure that AI is used to assist in identifying risks, rather than making final determinations about a candidate’s suitability for a job.

The best approach is one where AI plays a supportive role in identifying potential cybersecurity risks, but where humans ultimately make the decisions. In the long run, cybersecurity awareness should be an opportunity for growth, not a digital scarlet letter that follows candidates throughout their careers.

Author Bio

Tony Anscombe is the Chief Security Evangelist for ESET. With over 20 years of security industry experience, Anscombe is an established Author, Blogger and Speaker on the current threat landscape, security technologies and products, data protection, privacy and trust, and Internet safety.

Error: No such template "/CustomCode/topleader/category"!