Hiring new people and onboarding them is a part of life for growing businesses. Unfortunately, too often a new employee’s first password is also a security incident waiting to happen.
New joiners, especially those in their first job, haven’t yet developed an instinct for what looks suspicious. They might struggle to identify phishing emails, fake login pages, bogus password reset requests, fake IT help desk messages, and malicious attachments disguised as onboarding documents. The first few weeks, before cybersecurity training kicks in, are the most dangerous because newcomers are more likely to make mistakes and follow instructions without asking too many questions.
The problem often starts even before day one. When IT teams prepare laptops for new joiners, sign-in credentials are frequently sent via email, messaging apps, or SMS in plain text. People rarely delete those messages, so the credentials just sit there, unencrypted, waiting to be intercepted or stolen. Handing out laptops with passwords on sticky notes is just as bad: those notes tend to live on desks forever, tacked to a monitor or a partition.
It’s also common to try to make onboarding user friendly for new hires before they arrive by setting up temporary credentials. Those first-day credentials are often simple and created using a company name, new employee name, or an easy-to-remember phrase, like “Welcome2026,” because they’re meant to be changed. Unfortunately, those temporary credentials tend to become permanent and get reused across accounts. It’s best to generate unique credentials, deliver them through a secure channel, such as a password manager, and force a reset on first login.
Other common onboarding mistakes that increase cybersecurity risk include:
- Excessive access privileges. Giving new hires full administrative or wide network access instead of following the principle of least privilege.
- Abandoned accounts. Failing to revoke access promptly when a new hire changes roles or leaves shortly after starting — for example, after not passing the probationary period.
- Delayed security training. Postponing foundational phishing and cyber hygiene training until weeks after the employee’s start date — or skipping security awareness training entirely.
- Missing security policies. Leaving new employees without clear guidelines on acceptable use of digital tools, data handling, and reporting suspicious activity.
- Unvetted devices. Allowing personal devices to connect to corporate networks without endpoint security or mobile device management (MDM).
These oversights create immediate security gaps, exposing organizational networks to insider threats and data breaches.
Companies invest heavily in firewalls, VPNs, network security platforms, and antivirus software, yet users remain the weakest link. According to Verizon’s Data Breach Investigations Report, 62% of successful breaches involve a significant human element — and few employees are more exposed than new hires. That’s why conducting a proper and secure onboarding should not be optional. A single wrong click can be enough to spread ransomware throughout the entire network or give attackers access to critical systems.
_____
ABOUT NORDPASS
NordPass is a password manager for both business and consumer clients. It’s powered by the latest technology for the utmost security. Developed with affordability, simplicity, and ease of use in mind, NordPass allows users to access passwords securely on desktops, mobile devices, and browsers. All passwords are encrypted on the device, so only the user can access them. NordPass was created by the experts behind NordVPN — the advanced security and privacy app. For more information: nordpass.com.
Join our LinkedIn group Information Security Community!
