Between AI usage for cheating and flat out fraud, hiring into a security team has itself become a security problem.
Our enterprise clients have shared that vetting the capability of candidates applying to join their security team is a "massive concern." And they're not wrong to take this seriously: research shows that 48% of technical roles showed signs of relying on AI to cheat in the interview process between 2025 and 2026.
Fraud takes that concern even deeper. Gartner expects that by 2028, one in four candidate profiles worldwide will be fake. Famous Chollima, the North Korean state-sponsored threat actor and cyber espionage group has indeed become famous for placing operatives inside Western companies by applying for remote roles under stolen or fabricated identity documents, VPNs and proxy infrastructure. CrowdStrike has tied the group to more than 300 incidents in 2024.
Even if teams aren't screening out a state operative in every round, they are all dealing with the fact that traditional cybersecurity hiring processes are becoming easy to fake. Generative AI can produce technically fluent and confident answers to almost anything a panel asks, live, while the candidate reads from a second screen. So how do organisations avoid these expensive mistakes?
Across TryHackMe's client base, enterprises are preventing candidates from "gaming" the system by gamifying back, using simulators and capture the flag experiences to verify real skill. Not only are they battling fraud, they're improving the efficiency of their hiring in the process.
Anti-fraud innovation spans industries
We're seeing clients innovate against cheating and applicant fraud across sectors. From managed security services providers and global professional services to health insurance and banking, organisations are asking prospective hires to demonstrate their instincts and technical ability with live "hands-on-keys" problem solving.
Hiring on a live SOC simulation
Take one managed security services provider, a firm that runs security operations for other enterprises. This year it built its external hiring around TryHackMe's SOC Simulator, a live, timed environment that drops a candidate into a working security operations centre and watches how they cope. On its first assessment day, eleven candidates worked through security operations exercises in the morning, then sat one-to-one interviews in the afternoon. Nine of the eleven walked away with offers.
The day let the panel see technical ability alongside problem-solving, communication, and composure under pressure. The director who ran it was struck by how much of that remains invisible in a standard hour of questions. How a candidate reacts when the technology misbehaves, whether they collaborate, whether they are willing to ask for help are all easily missed in traditional recruitment: he described the day as "genuinely replicating a day in a real SOC," and said "no other vendor offers anything comparable."
A hands-on interview for the technical roles
The same provider goes further for its more technical roles, with a hands-on interview of its own. For years those interviews ran on the team's own infrastructure: cloud VMs spun up for each panel, and a SIEM licence kept alive in the background that, by their own account, nobody fully owned. It was a costly admin burden to share across teams. Moving the whole thing onto TryHackMe's hosted data sets and writing their own questions over the top removed that overhead at a stroke. As the SOC manager who runs it put it, "we no longer have to normalise the information, the data is there, hosted, we just create our own questions on your data set."
Stage 1: A theory stage that tests critical thinking
The interview runs in two stages, and the first is built to remove shortcuts. It is a set of private, question-only rooms, with the candidate screen-sharing the whole way through, ruling out 'second-screen' scripting.
Some questions carry no answer box at all and are flagged with a simple instruction to the panel: "no answer needed, talk through with interviewers." The point is to hear someone reason out loud, with a focus on process over outcome. Because every question is rewritten on top of hosted data, there's no chance of pre-completing.
Stage 2: an observed live lab
The second stage is a timed, hands-on lab observed by two analysts: log investigation and correlation against cloud-style alerts, watched as the candidate works. Rooms are tiered by seniority and mapped to the tools each team actually runs, and they double later as a promotion check. As the SOC manager put it, "it's not the same test that we currently have for each role."
Two analysts stay on the call to see how the candidate behaves when the work gets difficult. Here, hands-on technical validation also becomes a culture filter: "I want to know what the person is made of," the SOC manager said. "When they start struggling do they fall apart or do they rally."
A repeatable approach based on modular building
TryHackMe's management dashboard enables teams to reuse and customise content for their contexts and needs. A room built once can be cloned, and adapted for the organisation's purposes. That same modular philosophy carries over to TryHackMe's CTF Builder, enabling hiring teams to assemble an event from a library of challenges in seconds.
The team are blunt about why the decisive part of hiring has to happen in a live environment: "you need hands on keys, AI can't do that," the SOC manager said, describing these mini CTFs as "the only way to overcome the cheating that many candidates use AI for." Running the assessment live also lets them "observe live decision making," which matters more as "the disconnect between interviews and the actual hired individual" keeps getting wider.
For teams hoping to insulate themselves against that same disconnect, the method is easy to replicate. It's the scenarios, the questions, and the scoring that remain each organisation's 'secret sauce.'
Moving past a shiny CV
The value of watching candidates live means that the team sifts beyond what résumé screening would wave straight through.
In one threat-hunter interview, the applicant was genuinely strong across two major detection platforms, yet could not carry out the investigation in the third tool, which happened to be the hiring team's priority. Team says plainly that the format "saved us a bad hire." It was the live decision-making that enabled them to spot the weakness.
Using simulators to support team mobility
A global financial services firm uses a similar approach for internal mobility, spinning up hands-on threat-hunting simulations to let analysts test-drive a new specialisation before they commit. As its SOC manager put it: "we encourage people to cross train and move across the organisation... we just spin up a few threat hunting simulations and see how it pairs with what they're doing." He frames this as a retention strategy as much as a staffing one: giving people room to cross-train and move around the organisation is, he says, "one of the main reasons we have really good retention across our global team."
Building security instincts outside the security team
The furthest extension of the idea leaves the security team behind entirely. In a different sector again, a global technology and commerce group uses the same style of hands-on challenge content to build practical cyber awareness among employees whose roles sit nowhere near security. The goal isn't finding or testing specialists. Instead, it's raising the floor of cyber literacy for a large non-technical workforce. Giving legal and business roles a tangible sense of how an attack actually unfolds rather than showing a disconnected slideshow about it.
In each context, the use case relies on a core and proven belief: that people learn and retain more by working through a realistic scenario than by being talked at.
Explore how you can de-risk your cyber workforce pipeline with TryHackMe for Business.
Joanna Duffy
