iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
What onboarding mistakes can let cybercriminals into a company’s systems before a new hire has even settled in? The risk is less about a proven first-morning trend than about weak account controls: broad access granted too quickly, weak or optional multi-factor authentication (MFA), and support procedures that let an impostor change someone’s login. Organizations can reduce those risks by limiting access to what each role needs, requiring phishing-resistant MFA where possible, and verifying account-change requests through trusted channels.
How onboarding can expose a company
New employees need accounts and access to do their jobs, which makes onboarding a moment when identity and access decisions are made at speed. If those decisions rely on broad default permissions, unverified instructions, or easily phished login methods, an attacker may exploit the process. The FBI Internet Crime Complaint Center (IC3) describes criminals impersonating employees to persuade IT or help-desk staff to change login information, as well as phishing pages made to look like employer portals. Those are documented attack patterns; they do not establish that first-day compromise is common.
Credential security matters beyond onboarding, too. Verizon’s 2025 Data Breach Investigations Report found that compromised credentials were an initial access vector in 22% of the breaches it reviewed. That figure describes the report’s broader breach sample, not onboarding-related breaches specifically. Verizon 2025 Data Breach Investigations Report.
Grant only the access a new hire needs
Assign permissions according to the employee’s role, not convenience, a predecessor’s account, or a catch-all group. A new hire should receive the accounts and access necessary for their duties—and no more. Microsoft says HR-driven provisioning can reduce excessive access and remove access that is no longer required when organizations follow least-privilege practices. Automation helps apply consistent rules, but it does not replace designing those rules or checking the results.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Create role-based access profiles for common jobs, with a defined owner responsible for approving exceptions.
- Require explicit approval for administrative or otherwise privileged access; do not include it in a standard role by default.
- After provisioning, check the person’s actual group memberships, application access, and privileges against the approved role.
- Keep a record of approvals and changes so unexpected access can be investigated.
Microsoft documents Entra capabilities for automated account creation, updates, and deletion, including HR-driven joiner-mover-leaver processes. These are examples of lifecycle controls, not evidence that one IAM provider is best for every organization. Microsoft Entra identity provisioning.
Require MFA, and favor methods that resist phishing
Make MFA a condition of access to business accounts, including email, file storage, and remote access. CISA advises starting with administrators and employees who handle sensitive data, then extending MFA across systems. Its business guidance ranks physical security keys first among the methods it describes and identifies text or email codes as the weakest of those listed options. An MFA prompt is not automatically strong protection: methods differ in their resistance to phishing and account takeover.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
| MFA method | CISA’s relative ranking in its listed options | Practical consideration |
|---|---|---|
| Physical security key | Strongest | Check identity-provider support, device compatibility, enrollment, and a usable replacement and recovery process. |
| Authenticator app with number matching | Below physical security keys | Confirm support in the organization’s identity platform and provide clear enrollment instructions. |
| Authenticator app with one-time codes | Below number matching | Codes can still be exposed to phishing; set a recovery procedure for a lost or replaced device. |
| Biometrics used with another method | Below app-based methods | Use as part of a supported combination rather than assuming biometrics alone are a complete MFA method. |
| Text or email codes | Weakest | Avoid when stronger supported methods are available; codes can be solicited through social engineering. |
This is CISA’s ordering for the methods it describes, not a compatibility guarantee for every system. Before selecting a physical FIDO2 key, check support for the organization’s identity provider, managed devices, operating systems, and available ports. Also decide how staff will enroll a replacement if a key is lost. CISA: Use strong passwords and enable MFA.
Make onboarding links and instructions independently verifiable
Do not rely on an unsolicited email, text, or call to establish where a new hire should sign in. The FBI IC3 warns that criminals may pose as an employer or create a fake employer portal to collect credentials and personal data. Give employees a known route to the onboarding portal—for example, a bookmarked company site or a URL confirmed through a trusted contact—and tell them how to verify it independently.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Never ask employees to send passwords, PINs, or one-time codes to a person who contacts them.
- Tell employees not to share a code in response to an unexpected call, text, or email, even if the sender claims to be IT.
- If a message requests a code or personal information, contact the organization using a phone number or directory entry already known to be genuine.
- Train new hires to report suspicious onboarding messages through a clear, established channel.
The FBI IC3 specifically advises independently contacting a verified service line when someone requests a code or personal information. Its warning about impersonation is relevant to onboarding because account setup and recovery often involve contact between employees and support staff. FBI IC3, “Cyber Criminals Target Victims Using Social Engineering Techniques” (2024).
Harden help-desk identity checks and account recovery
Help-desk staff can be pressured into changing login information for someone who claims to be an employee. The FBI IC3 describes the tactic this way: “Impersonating employees is a technique in which cybercriminals obtain credentials, pose as company employees, and contact IT and/or helpdesk staff to update employee login information, and gain access to a company’s network.”
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Set a consistent identity-verification procedure for password resets, MFA resets, and changes to employee contact details. Train support staff to stop and escalate requests that fail the checks rather than treating urgency or familiarity as proof of identity. Verification should use established, independently sourced channels—not a new phone number or contact method supplied in the request itself. CISA and the NSA also recommend limiting and monitoring administrative privileges, which helps reduce the damage if an account is misused. CISA and NSA guidance on implementing phishing-resistant MFA.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Manage access through role changes and departures
Onboarding is one point in an account’s lifecycle, not a one-time access decision. When someone changes teams, update their permissions to match the new role and remove access they no longer need. When employment ends, disable accounts and revoke access promptly under a defined process. Microsoft’s provisioning guidance describes automated creation, updates, and deletion through joiner-mover-leaver workflows.
Best Value
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
- Use a reliable source of employment and role status to trigger account changes.
- Connect that source to provisioning and deprovisioning workflows where practical.
- Log changes and approvals, and review exceptions such as delayed removals or manually created accounts.
- Periodically review privileged accounts and monitor their use; remove privileges that no longer have an approved need.
Automation can make lifecycle actions more consistent, but organizations still need to define role access, handle exceptions, and review whether permissions remain appropriate. Microsoft Entra identity provisioning; CISA and NSA guidance on implementing phishing-resistant MFA.
Quick Recap
A practical onboarding security checklist
- Before access is granted: confirm the employee’s identity and role through established HR and hiring processes.
- At account creation: apply the approved role profile, exclude unnecessary privileged access, and record any approved exceptions.
- At first sign-in: require MFA enrollment before granting access; prioritize phishing-resistant methods for administrators and people handling sensitive data.
- During setup: direct the employee to a known onboarding portal and explain how to verify unexpected requests.
- For support: use documented identity checks for account recovery, MFA resets, and contact-detail changes; escalate failures.
- After onboarding: validate actual access and revisit it when the employee changes roles or leaves.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
