Skip to content

Report 003 · August 20, 2026 · Permanent archive

Forty-one percent of surveyed enterprises report hiring and onboarding a fraudulent candidate, Gartner projects one in four candidate profiles worldwide will be fake by 2028, and no open standard yet attests that a skill was demonstrated under stated conditions.

By Ryan James York · Founder, SSX360

Candidate fraud and workforce infiltration collapse the value of self-asserted résumés. This report sources the public counts, names the missing proof-of-skill layer, and proposes PSV-1 as an open profile. The registry, verify host, badge kit, and package are not live in this publication.

The hire is a security event

Candidate fraud and workforce infiltration now sit in the same pipe as phishing and deepfake impersonation. Filing them as an HR problem leaves the security team reading the wrong queue.

  • Gartner, 2028By 2028, one in four candidate profiles worldwide will be fake. The same newsroom release reports that only 26% of job applicants trust AI will fairly evaluate them. Source: Gartner newsroom, 31 July 2025. Underlying note: Mitigate Rising Candidate Fraud Through Identity Verification, 9 April 2025.
  • GetReal Deepfake Readiness BenchmarkOf 668 IT, cybersecurity, risk, and fraud leaders surveyed in September 2025 at organisations with at least 1,000 employees, 41% say their company has hired and onboarded a fraudulent candidate. 88% encounter deepfake or impersonation attacks at least occasionally; 45% say those attacks are frequent. Only 35% list fake candidates as a primary concern. The hire already happened. The threat is still filed elsewhere. Source: GetReal, 11 December 2025.
  • CrowdStrike Famous ChollimaCrowdStrike reported a 220% year-over-year increase in Famous Chollima activity and 320 North Korean IT-worker cases in the prior year, as covered from the 2025 Threat Hunting Report briefing. Source: CyberScoop, 4 August 2025.
  • DOJ nationwide actionsFraudulent employment schemes in the Justice Department's November 2025 nationwide actions impacted more than 136 U.S. victim companies. Source: DOJ Office of Public Affairs, 14 November 2025.
  • FTC Consumer SentinelUnder business and job opportunities, the subcategory job and employment agency scams saw reported losses jump from $90 million in 2020 to $501 million in 2024. That is consumer-reported loss to job and employment agency scams, not a count of fraudulent hires inside enterprises. Source: FTC, 10 March 2025.
  • OFAC, March 12, 2026Treasury sanctioned facilitators of DPRK IT-worker fraud targeting U.S. businesses, describing government-orchestrated schemes that systematically defraud employers and fund weapons programs. Source: U.S. Department of the Treasury.
  • Huntress recruiting stackBetween September to November of 2025, Huntress reported that 23.2% of applicants were flagged as a fraud risk after adding detection to its recruiting stack. Source: Huntress, AI-enhanced candidate fraud.

Why identity and workplace checks do not close it

Identity products verify that a person matches a document or a live session. Workplace credentials verify that an organisation issued an affiliation. Both are useful. Neither attests that a named skill was demonstrated under stated conditions. Skills-first hiring removed degree screens in many pipelines without putting a checkable demonstration in their place. The movement has a credibility gap: self-asserted claims remain the data model on the résumé and the profile.

Three layers, one missing

Layer 1, skill taxonomy (CTDL, RSD and peers), is mature. Layer 2, credential container and signature (W3C Verifiable Credentials 2.0, Open Badges 3.0), is mature. Layer 3, examined demonstration with a rigor descriptor and an examiner attestation, has no open standard. Credentials and identity products remain useful. The missing piece is proof that a trial happened under disclosed conditions.

PSV-1 as a proposed profile

Proof-of-Skill Verification (PSV-1) is a proposed open profile for examiner-attested, cryptographically verifiable proof of skill. A Proof Card would profile W3C VC 2.0 and Open Badges 3.0. It would carry a PSV extension for examiner identity, trial mode, conditions, rigor tier, and an evidence hash. Signing would use Ed25519 with the eddsa-jcs-2022 cryptosuite and did:web issuers. Two rigor tiers would label honesty: tier-0 self-asserted, and tier-1 examiner-attested. Only tier 1 would claim an examined demonstration.

Attestation, not certification. An examiner would attest that a demonstration occurred under the conditions named on the card. PSV-1 would not license anyone, replace a regulated credential, or judge whether the trial design was sound. Verification would check signature, status, and registry presence. A forged card would fail visibly. Tamper-evident detection is the property on offer.

The Independence Firewall for any such registry is simple: the verifier does not sell placement and does not take a cut of a hire. The standard text would be ungated. The registry, badge mark, and conformance process would be operated separately from any hiring marketplace. That separation is the product rule, not a marketing line.

This report publishes the case for that layer. It does not ship a live PSV registry, a hosted verify API, a badge endpoint, or a PyPI package under that name. Those surfaces are not live. Claiming them here would invent the product this page is arguing for.

What ships today

The open protocol is Matrix Scroll, free permanently. The shipping pin is matrixscroll==0.7.0 on PyPI and GitHub. Ed25519 signing and offline verification ship in that release line. SSX360 sells scoped assessments that reconcile evidence against the frameworks a client already cites. A first call is a scoping conversation.

What every engagement defines

  • Framework mappings connect evidence to named control objectives. They are evidence mapping, not a certification claim. Certification comes from each scheme's accredited assessors.
  • SSX360 sells cybersecurity products and scoped services. Each proposal and report names the product, service, evidence, and limits in scope.
  • Signet-C and Signet-N are completed hardware signers supplied through direct contact. The software console animates status icons. The device display presents the current state only. Public pages do not disclose their internal architecture or customer integration details.
  • The post-quantum software path supports assessment and migration planning, including inventory against Category 5 parameter sets such as ML-DSA-87 used in CNSA 2.0 alignment work. It is not presented as a validated production cryptographic module, CNSA certification, FIPS CMVP validation, NSA approval, or as suitable for protecting sensitive production data.
  • Working with defense and government suppliers is not the same as holding an accreditation. We hold no facility clearance, no CMMC certification and no ITAR registration, and we say so before anyone asks.
  • Matrix Scroll is free under Apache-2.0. Its public verification software can be used without buying an SSX360 service.

How products and services are delivered

  • Product and service scope is written separately in each proposal, including what is supplied, what is reviewed, and what remains the buyer's responsibility.
  • Reports name the evidence, method, assumptions, and limits behind each material finding.
  • Framework alignment is presented as evidence mapping, not a certification claim.
  • We publish corrections. A finding we got wrong is amended in public, where everyone who read the original can see the change.
  • Service fees are fixed once scope is clear. Product availability and pricing are confirmed through direct contact.

Corrections

Disagree with a count here? Write to mission@ssx360.com and we amend the page in place and say what changed, on this URL, where everyone who read the original can see it. The policy this follows, and the log of every correction issued, are on the corrections page.

Working through a hire-path or workforce-infiltration timeline now? Request a call. Compare the engagements or the capability surface before the call if you need the register first.

Where we name a scheme such as PCI DSS, SOC 2 or the EU AI Act, we are describing evidence mapping, not a certification claim. Certification under any scheme named here comes from that scheme's own accredited assessors.

Permanent link · https://ssx360.com/research/proof-enters · Published by Ryan James York · matrixscroll 0.7.0