From recruiting and retention to company culture and the latest in HR tech, HR Brew delivers up-to-date industry news and tips to help HR pros stay nimble in today’s fast-changing business environment.

HR Brew

Kristen Parisi

hr-brew.com

Letters spell "Deepfake" over a pixelated background. 

FBI issues warning to beware of scammers posing as job candidates in virtual interviews.

Recruiters, beware of deepfake applicants

Email logo floating through a black and red digital space with a warning triangle and exclamation point sign in front of it

Cybersecurity

Adam DeRose

AI skills aren’t the only urgently needed skills to ready the workforce for the AI transformation. Skilling across workplace technology—not just AI—will be critical to successful AI-enablement projects, new research from Coursera and AWS finds.

The survey of technology leaders across top global firms finds that 88% agree planned AI investments will not succeed without increasing investments in skills development.

“Despite all this technological transformation and automation and speed that you know these leaders…still believe that humans are irreplaceable,” said Coursera’s CPO Marcelo Modica.

But the findings are a bit more complex. While AI upskilling is obviously important to success, technology leaders say cloud, data, and cybersecurity upskilling are also essentially needed, especially in the next three years, or AI initiatives spearheaded by organizations may underdeliver or even fail, 

A workforce with strong cloud skills remains a top priority because cloud infrastructure plays a fundamental role in every digital initiative inside the organization, including AI projects. Data skills are needed as data quality and good governance are required to successfully deploy AI solutions, and cybersecurity responsibilities will grow with expanded cloud and AI infrastructure.

“Those technical skills in themselves are changing very rapidly,” Modica told HR Brew.

 Modica told HR Brew that readying the workforce for this AI transformation calls for a new strategy for employee learning.

Learning in the AI-enabled future will require more “practical skill development, working on real projects, practicing skill assessments,” he said, and importantly “risk-free experimentation.” A culture of experimentation, innovation, and failure, “the louder the better,” will best prepare employees for participating in the future of work.

 has been thought of as something you do separately from 

Employees stop working to participate in a training program, but according to Modica, this new culture always requires learning.

“Now more than ever, these things have to be very tightly webbed together on a day-to-day basis,” he said. “From an HR perspective, this idea of continuous learning is going to be really important…As these new technologies roll out, constantly thinking about that training in a day-to-day workflow as opposed to separate.”

image of a hand pushing a learning button with a stylist pen in a digital space

Cloud, data, and cybersecurity upskilling needed amid ongoing AI transformation

AI upskilling requires foundational technology skills, and maybe a new approach to employee learning.

An illustration of a photo of HR Brew reporter Paige McGlauflin.

Paige McGlauflin

Deepfakes aren’t just something you have to worry about your uncle falling prey to while browsing his Facebook newsfeed.

As AI continues to evolve, recruiters now have to worry about candidates using 

 during interviews. Just ask Bettina Liporazzi, recruiting lead at 

, a remote digital studio that hires internationally (Liporazzi, for one, lives in Argentina).

She was contacted in mid-March by someone claiming to be an out-of-work software engineer. Though Make wasn’t hiring for their skillset, they wanted to connect, in case any relevant roles turned up in the future. After taking a quick glance at their résumé, she invited them to an introductory call.

“I’ll be honest, their résumé looked okay. I didn’t look into it with much detail, especially with how legit the companies were,” Liporazzi told HR Brew. “They reached out to me saying, ‘I’m out of a job,’ and with the market as it is, you are a human being. You want to help people.”

But from that point on, something felt off. They never accepted the Google Meet invite, and though they joined the 10-minute interview, (possibly via a private browser like Incognito, leading Google to flag them as suspicious), they did not turn on their camera—declining Liporazzi’s repeated requests to do so, claiming it was broken. After Liporazzi suggested rescheduling, they offered to restart their computer to fix the issue.

“I don’t know anyone who works remotely and whose camera is broken,” she said. “That’s something that, in the past, I would have said, ‘Okay, no problem. Let’s have a call without the video today.’ I cannot afford to do that. It’s not safe, unfortunately.”

Once they came on camera, things got fishier. Their eye and mouth movements appeared unnatural and not in sync with their speaking, and the edges of their face were distorted, as if they were using a sophisticated version of Snapchat’s 

Liporazzi—who captured and shared this footage in a now-viral 

“The filter was basically very similar; the eyes, the mouth, everything looked quite similar,” she said. “If I hadn’t seen that post before I don't know if I would have noticed.”

When she asked the candidate to wave their hand in front of their face—a tactic that can 

 the filter—they immediately left the call. They’d only been on camera for 30 seconds, but she was shaken.

“It was very creepy,” she said. “You have no idea who you’re talking to.”

Deepfake job candidates are becoming more common, in part because job seekers are hiring professional interviewers to go through the hiring process for them, Ben Walker, COO at Glider AI, an AI skills assessment and interview platform that 

 tools that scan for AI use, told HR Brew.

In less-common cases, deepfakes could be bad actors. Last summer, for example, cybersecurity firm KnowBe4 

 that someone from North Korea stole a US-based identity, posing as an IT worker through the hiring process. The firm caught them before they could access data or compromise systems, but others 

The best recruiters can do is look out for deepfaker red flags. Many target IT or tech roles, as they’re more likely to be remote, and well-paid.

“That’s where the big dollars are. That’s where it’s worth taking a bigger risk,” Walker said. “If I want to attempt something fraudulent, I’m going to make a lot more money in software engineering.”

Glider AI is currently developing tools to detect deepfakes, though Walker is still coaching clients on human interventions, such as asking candidates to turn on their cameras, or watching for unnatural eye or mouth movements, or voice distortions.

“Everyone needs to have a heightened awareness, unfortunately, that this is, I hate to say a new normal, but with the distributed remote workforce being a thing that’s probably not going to go away en masse, we have to brace for the worst,” he said.

After her deepfake encounter, Liporazzi noticed previously missed red flags, like outreach that appeared to be AI-generated and repeated—they had reached out two years prior. She then noticed suspiciously similar messages from another “candidate,” sent on the same days in 2023 and 2025.

Now, she warns other recruiters to be aware of the signs and best practices for remote interviews.

“We have to help our community and we have to talk to one another and say, ‘Hey, this is happening. Just be careful.’ Because if you have no idea what the intentions are or the real reason behind it, you don’t have an understanding of how risky it would be if you let that person in the organization,” she said.

A detected deepfake displayed on a glitchy computer screen.

How one recruiter caught an AI deepfake

“It was very creepy.”

How this recruiter realized she was interviewing an AI deepfake

 in July caused widespread chaos and financial damage to businesses large and small. Thousands of flights 

, an Alaskan 911 system was temporarily unavailable, broadcasters went dark, and for HR pros, the outage left many employees with the infamous “blue screen of death” and even upended 

The meltdown served as a painful reminder of the vulnerability of technology that organizations rely on for basic functions. But cyber experts also see the high-profile outage as an opportunity for HR to deepen employees’ relationship with colleagues in the IT department, and reinforce employee best practices.

CompTIA’s chief technology evangelist, James Stanger, acknowledged that the CrowdStrike outage “was not something that individual users could do a whole lot about.” But he told HR Brew that the incident reinforces the importance of protecting any work-related technology—and educating employees about proper tech hygiene.

And while many organizations do have good tech hygiene policies, in some cases it’s dated—or as Stanger said, it’s “good hygiene for 10 years ago.”

“We’ve got to have good hygiene by upskilling our existing workers,” he said. “We need to do a better job at helping our existing workers have a much more productive relationship with the technology stack that…they’re using [at work] right now.”

HR and colleagues from the IT department need to measure, document, and track employee learning about the technology they’re required to use at work, he suggested, adding that employees need to be “digitally fluent,” not just “literate.

 we’re doing certain things, then we’ll understand what we’re doing,” he said.

Michael Alicea, CHRO at cybersecurity firm Trellix, said employee training is crucial for maintaining an organization’s tech security.

“Every business has to decide for themselves and plan accordingly, but communication is…critical,” Alicea said. “Sometimes, one mistake from an improperly trained employee can cause an entire security system to crumble.”

Alicea said HR can work to reenforce best practices for good IT hygiene, including:

Backing up important information frequently to the cloud or a local storage device

Updating software regularly; when an update is shipped to a device, employees shouldn’t hit “update later”

Using a virtual private network (VPN) when connected to public Wi-Fi, like at Starbucks or an airport

Regularly scanning endpoint devices (such as laptops or work stations) for viruses; this includes phone or external devices if they’re ever connected to the primary endpoint

Only using HTTPS—rather than HTTP—websites when private information will be shared (the S stands for secure)

Always enabling two-step authentication when possible

Training employees to be alert to phishing emails and spoofed email addresses; cyber criminals leverage “social engineering” to coax unsuspecting employees to click on links to malware

Employees need to be extra cautious of phishing scams, Alicea said, because “at a corporate level, you can enforce password changes…You can enforce the kind of password they use. You can enforce the websites that people go to,” but there’s no enforcement against phishing: employees need to be trained to spot them.

IT and HR have a shared responsibility to team up and operationalize best practices. While it may be IT’s role to ideate some of the more technical policies, HR is responsible for making sure the policy is documented and carried out, Stanger said. HR can become the “trusted advisor” to IT and to executive leaders.

“Because this is a people strategy that we’re talking about here,” he said. “If we’re talking about hygiene as something that’s more than just...an update or whatever…It’s something that needs to be tracked, because if you don’t track it, it doesn’t happen. It doesn’t improve.”

For Stanger, it comes back to education and ensuring employee competencies around the tech used at work, the protections in place, and how to activate them when something doesn’t pass the smell test.

“The organizations and individuals that crack that education [component]…the most efficiently, I think they’re the ones that are going to win out here,” he said. “Because if you have that, it allows you to leverage the existing controls.”

File folders and a software update notification.

Technically HR: What’s HR’s role in employee IT hygiene?

HR can be a “trusted advisor” on good IT policy, one expert says.

 airlines, banks, and healthcare systems, becoming the world’s largest-ever IT failure. Terminals and computer monitors at workplaces across the planet donned the infamous “blue screen of death,” and some payroll admins and HR pros were sent scrambling to 

Fran Williams, the senior product director of payroll and managed services at the UK-based IRIS Software Group, told HR Brew that outage was especially difficult for smaller companies with limited personnel who touch payroll systems, those with smaller budgets, or those with older, on-premise payroll solutions.

The CrowdStrike outage served as an unmistakable reminder that, when it comes to payroll, it’s important to have a contingency plan. Williams said HR leaders who haven’t done so already should audit their process and create a plan B to protect employees in the future.

“Walk through your end-to-end payroll process and understand who are the constituent players, and what are the technologies as part of that process, and work out if one of those elements…fails, what would you do,” he said.

Williams, who oversees IRIS’s global and UK-based payroll products and services, said the outage created more issues for small- and medium-sized businesses, or those without robust (and cloud-based) payroll solutions.

Payroll solutions in the cloud fared better, as the software could be accessed from other devices, such as Macintosh computers, Windows devices not connected to a Microsoft-run network, or those outside the outage.

Companies that moved their payroll to the cloud were able to manage better during the outage. They could use personal devices or other unaffected computers to process payroll, he said.

He also suggested that, in the event of an outage, colleagues in IT can prioritize payroll issues among the top business-critical needs.

Another backup plan can simply involve bringing additional people and equipment into the process so payroll isn’t a single point of contact solution. This can help to make sure payroll can still be processed even if a payroll admin is unable to perform those duties or there’s an equipment failure.

Some payroll solutions offer services to run payroll in an emergency, he noted.

HR also must consider a communications plan in the event of an outage. It’s important to keep employees informed of what’s happening, but when and how you deliver that message is equally as important.

“You’ve then got to think about employees and what to tell them. Rushing to tell them there’s an issue too quickly is a challenge. You’ve got to work out when’s the appropriate time to communicate with them,” Williams said.

Finally, as a last resort, run the previous payroll, he suggested. Work with the finance department or the team that cuts the checks and reprocess the previous payroll to ensure employees—up to 65% of whom live paycheck to paycheck in the US, according to 

—get paid, and resolve any discrepancies in the next pay period.

“If you can’t access your payroll system, and your employees are at risk of not…having money in the bank, you only really got one option,” he said. “At least that way, you’ve made sure that people can buy food and pay their rent and or pay their mortgage and all that.”

Communicate that necessary adjustments will be recalculated once the issue has been resolved, he added.

Early in the Covid-19 pandemic, offices abruptly closed, and across the globe payroll pros were tasked with figuring out how to make sure employees still got their paychecks when they didn’t have access to their workstations.

“Covid was the thing that kind of taught us that if we’re locked out of offices, people need to get paid, and payroll...ensured that businesses survived,” he said. “That taught us that it’s a pandemic, an IT outage, or who runs payroll gets, unfortunately, run over by a bus, you need a backup plan.”

The pandemic should have instigated a process to identify a plan B in case of future disruptions.

“You should write down the backup plan. You should probably run through a couple of different scenarios…and practice it, and then document it and revisit it on an annual basis,” Williams said.

image of computers with the blue screen of death

CrowdStrike outage reminds HR and payroll pros on importance of plan B

HR can take steps to mitigate payroll issues amid another crisis.

Gen Z, the “digital native” generation, aren’t just using their phones for TikTok and listening to Doja Cat with wired headphones; earlier this year, some of them put out a call to flood the 

 as part of a protest against the coffee giant.

Gen-Z for Change, a nonprofit organization that uses social media for social activism, claimed responsibility for more than 

 that were submitted to Starbucks locations where the company had been 

 employees who were attempting to unionize.


 for a similar action in March, after 48,000 Kroger employees went on strike. According to 

, when Kroger tried to hire temporary workers to fill in for the workers on strike, Gen-Z for Change digital strategy associate Sean Wiggs reportedly created a website that flooded Kroger’s job portal, leading the company to remove the job postings.


Gen-Z for Change’s operations director Elise Joshi explained to Teen Vogue, “We can at least support [employees] by taking down applications that are meant to replace them.”


In a statement to Teen Vogue, Kroger said that “it was disappointing to see that these failed attempts were aimed at disrupting the community’s access to fresh food and essential items.” And while Kroger ended up taking down the job postings, a Starbucks 

 that no job postings had been taken down outside of its normal hiring processes.


 Rick McElroy, principal cybersecurity strategist at VMware, a cloud computing company, told HR Brew that these forms of protest can impact real people. “As you can imagine, if there are legitimate people applying for those positions, it would be really hard to actually figure out who’s legitimate from non-legitimate…it has an absolute cost to the organization.”

Elise Joshi, operations director at Gen-Z for Change says that while the ensuing headaches for companies is the point of the campaign, the group collaborates with union workers on the ground. She explained to HR Brew, “With every single Starbucks job application that we add in a different location, whether that’s Memphis, or Buffalo, or Ithaca, we had explicit permission and or have been reached out to by union organizers from those locations.”


So how does a threat to large corporations impact your HR team? McElroy says that especially large organizations should understand that hacktivism exists and, “at some point, a group of people may not like all the actions that your organization does for various reasons.”


McElroy says there are a few basic things employers can do to protect their job portals, like requiring people to set up an account before they’re allowed to apply for a job and using CAPTCHA tools. He also stressed that HR, security, and IT leaders should work together to understand the threats they could potentially face. He says leaders need to ask themselves, “Are we at risk? If so, what’s the exposure and then what do we do about it?”

Do you work in HR or have information about your HR department we should know? Email 

 or DM @Kris10Parisi on Twitter. For completely confidential conversations, ask Kristen for her number on Signal.

Group young friends using mobile smartphone outdoor - Millennial generation having fun with new trends social media apps - Youth technology people addicted - Red background

A flood of fake job applications by online activists signals need for job-portal safeguards.

Gen-Z social media activists expose hiring portal weaknesses at Starbucks, Kroger

Susanna Vogel

 in no uncertain terms that Russian-led cyberattacks may be coming, warning business leaders to “harden your cyber defenses immediately.”


In preparation for possible attacks, the White House 

 advising companies on how to ramp up defenses. Suggestions include mandating multi-factor authentication, encrypting and backing up data offline, and running drills of emergency plans in case of hacks.

The US Cybersecurity and Infrastructure Security Agency (CISA)

first alerted companies to the heightened possibility of Russian-led ransomware attacks via a 

, which warned of “malicious cyber activity” targeting the “critical infrastructure sector” in the US. The agency implored businesses to “shore up their systems.”

As the crisis worsened and NATO allies imposed economic sanctions on Russia, Senator Mark Warner, the Virginia Democrat who leads the Senate Intelligence Committee, 

 that Russia might use cyberattacks in retaliation. He believed Russia could levy “direct cyberattacks against NATO countries or, more likely, in effect [unleash] all of the Russian cybercriminals on ransomware attacks at a massive level that still allows them some deniability of responsibility.”


Rob Shavell, co-founder of Abine, an online digital-privacy service, and who has over a decade of experience in cybersecurity solutions, told HR Brew that remote work has generally made companies easier targets.


Shavell explained that remote work has “increased the surface area of [company] data” as employees communicate with each other back and forth across often-insecure personal home networks. He said the result is over “10 times as many” possible entry points for malicious attacks in remote or hybrid work arrangements compared with a traditional in-person work environment.


Shavell also warned that cybercriminals have gotten smarter—he says 

they’re buying or scraping executives’ personally identifiable information (PII)

 to trick employees into falling for phishing schemes.

 “The problem is that the hackers, and the Russian hackers in particular, have gotten very good at personalization at scale. They can run basically massive amounts of [phishing] attempts [where they] send very realistic messages to literally tens of thousands of people that are hyper-personalized,” Shavell explained. “And, unfortunately, because people are busy, and they’re on their phones, or they’re at home or what have you, they have a higher conversion percentage [than other attacks].”

Taken together, Shavell called March 2022 “perfect” for increased cybersecurity incidents.

“You’ve got the war, people working from home that are distracted, and the easy availability of all this information to design perfect, personalized hacks at scale, and [it] doesn’t cost [hackers] much,” Shavell said. “So unfortunately, you’ve got the worst of all three things converging at one particular point in time—and that’s March 2022.”

According to a new study from Barracuda Networks, a cybersecurity research firm, 

small businesses may be particularly at risk

 from cyberattacks. Barracuda Networks analyzed data from January–December 2021 and found that, on average, employees at small businesses with 100 employees or fewer could expect to receive 350% more “social engineering attacks” than employees at larger firms.

The White House’s fact sheet tells companies that when it comes to cybersecurity, it’s best to “bake it in, don’t bolt it on.” From that vantage point, they appear to be baking in security from all angles.

This month, Big Tech companies like Microsoft, as well as the federal government, joined the defensive effort. According to 

, Microsoft worked with federal agencies to help Ukraine and other European nations defend themselves against newly identified Russian “wiper” malware. Last week, President Biden signed a law requiring timely reporting of certain cyber incidents and ransomware payments for businesses in critical industries.

Advocates say this law is critical to helping businesses stay abreast of risks in the cybersecurity landscape and update their own policies and procedures in response to new threats. But 

 that critics are wary of the vague language about enforcement. If officials take a hard stance, critics worry the regulation could be yet another box to check during critical early hours after a breach when businesses are often overwhelmed; if the government loosely enforces the legislation, then the law might not offer as much critical insight into cyber threats as advocates hope.

 or DM @SusannaVogel1 on Twitter. For completely confidential conversations, ask Susanna for her number on Signal.

Organizations should harden their defenses against cyberattacks ASAP, experts warn

The rise of remote work has made many companies more vulnerable to cyberattacks

This winter, popular payroll, time, and attendance management platform Ultimate Kronos Group (Kronos) had devastating news for 2,000 clients that depend on its cloud-based solutions, Kronos Private Cloud (KPC): On December 11, the company discovered a ransomware attack and disclosed the attack to impacted clients on December 12. Kronos could not immediately restore cloud-based services and, in at least one case, couldn’t 

. It said on December 13 that it could take weeks for a full system recovery.

, Kronos stressed that clients should “evaluate alternative plans to process time and attendance data for payroll processing, to manage schedules, and to manage other operations important to their organization.”

But for many impacted companies, there was no plan B: The outage left many logging time by hand. Kronos offered interim guidance on December 24, including CSV templates for tracking time and workarounds for using its 

, customers have been incredulous. One commenter, “tacomageorge,” summed up the general frustration, writing, “it is extremely disappointing how this has been handled.”

Kronos spokesperson Erik Carlson said in an email to HR Brew that the company has been updating clients regularly. He declined an interview with HR Brew, but directed us to 

 on instituting interim procedures. Between December 12 and the New Year, Kronos provided impacted clients with daily updates (yup, including on Christmas).

Carlson pointed HR Brew to a December 30 email that promised, “We are now working on restoration of customers in parallel, which will begin in phases during the week of January 3 and be complete by January 28.”

Despite Kronos’s efforts at damage control, John Riggi, the national advisor for cybersecurity and risk at the American Hospital Association, called the attack a “rolling crisis.” He acknowledged that Kronos is “the victim of a crime,” but said he’s been “disappointed with the availability of information.”

 When Kronos came crashing down, UKG promised support through its UKG Kronos Community. Some have felt like the support amounted to little more than lip service.

“I have seen communications from Kronos that just said, ‘Resort to your downtime procedures.’ That hadn’t really been worked out with Kronos. My understanding is that there was a lot of reliance on Kronos, and their resiliency and redundancy in procedures,” Riggi told HR Brew.

Riggi says many of the employees he represents live “paycheck to paycheck” and count on stable pay, particularly during the holidays.

According to Riggi, the majority of AHA employees 

 been paid throughout the outage due to—you guessed it— “HR folks working 24/7.” Unfortunately, he said, there’s no guarantee of accuracy.

“Go ahead and pay [employees],” Riggi said. “However, that [method] may not take into account shift differentials, holiday pay, overtime—which clearly they're all working overtime.”

The lack of access to usual payroll processes has reportedly resulted in severe discrepancies elsewhere in the country. On December 23, two hourly employees at Grady Memorial Hospital in Atlanta noticed their 

: One says they were paid 75 cents, and the other says they made a whopping 86 cents for her efforts, The Decaturish

In an effort to prevent errors like this, Baptist Health is paying

“an average based on prior cycles, including standard hours and an average of historical overtime and differentials,” said  Cindy Hamilton, executive communications director. Once Kronos is back online, any pay discrepancies that need to be fixed will be “fully trued-up.”

Riggi noted that the problems are only going to get more hairy in the new year.

He worries that ongoing disruptions could lead to “delayed” W-2s for health care workers, causing a cascade of impacts that might include delayed tax filings, delayed returns, and delayed refunds, turning the hack into “an ongoing financial pain point for our health care workers.”

In a time where ransomware attacks are on the rise, this hack and its wide-ranging impact still took HR by surprise.

“It’s not something we’ve seen before on this scale, on the HR side,” Sam Grinter, senior principal analyst at advisory firm Gartner, 

HR Brew reached out to 18 companies impacted by the hack, all of which were non-responsive or tight-lipped about the impact on business processes. Of the companies that did respond, Honda’s Marcos Frommer acknowledged a “temporary disruption to our payroll reporting system,” and Eugene Resnick, a spokesperson for The MTA, reported “20,000 of the MTA’s 66,000 active employees” are being impacted by the breach.

Two weeks into the new year, HR Brew couldn’t find a single impacted company that would go on record as being partially or fully back online. According to Hamilton, Baptist Health in Florida, her hospital, 

 in the process of “testing and validation.” But they’ll fall short of Kronos’s January 28 target.

“We expect our Kronos service to be fully restored in February,” Hamilton told HR Brew.

As the outage stretches on, social media has filled with posts wondering when employee paychecks will be corrected. Many employees and HR professionals appear to be at their wits’ end.

“I work in a hospital in a rural part of the state. With our Covid surge affecting the community and all employees and Kronos being down I’ve been working 12-13 hour days,” one Reddit user vented on 

Unfortunately, while employees may well recognize HR's attempts to fix the problems, that labor isn't good enough if they're not being paid.

Screengrabs of two tweets from workers who say they have not been paid correctly.

 say they were notified that their direct deposits would be delayed due to payroll processing difficulties caused by the Kronos outage. (Whole Foods representatives did not immediately respond to a request for comment.)

One thing is for sure: Kronos may be the first large HR vendor to fall victim to a ransomware attack, but it’s unlikely to be the last. Ransomware attacks 

, and, according to cybersecurity firm SonicWall, the first half of 2021 saw a 

 compared with the first half of 2020. Companies should prepare their plans B, C, and D now, so they aren’t processing payroll in a panic—Some organizations, including JD Supra, have thoughts on how 

 or DM @SusannaVogel1 on Twitter. For confidential conversations, ask Susanna for her number on Signal.