A new employee’s first week is arguably the most dangerous period of their time at a company. They have fresh credentials, they don’t really know the tools yet and they’re very keen to be useful. Attackers know this.
New-hire phishing (an email “from IT” or “from the CEO” arriving in the first few days) is a classic social engineering tactic, and public org-chart changes on LinkedIn make the targets very easy to find.
Security teams tend to focus on offboarding, and that’s entirely justified. Onboarding deserves the same level of attention and rigor.
Where onboarding creates risk
- Over-provisioned access. New staff are copied over from a colleague’s permissions “to save time” and end up with access they don’t need.
- Credential handover. Temporary passwords sent via email or chat, often never rotated.
- Unknown processes. New staff don’t yet know how to validate a request, or who to escalate to if anything looks amiss.
- Shadow tools. If there’s no clear direction, people will sign up for unapproved apps to get the job done.
- Inconsistent training. Each manager onboards in their own way, so the security steps get missed.
The day-one security playbook
Before day one
- Provision accounts via role-based templates, not by cloning a colleague.
- Apply least privilege and set review dates for any elevated access.
- Enforce MFA on first login (ideally using phishing-resistant methods such as passkeys or hardware keys).
- Enroll devices in MDM before they’re shipped or handed over.
Day one
- Deliver the credentials via a secure channel (e.g. an IdP invite or a share from your password manager). Don’t send them in plain email.
- Walk through the MFA and password manager setup with a short guided video.
- Explain how IT and security will get in touch, and how they won’t. For instance: “We will never ask for your MFA code.”
- Show precisely how to report a suspicious email or message.
Week one
- Cover approved tools for file sharing, messaging and AI assistants.
- Explain data classification in practical terms, i.e. what can go where.
- Run a light, educational phishing simulation rather than a punitive one.
- Confirm the manager has had a look at the new hire’s access.
Day 30
- Remove any temporary or onboarding-only access.
- Get feedback on what was confusing in the security steps.
Make the secure path the easy path
New hires will follow whatever instructions are the clearest. If the security steps are tucked away in a 40-page PDF, they’ll either be missed or done incorrectly. Each security step should be a short guide that shows exactly what the screens look like in your IdP, your MDM portal and the reporting button.
This is where onboarding software for new hires built around guided video really helps. Guideless, for instance, lets IT record a setup task once in the browser and turn it into a narrated guide with captions.
Credentials and internal URLs can be blurred, the guide can be shared by link without the new hire needing a separate account, and IT can see who has completed each guide. If the SSO page changes, only the relevant step needs to be updated.
Standardize across managers
Security onboarding shouldn’t depend on which manager someone reports to:
- Keep a single onboarding checklist, owned jointly by HR, IT and security.
- Make security tasks non-optional items with tracked completion.
- Use the same guides for every new hire and translate them as appropriate for global teams.
Metrics to track
- Time from start date to MFA enrollment.
- Percentage of new hires provisioned from role templates rather than cloned access.
- Report rate on the first phishing simulation.
- Number of access exceptions still open at day 30.
- Onboarding-related helpdesk tickets in the first two weeks.
The takeaway
Onboarding is the moment you’re setting a new employee’s security habits for years. Provision carefully, enforce strong authentication on their very first login and make every security step as short, visual and specific to your own tools as possible.
The aim is that by the end of week one, the secure way of working is just the way they work.
