Zero Trust Architecture effectively verifies users after they are established but has a critical gap during onboarding when trust must be decided without strong authentication. Attackers can exploit this by using fraudulent identities to pass hiring and onboarding processes, leading to accounts secured with MFA and trusted devices but controlled by unauthorized individuals. The FBI highlights North Korean persistent threats using false identities to gain remote access. The report advocates for robust identity proofing before issuing credentials, including government-issued ID validation and biometric liveness detection. Specops Secure Onboarding is presented as a solution that integrates identity verification into onboarding workflows, ensuring trust is established before access is granted. This approach reduces human error and manual trust decisions that attackers exploit. The report concludes that Zero Trust must start before the first login, addressing the identity creation phase to prevent persistent unauthorized access.

If organizations do not verify identities robustly during onboarding, attackers can create legitimate-looking accounts secured with MFA and trusted devices, gaining persistent unauthorized access. This undermines Zero Trust principles by allowing attackers to bypass strong authentication controls through initial identity fraud. The FBI has identified this as a vector exploited by North Korean threat actors to infiltrate corporate networks. The impact is a foundational security weakness that can lead to breaches despite strong post-onboarding controls.

Organizations should implement strong identity proofing during onboarding, including validation of government-issued identity documents and biometric liveness checks, before issuing credentials, MFA methods, or device access. Integrating identity verification into onboarding workflows, rather than relying on manual service desk decisions, reduces risk. Solutions like Specops Secure Onboarding can automate and enforce these verification steps. This approach ensures trust is established at the identity creation stage, closing the 'Day-One Hole' in Zero Trust Architecture. No patch is applicable as this is a process and architectural gap rather than a software vulnerability.