Career development

Anonymous member

32m

We have a guy on our staff who has special needs. Based on his abilities, we offered him a job working with documents in the archive. But he’s against it, he wants to interact with clients. I’m not sure how to gently explain to him that his work and ambition are very admirable, but we also need to keep our clients. Could you suggest how to talk to him in a way that doesn’t make him feel limited... or hurt?

Thanks for any advice.

more

Boris Blažeković
14m
Tell him that everyone has a place. He's the best at what he does. If he were to do a job that wasn't his, we'd have to fire the person who's doing it... now, and that wouldn't be fair.
more

Tomas Eckholm

Career development

1d

Hi! I work as a driver for a large company and I’m assigned to one of the managers. I drive him to and from work and during the day if he needs it. But my boss keeps giving me more and more tasks. First, I had to drive his daughter to school. Then I started picking her up every day. Now I’m supposed to go to his house and walk his dog. I also have to drive his wife wherever she needs to go.
None... of this is part of my job. Should I ask for extra pay, refuse these tasks or talk to the company director? Thanks.

more

1

erasty philbert
56m
Seek additional remuneration by talking with the manager..if that doesn't work seek solutions through the human resource department
Henry Myers
2h
Talk to a lawyer, sue him for. He is taking you for granted.

Career development

7h

AI scams targeting businesses are surging: Here are the top 3 threats your team is likely to face in 2026 (Brains Byte Back Podcast)

Imagine a company interviewing a candidate for a senior IT role. The résumé checks out, the background looks solid, and the person even passes multiple video interviews. It wasn't until the new Mac that the employee received was immediately being loaded with malware that suspicion arose.

After a thorough investigation, the shocking truth comes out: the "engineer" was a deepfake, part of a... sophisticated operation using AI to infiltrate a hiring process.

"It's no longer just about breaking into systems -- attackers are targeting humans, and AI makes it easier than ever," says Sanny Liao, co-founder and chief product officer at Fable Security. With AI-powered attacks on the rise, small and mid-sized businesses are facing threats that can mimic employees, clone voices, and exploit rapidly adopted AI tools.

The numbers tell the story. In 2024, 90% of U.S. companies reported being targeted by cyber fraud, with AI-driven attacks -- from deepfakes to voice phishing -- surging 118% year over year. While businesses are learning how to leverage AI, attackers are becoming even quicker at weaponizing it.

Cybersecurity experts are discovering dozens of ways AI is assisting attackers in increasing sophistication and creativity. On the latest episode of Brains Byte Back, Liao walks host Erick Espinosa through the top three AI-driven scams business leaders need to watch in 2026 and shares practical steps to stay ahead.

1. Synthetic Identities and Fake Employees

Fake résumés and forged references have long been a concern, but AI has taken the threat to a new level. Entire fake employees can now be created with convincing IDs, references, and even live video interviews that don't glitch.

"The AI technology has gotten so good that it's almost impossible to tell who's fake over Zoom or a phone call," Liao explains.

Remote-first companies and those hiring internationally are especially vulnerable. Once inside, a fake employee is treated like any other team member -- gaining access to sensitive systems and critical data. Liao recommends a simple but powerful measure: in-person verification.

"Anyone doing remote hiring needs in-person identity verification. That's the only reliable checkpoint left," she says.

Liao referred to the previous KnowBe4 example, in which the company unknowingly hired a North Korean operative.

¨This is a well-organized, state-sponsored, large criminal ring with extensive resources,¨says KnowBe4 on their post detailing what unfolded.

¨The case highlights the critical need for more robust vetting processes, continuous security monitoring, and improved coordination between HR, IT, and security teams in protecting against advanced persistent threats.¨

While this story made headlines, Liao points out that fake employees seeking remote work have become a common occurrence.

¨We actually talked to a bunch of security leaders that we knew, and what shocked me was that about half of the security leaders I talked to told me that this is not new. We are already being targeted by this,¨ added Liao.

The stakes go beyond payroll fraud. Attackers can manipulate internal systems or exfiltrate proprietary information, turning a single fake hire into a company-wide breach.

Phishing used to mean clunky emails riddled with typos. Now, AI has made social engineering smarter, faster, and more personalized. Attackers can research a company's tech stack, identify high-value employees, and even clone voices to impersonate trusted colleagues.

A striking example is the ShinyHunters attacks on companies, including Google, Adidas, and Workday. Using AI-driven voice phishing, attackers convinced employees to install malicious apps on Salesforce, exposing client data and sensitive internal systems.

"Attackers can now figure out which companies use which tools almost instantly. It's knowledge on tap," Liao says.Her advice is straightforward: if an unexpected call comes from someone claiming to be IT or HR, hang up and call back using a verified company number. These attacks aren't confined to phones either; Slack, WhatsApp, and other communication platforms are also being targeted.

"Attackers follow the platforms you use. If you're on Slack, they'll try Slack. If it's Zoom or WhatsApp, they'll shift there," she notes.

Liao advises that if you receive a call from anyone claiming to be IT or HR, use caution by hanging up and contacting them from a designated number that reassures that you are connecting with someone legitimately from that department.

3. Insecure AI Adoption

The rush to adopt AI tools for automation, coding, and productivity is creating new vulnerabilities. Startups and enterprise teams alike are exposing themselves to risks that never existed before, from malware hidden in open-source packages to accidental data leaks into public AI models.

"AI is new, and everyone wants to move quickly. But the pace of adoption is amplifying vulnerabilities by design," Liao warns.

A high-profile case in 2023 involved a Samsung developer who uploaded the company's codebase into a personal AI tool that used the data for public training -- effectively exposing proprietary information.

Even enterprise AI products can introduce gaps if used without proper oversight.

Liao says this is a cautionary example that reflects the unintentional errors that can happen when using these types of AI systems. The challenge is not just malicious actors; human error in a fast-moving AI landscape creates blind spots that attackers can exploit.

Companies need AI to stay competitive, but they must do so deliberately, with security and governance prioritized throughout the process.

Attackers aren't just hacking tools anymore; they're targeting people. "At the end of the day, if they can get around your tools and get to your people, they win," Liao emphasizes.

For business leaders, the takeaway is clear: verify identities in hiring, train employees to recognize AI-powered social engineering, and adopt AI tools cautiously with security oversight in place. Staying ahead isn't about avoiding AI; it's about understanding how it can be weaponized and preparing your team for the ¨what ifs¨.

Companies will continue to leverage the technology to grow, and attackers will continue to harness it to exploit weaknesses in ways that are faster, smarter, and more convincingly than ever.

Sanny Liao: Hi, everyone. My name is Sanny Liao. I am the co-founder and chief product officer at Fable Security. We are a human risk management solution that work primarily with enterprises to help prepare their employees for the latest threats that's facing them.

Erick Espinosa: Sanny, thank you so much for joining me on this episode of Brains Byte Back. Sanny, and those of you listening, on Brainspite Back, we love to talk about how companies are using AI to automate work, basically to make things a lot easier. But I feel like what we don't talk about enough is how attackers are using those same tools. And this conversation matters in today's world where AI is just not influencing our work, but I guess our sense of security is the best way to put it.

We've heard of the scams hit the news, and I mentioned this to you, Sandy, about like the most typical scams, personal scams like grandfather, people using AI voices to mimic grandchildren. That's happening on the personal side of things. But at the same time, in the enterprise and startup world, they are having the ability to basically gather information, mimic trusted people's voices, and probe for weak spots.

And this is happening really, really fast. Some teams still think that AI scams are something that only hit big enterprises, but we're actually discovering that the reality is that small and mid-sized companies are easier for targeters or attackers to study, impersonate, and manipulate.

So today we're going to focus on the three threats that you see as the fastest growing, Sandy, some that have made some global headlines, and as well, we're going to be talking about basically the common things that startups should be focusing on and what signals founders should pay attention to when it comes to these types of scams.

But before we dive into that, Sandy, I'd love to learn a little bit more about your background. Can you give us some insight into what kind of led you into fraud prevention and identity risk?

Sanny Liao: Yeah, absolutely. So I actually started my career as a PhD researcher in economics. After I got my PhD, I kind of got to the point where I really wanted to make things that people can feel, can really have real-world impacts.

So at the time, I was going to school at Berkeley, and I ended up working with this small ad tech startup out of San Francisco called Telepar. That's where I actually got introduced to, oh my God, for the first time, I realized the power of technology, how it can actually change our lives.

And I remember one of the thoughts that I had at the time was this ad tech technology was so powerful beyond kind of any of us actually even realized, but it's a pity. It's being used to get people to click on ads.

So a couple of years after that, a few of my friends went off to start a cybersecurity startup called actually Abnormal Security. And I knew nothing about email security. It was just a group of people that I really, really enjoy working with. And I thought, this sounds good, right? We can figure out email. Like how hard could it be? It ended up being actually one of the best, I think, decisions I've made in my life.

So I ended up with that team. We built Abnormal Security from the very ground up.

Started with literally just 10 of us in the back of our VC's office trying to figure out what BEC meant. BEC stands for Business Email Compromise.

To Abnormal now, obviously, it's a very successful cybersecurity startup. I think one of the fastest, actually fastest growing cybersecurity startup in the world right now.So that was actually my kind of introduction into cybersecurity.

The moment I knew I wanted to stay in cyber forever was at the time I had a four-year-old child.

And he asked me, he's like, Mom, what do you do in your job? And I'm there thinking, how do I explain email security to a four-year-old?

So I said something along the line of, there are bad guys out there who's trying to steal people's money and stuff. Mom stops the bad guys on the internet. And he stopped for a second. He said, like Batman?

That was the point. I'm like, okay, if my child thinks that I'm Batman when I go to work, I think I'm doing something right in life. But that was my start in cyber.

Erick Espinosa: But you're helping a lot of businesses in a way. It's kind of like, I don't want to say good versus evil, but obviously you're stepping up the game of a lot of these companies in terms of trying to protect them. And right now, I mean, you got into it when tech was a thing, but now tech is a necessity, and especially when it comes to AI.

But when did you start noticing that, I guess first notice that AI started changing how attackers are behaving?

Sanny Liao: Yeah, this actually started even toward the end of my time at Abnormal. So Abnormal Security, what they did is that they stopped sophisticated email-based threats. And we actually started seeing, this is around kind of 2022-ish, that email-based threats started evolving very quickly from, we used to see a lot of bad grammar used in the emails. There's bad formatting. It's very easy to tell, find some of these tales of email-based attacks to all of a sudden over the course of a year, all the grammar mistakes and all the spelling errors just disappeared.

And it was this huge, actually, increase in both the scale of attacks as well as the sophistication and their ability to bypass a lot of the detection tools.

So that was kind of already at that point, we started seeing that, hey, attackers are in fact adopting AI. They're one of the first people to adopt AI, and they're going to actually, they're going to evolve just as fast as the AI technology is evolving. That was the beginning of it.

And the reason we actually left Epnormal to start Fable Security was, if you remember in 2023, when the MGM resource attack happened, that actually happened over voice phishing, right?

So someone caught up MGM resource IT helpdesk and actually bypassed their MFA, got into a system, deployed ransomware. And that was a case where we realized that, like, wow, attackers are now actually able to target precisely, right? They knew exactly who to target, who this guy was, who had the super admin privilege.

They were able to get in, target him, execute a very successful voice phishing attack. So it's not something you could have stopped with any of the tools that most companies had. And that was the point we realized that, we're like, hey, I think there's something here, right? Attackers are, at the end of the day, focused on the human.

How can they get into, how can they get around all the technical tools a company has and get to the human at the end? And that is happening beyond one surface area. It's not just email anymore. There's other ways that attackers are finding them. And AI has made it tremendously easy and powerful for attackers to do that.

Erick Espinosa: That kind of sets the stage thinking about, because when a lot of people think about when AI started becoming a thing, it was during the pandemic. And then that's when people were working from home.

So there's this relationship in terms of when the technology started kind of like, thriving and growing really fast. And then when people were actually doing things at home and it became this kind of like this relationship in order for them to basically kind of open doors and access companies in other ways.

And I found this quote here. It's kind of interesting. It speaks to last year. It says, in 2024, 90% of US companies reported that they had been targeted by cyber fraud and generative AI tactics, such as deep fakes or deep audio, rose 118% year over year. So that number kind of is, I mean, it's mind-boggling.

And you think now, even just this year, when you're seeing deep fakes, I think Banana was the one that I just saw most recently. And I just started playing around with Sora and the fact that it looks so real, it's really hard for people to be able to differentiate what's real and what's fake.

But apparently with that same study, it says, despite the growth and success of cyber fraud methods, most executives report confidence in their, basically 90% confidence in themselves and 89% confidence in the ability of their employees to spot deep fakes, business email compromise that you mentioned, the scams, and other advanced fraud attacks.

I feel like that's a high number that they're very confident. But do you think that number reflects, I guess, the companies that you've connected with or that you found that you feel like maybe they're starting to realize, no, actually there's a problem here?

Sanny Liao: Yeah, I think sometimes people don't know what they don't know, right? So you can only speak to the attacks that you may have detected, but not necessarily ones that have bypassed. It's interesting that you talked about deep fake as something that a lot of companies deal with.

If you remember last year when KnowBe4 talked about how they accidentally hired a North Korean fake IT worker, so of course it made headlines, you should feel free to look it up. It's actually quite crazy that a North Korean fake IT worker basically pretended to be a software engineer and got hired by a security company.

So when that happened, we actually talked to a bunch of security leaders that we knew, and what shocked me was that about half of the security leaders I talked to told me that, oh, this is not new. We are already being targeted by this.

There was one company where they have a very strong brand. They're really kind of out there in the news quite a bit. They even said that they actually they're hit by this type of attack almost every single month. And what we saw was that the more a company has remote workers, which is something that we've seen really changing a lot in the last couple of years, the more they are vulnerable to these type of fake identities and fake employee attacks.

Erick Espinosa: So that actually leads to the first threat, which was synthetic identities and fake employees. And like you mentioned, apparently it's been around for years. But what is really changing now?

I imagine with this type of thing that most of the companies that would be targeted would be IT companies because a lot of them work with employees across different countries, right?Or in different regions. What do you think is changing right now that's making it even more of an issue?

Sanny Liao: Yeah, I mean, it's just as attackers, actually, they are creatures of opportunity, right? So with the introduction of AI, what it has actually changed is that it made it very, very easy for attackers to execute on a fake employee type of attack. A lot of companies, right, if they are hiring more workforces, they're really relying on a couple of verifications to figure out who these people are, right?

They're looking at their resumes. Maybe they're doing a background check. But all those things are actually very easy things to deepfake now with the assistance of AI. The Nobi, for example, was a good one where they actually went through all the vetting, right?

They even looked at this guy's driver's license, but all of that was deepfaked. And that, of course, led to actually a huge incident because once the attackers are in, they now are treated as a normal employee.

They have access to your data, to your systems. So in the least worst case, they're doing it because they're trying to kind of make money, right? By having, you know, pretending to be someone else to get a job. But in the more egregious cases, they're getting in there because they want the access to your systems.

They want access to your data. So it's, you know, it's basically like the, it just, we, AI made it a lot easier for attackers to successfully execute on this type of attack.

Erick Espinosa: And with that information, I guess they could do ransoms. They could ask, obviously, for large amounts of money. What checkpoints, I guess for a smaller business, what type of checkpoints do you think they need to focus on to have them catch cases like this that can potentially be, I guess, somebody posing as somebody that they're not to potentially get a job?

Sanny Liao: Yeah, yeah. So I would actually recommend for these cases, the AI technology has gotten so good that it's almost impossible to completely tell who's a fake person versus a real person over Zoom or phone call, right?

Even before, if you remember like a year ago, if you actually had someone move their face, put a hand over their face, a lot of the AI technology then they start kind of glitching out. That's actually no longer the case.

The AI technology has gotten so good that that doesn't really cause an issue anymore. So I would actually recommend that anyone who's doing remote hiring, you need to actually have a process where you're doing in-person verification of identity.

Erick Espinosa: Okay. So like physically have somebody, I guess maybe hire somebody in, I don't know, like a trusted third party maybe to go and meet the person, collect documents, things like that?

Sanny Liao: Exactly.

Host (Erick Espinosa): Okay. That's smart. And then the other one that you'd mentioned here is AI generated social engineering. Can you explain what that is exactly, what that looks like in picture?

Sanny Liao: Yeah, absolutely. So when most people think about social engineering, they are thinking about a email they receive, right? Or a WhatsApp they receive where they are being kind of tricked into clicking a link, you know, send a gift card somewhere, etc.

But what attackers have actually figured out is how to use AI in very creative and powerful ways to make social engineering attacks a lot more powerful and actually a lot more scalable.

So what I mean by that is that there's the obvious one, which is, hey, we're seeing that attackers are using AI to deep fake voices. So for example, in the latest Shiny Hunters attack, there were research where they found that attackers are using AI to actually impersonate individuals when they are impersonating to help that specifically when they are calling employees to actually get their, to get them to install a Salesforce app and whatnot.

That's the obvious one, right? Like it's like, yes, AI is really great at deep faking stuff. What the not obvious one that's happening that's actually impacting everybody is that attackers are also using AI to help them do research a lot better.

So I'll give you an example. So in the Shiny Hunters attack, the way attackers, the way they actually found their targets is they looked for companies that use Salesforce and they looked for people who have Salesforce access. Now, you know, if I was doing this one by one, right before AI, it actually takes, it's like a non-trivial amount of work for me to figure out who's using Salesforce, right? There's a lot of people that use Salesforce. There are a lot, right?

But for me to pinpoint down who exactly, which companies use Salesforce and which are the individuals who had this access, it takes a bit of work. Now with AI, that type of research is almost instant.It's knowledge on tap, right?

So that's kind of the example where you can assume that attackers are actually using AI to do this mass reconnaissance so that they can then figure out what is like the most targeted attack they can execute that's going to give them the biggest return.

And the unfortunate part is that like this is something that you can't stop attackers from using AI, right? They're extremely motivated to do so, but it just means that all the attacks we're receiving are going to be a lot more personalized and targeted. And it's going to be a lot more, a lot more convincing for the recipients as well.

Erick Espinosa: I kind of connect that to like, I mean, companies now, even when they want to personalize information, I guess to target customers, you know what I mean?

Like a lot of the information is online and it's just easy access. And, you know, AI could basically just collect that information and tell you a story about that person automatically. Is there any, I guess going off of that, is there anything I guess online that you would recommend that companies don't kind of share?

Because like, how would they find that these companies are using specifically Salesforce?

I imagine that's information easily, like readily available online, no?

Sanny Liao: That's quite easily available. If I were attacker, it's pretty easy to look up, hey, if a company is hiring for, for example, Salesforce developers, that's a telltale sign, right? That they are using Salesforce and, you know, every company have to recruit.

So these jobs are publicly available.

So there's, I think there's some amount of risk, right, that we can mitigate...

Erick Espinosa: There's always going to be some activity we can't fully stop. Attackers will get access to certain information. One example you mentioned is the Shiny Hunters vishing attack. Am I saying that right?

Sanny Liao: Yes. The attack is still unfolding. It first came out in the news when Google, Adidas, Workday and a few others reported that attackers targeted sales teams with access to Salesforce. They used two tactics.

They called employees while pretending to be IT support and convinced them to install a malicious third-party app. That gave the attackers access to Salesforce, which exposed client emails, contact information and other data. The biggest impact was the loss of trust between companies and their clients.

The group also pretended to be HR and used that story to get employees to reveal personal information. That let the attackers bypass MFA and get deeper into Salesforce.

More recently, they compromised accounts belonging to Gainsight employees and inserted malware into a Gainsight Salesforce extension. Gainsight is widely used, so that created another wave of data loss.

Erick Espinosa: I imagine the employees felt violated. When you meet with companies, what should founders or employees watch for when they get calls or emails that feel off?

Sanny Liao: If someone calls claiming to be IT support or HR, don't trust it. Almost no legitimate IT or HR team will call you out of the blue. If you're unsure, hang up and call back using the number you already know belongs to your company. Treat every unexpected call with suspicion.

Erick Espinosa: What about Slack? Could attackers get in there by pretending to be someone from a vendor and message employees?

Sanny Liao: Yes. We've seen attacks happen over Slack, WhatsApp and other channels. Many international companies use WhatsApp heavily. Attackers follow whatever platform you use. If you're on Slack, they'll look for you there. If it's Zoom or WhatsApp, they'll try those too. Once companies get better at handling phone-based phishing, attackers shift to the next channel.

Erick Espinosa: The third threat you mentioned is vulnerabilities created by insecure AI usage. This one is common. Can you walk through the Shai-Hulud example and what insecure AI usage looks like?

Sanny Liao: Insecure AI usage is a major concern. Every company is adopting AI to stay competitive. The ones who adopt it quickly and correctly will have an edge. The problem is that rapid adoption creates new vulnerabilities that companies never had to deal with before.

The recent Shai-Hulud attack targeted NPM packages. Attackers compromised GitHub accounts of open source contributors and slipped malware into widely used packages. Most startups rely heavily on open source, so when they pulled the latest versions, they unknowingly pulled in malware.

This connects to AI because tools like Cursor and Claude Code make coding faster and more automated. If you rely heavily on AI to write or review code, you may not notice what packages are being added or how they behave. Without deliberate oversight, it's easy to miss these risks.

Asana also reported a flaw in their MCP server. Tenants could accidentally access each other's data. There's no established playbook for building these AI-driven systems, so companies are learning as they go while moving fast. That creates new vulnerabilities by design.

Erick Espinosa: It reminds me of the crypto era. People rushed in, got sold products by people trying to make quick money and ended up exposing themselves. Now you see the same with AI tools that ask for deep access to company data. Have you seen cases where companies jumped into AI too fast and realized later they made themselves vulnerable?

Sanny Liao: Yes, and there's no simple solution. It's not just small third-party AI tools. Even large enterprise AI products ship with new vulnerabilities. Google launched its coding tool and a vulnerability was found the next day.

AI is new and everyone wants to move quickly, so issues are going to happen. There was a well-known case in 2023 when a Samsung developer uploaded the entire company codebase into a personal ChatGPT account. The personal version uses data for public training, so the code became publicly accessible. Samsung couldn't get it back. That wasn't an attacker. It was an unintentional mistake during early adoption.

Both intentional attacks and unintended misuse create real risks. Companies need AI to stay competitive, but the pace of adoption is amplifying vulnerabilities.

Erick Espinosa: I think you're also a great example of how AI is creating new jobs. While there are attackers, there are also new opportunities in this field. Security roles have always been needed, but now people see the value more clearly. For anyone interested in getting into this space, it feels like a career that isn't going away anytime soon.

Sanny Liao: Absolutely. This is a really exciting time, especially for people who are just entering the workforce. No one has a degree in how to use the latest AI tools. It's a blank slate. You have the chance to learn cutting-edge tools, come up with creative ways to apply them, and create value for a business. It's a great place to be.

Erick Espinosa: I agree. Sanny, thank you for your insight and for breaking this down. You gave our listeners a clear view of how attackers are stepping up their game. For anyone who wants to learn more or follow your work, what's the best way to find you online?

Sanny Liao: You can find our company at fablesecurity.com. I'm also on LinkedIn. Feel free to connect with me. I enjoy talking about cybersecurity and the latest AI threats. Always happy to have those conversations. more

Career development

8h

Craft my cv

My goal is to move into a new senior-level technical role, and I need my current résumé elevated so it speaks directly to hiring managers. while remaining clear, concise, and results-focused. You will receive my existing résumé plus a brief outline of recent accomplishments and preferred job descriptions for context. From there, refine the narrative, sharpen the metrics, weave in relevant industry... keywords, and present a polished document ready for submission. Deliverables (all editable): * Final résumé in US-letter Word (.docx) and matching PDF * Concise, two-sentence professional summary option for LinkedIn use * One revision round to fine-tune tone or emphasis The finished draft should feel senior, technical, and impact-oriented, making it obvious why I belong at the top of the interview shortlist. more

Martin Waters

Career development

1w

I’m 25 years old and have been working as a junior manager in a trading company for 4 years. Recently, our internal email said that another department is looking for a new boss. I sent my resume. But HR and the deputy director laughed at me and said I’m too young, even though I’m sure I can do the job.
I feel upset, because we already have some department heads who are 26-27.
Now I don’t know... what to do. Should I stay and wait until I’m older or look for another company that respects young, active workers? Thanks more

9

Paul Samalama
8h
First don't speak as junior instead speak as a mature adult who is able to handle tuff situations. You are competent only when you can solve... situations without supervision. Good luck more
James Britius Musika
1d
Hullo Martin Waters sorry about that, in my culture we have saying going like " even the young can drum and the to old to dance so they would have... given you chance" BUT take heart one day you will be there God as our provider to all. more

Career development

10h

How to Find Employees in a Competitive Job Market

The demand for specialized talent is rising fast, but most hiring strategies are stuck in neutral. In this guide, I break down the challenges to finding employees today and how to course-correct.

The saying, "Good help is hard to find," rings loud and true. Sourcing skilled candidates has become a persistent challenge, especially for specialized and technical roles.

Even with competitive... compensation packages and modern recruiting tools, many organizations are still falling behind in finding employees with the right skills.

And the data reflects that reality: 74% of employers say they're struggling to find skilled talent.

That's a clear sign to go back to the drawing board to redesign the traditional hiring approaches still in effect. But before real progress can be made, you have to understand the factors standing in your way.

The challenges in hiring today

Market competition isn't the only reason finding employees is difficult. There's a growing set of challenges slowing down your recruitment efforts.

1. Tight competition for skills

New technology is changing how work gets done, but recruiting for the skills to keep up hasn't kept pace. Many of today's roles depend on skills and tools that didn't exist years ago, and the demand is growing.

By 2030, the importance of AI and big data skills is projected to increase by 87%, making them the most sought-after capabilities.

But technical skills aren't the only ones in high demand. Soft skills, such as creative thinking, resilience, and leadership, are also on the rise.

Even though more people are developing these skills, there still aren't enough professionals with the expertise you need to support modern operations.

2. Budget constraints

65% of HR leaders expect flat or reduced budgets. Even the strongest hiring strategy hits a wall when budgets tighten.

Keep in mind that it still costs $4,700 on average to hire an employee, and that number increases depending on the role and required competencies. But regardless, hiring teams are still expected to fill roles quickly and compete for top talent, even with fewer resources.

3. Overwhelming volume of applications

In theory, more applicants should be a good thing. In reality, it's causing a major bottleneck in the application process. Recruiters are drowning in the sheer volume of applicants.

Oftentimes, they're receiving hundreds to thousands of résumés per role, with only a small number meeting the essential requirements.

Executive headhunter Nicole Kaiser described today's hiring landscape as recruiters "drinking through a fire hose of applications," which is exactly how it feels.

The upsides and blind spots of AI in hiring

AI in recruitment has added real efficiency to the hiring process, from résumé parsing to automated scheduling, but it's also introduced new challenges.

Résumé parsers may flag promising candidates too late in the process, or filter them out altogether based on formatting or phrasing. While these tools save time upfront, they make it more challenging to spot unconventional experience and transferable skills.

Pressure to regulate and mitigate bias in AI hiring tools is also increasing. Several jurisdictions now require transparency around how AI is used in hiring. That means more oversight and more documentation for teams that heavily rely on third-party platforms.

The best talent sourcing methods

I reviewed the daunting challenges keeping you from hiring your best employees, but I don't want you to feel defeated. Like with any obstacle, you have to move strategically to accomplish your objective.

If you're trying to nail down how to find employees going forward, you have to refine how you source them. The candidate sourcing methods below aren't new. What is new is how you'll use them.

I'll explain how to make the right adjustments to get the most out of these strategies and secure today's talent.

Job boards

The days of copying and pasting job posts have made their exit. Candidates scroll past vague listings. If you want to stand out, write job descriptions that are clear and realistic to the role.

Of course, you want to include the essentials -- job title, job summary, a list of responsibilities, compensation -- but you also want to highlight your Employee Value Proposition (EVP).

Your EVP explains why a candidate would want to work there and what they gain in return. Don't be afraid to get creative. You really want to think about what your company has to offer besides compensation and benefits.

Are you making measurable progress toward sustainability? Say that.

Do you invest in your employees through workshops, certifications, or career growth stipends? Include that.

Are your teams flexible, collaborative, or tackling meaningful challenges? I strongly advise making it known. These are the extras many candidates are seeking, especially Gen Z, who value purpose over salary.

Once your job description is dialed in, it's time to optimize your job post. That's right, just like your SEO, you want to optimize your job post with keywords that'll increase your visibility on job boards like LinkedIn, Indeed, and ZipRecruiter.

For example, ZipRecruiter's smart matching technology analyzes the keywords in job titles and descriptions. So if you're hiring for a customer success manager, it's important to include specific keywords such as:

* SaaS onboarding

* Client retention

* CRM experience

* Post-sale implementation support

These keywords help ZipRecruiter match the post with candidates who've held similar roles or have these terms in their resumes. Optimizing your job posts makes sure that your listing reaches candidates with the right background and surfaces in relevant search results.

Referral programs

Referral programs expand your talent pool by granting you access to both passive and active candidates. Your employees essentially become brand ambassadors.

They can explain the reality of the role and answer questions long before an interview is scheduled. Plus, referral programs lower job advertising costs, giving you more bang for your buck if you're working with a tighter budget.

If you're starting from scratch, keep it simple. Focus on one or two roles that consistently take the longest to fill. This allows you to test the program and iron out the wrinkles in the process.

Then determine the incentives. You can offer cash bonuses, extra PTO, curated experiences, or even paid trips. The main point is to select what fits your budget and also piques your employees' interest.

Universities and local programs

I'm a firm believer in connecting with people who are actively developing the skills I'm looking for. In my book, it's one of the best ways to build a talent pipeline.

Colleges, trade schools, and certification programs are filled with candidates learning exactly what your organization is missing. Start by reaching out to the career services office at the institutions that align with your hiring needs.

You can participate in job fairs, guest lectures, and mentorship programs. You can set up an internship or post-graduation employment program.

And don't overlook non-traditional paths. Some local programs and bootcamps train professionals in niche areas, like cloud computing and digital literacy.

Their goal is to have employment lined up for their new certification holders, and you need professionals with specialized skills. It's a win-win!

You can also tap into online education programs. Some online platforms, like edX, offer a job board exclusively to their students so they can find work as soon as they complete their program.

Social media recruiting

When many people think of social media recruiting, they picture posting their job listing on the company page and having some employees share it on their feeds.

Sometimes it works, sometimes it doesn't. The results aren't consistent, and you're left wondering if it was worth it. To take it in the right direction, consider using social media recruiting platforms that place your jobs directly in the feeds of your ideal candidates.

Platforms, like HireSocial by CareerArc, boost your listings' reach to both active and passive candidates. These platforms also make it easy for applicants to apply with just a few clicks. You can interact with prospective candidates with direct messages or answer their questions in the comments before they apply.

Future-proofing your talent pipeline

The demand for specialized skills will continue to increase as we approach 2030, and at the same time, the skills in demand will change. To prepare for such an ever-changing future, again, strategy is key.

Skills-based hiring

Skills-based hiring means you're intentionally recruiting the people who demonstrate the abilities you need, versus focusing on their degree. Shifting the attention to skills helps you build a workforce that's adaptable and growth-oriented.

Start by identifying the core skills your company thrives on today and the emerging skills you'll need over the next one to three years. Those are the skills your hiring team will prioritize.

Workforce planning

Identifying the core skills you need sets up the foundation for proactive workforce planning. I have a genuine soft spot for workforce planning.

Ultimately, I love how it makes you step back and ask:

* What skills do we already have?

* Where are the gaps?

* What will we need six months from now? A year from now?

* Can we train for it, or do we need to hire for it?

To answer, begin by taking an inventory of your current workforce to see what capabilities you have and where. Then, determine which initiatives you have coming up and what skills they require.

Compare the skills you have with what you'll need. That's your skills gap, and now you can figure out whether you'll need to hire for it or train for it.

This is how you can anticipate what your organization will need and move accordingly. You won't have to rush to hire because you'll already know what's coming.

Internal mobility

External recruitment gets all the attention, but your best candidates may already be on your payroll. Investing in internal mobility reduces your time-to-fill rate and protects institutional knowledge by upskilling your employees.

With targeted upskilling, employees grow into the roles your company will need down the line. Workforce planning already shows you which skills you need most.

Now, you have to create the pathway for your employees to get there. You can offer in-house training, mentorship programs, workshops, or stretch assignments.

Whatever you choose, make sure the opportunities are visible and accessible. If you take a look at my recommendations, you'll notice they encourage you to look inward.

I've experienced competitive job markets and talent shortages a few times, and the lesson is that it's vital to know what your company has in its wheelhouse. You must know what your company offers and show candidates what it's like working there.

That's how you genuinely attract and retain employees, and build a lasting workforce. more

Career development

10h

AI Monthly: How AI is challenging authenticity in recruitment

Traditionally, job applications involved substantial preparation. Candidates often spend several days conducting in‑depth research on the company, refining their résumés, and crafting cover letters. The prevailing belief was that a well-written cover letter could set candidates apart by demonstrating rigorous research of the company and portraying an authentic profile.

Today, generative... artificial intelligence models (Gen AI) can generate a perfectly targeted cover letter at the click of a button - if you prompt it well. Failing to do so, however, may lead to inaccuracies or made-up statements that could diminish chances of getting hired. While this significantly reduces preparation time, it raises a bigger question: How will recruiters be able to see the authentic self behind the application if everyone uses the same tools?

According to the 2025 Market Trend Report by Career Group Companies, a leading US recruiting firm, about two-thirds of job candidates in the US say they use AI when applying for jobs. This includes not only résumé and cover letter writing, but also interview practice, career guidance, and perfecting their headshots.

AI-driven tools combined with standardised application processes have compressed hours of preparation into mere seconds, enabling candidates to apply at scale. And recruiters are feeling the strain. Human resources (HR) teams today are handling almost three times more applications than three years ago. Part of the problem stems from AI auto-apply tools that lower the barrier to mass applications. The reason is not such much an increase in the number of job seekers but rather the fact that platforms like LinkedIn, where applications rose 45% year-over-year, facilitate the application process with easy-apply features. This surge in application volumes is forcing talent teams to rethink their workflows to keep pace. more

Career development

12h

How to Improve English for Job Interviews: Easy Tips to Speak Confidently

Wondering "How to improve English for a Job Interview?" The answer is simple: Speak clearly and stay confident. It lets you create a positive impression. Job interviews are often the final step that determines whether you get the job. Nearly all the interviews are conducted in English, especially in the private sector. This is why improving your English-speaking skills matters the most.

Many of... you know the skills, but struggle with expressing them. To put it simply, you have sufficient knowledge but lack communication skills. You can get better with the right approach and a few small habit changes. To help, we have compiled below the tips and tricks to improve English for job interviews.

How to Improve English for Job Interviews?

Improving English is more than just learning grammar rules. You should speak in a way that clearly presents your ideas. Your speech should be fluent and natural. You must have a confident mindset to handle any questions. Daily practice and smart strategies can help you excel. Learn various ways to improve English for job interviews.

Master Basic Interview Questions

You can start practising with basic interview questions. These are mainly asked to assess your basic communication and background. Common questions are "Tell me about yourself," or "Why should we hire you?" You can prepare short responses for this. Make sure your language is simple. Practice daily to speak without any pauses.

Build Vocabulary

Improving your vocabulary doesn't mean learning complex words. Focus on the job-related terms. If you are a content writer, get familiar with words: Content strategy, SEO, or keywords. Pick a few relevant words every day. Try to integrate them into your daily conversation. This can help you build strong vocabulary skills.

Practice Speaking Daily

Talk to yourself in English every day. Read newspapers loudly or narrate your day. You can also talk to your mentors and classmates. You can even chat with AI tools anytime. Record yourself to check how your speech sounds. This approach can improve your grammar and pronunciation mistakes. The more you talk, the more fluent you become.

Improve Listening Skills

Listening can enhance your communication skills. Watch interviews or podcasts in English. It helps you know how other people answer the interview questions. You observe their tone and sentence formation tricks. This trains your mind to think in English and speak naturally.

Also Check:

How to Improve English for Competitive Exams (SSC, Bank, UPSC)How to Build a Strong English-Speaking Habit in 30 Days

Prioritise Pronunciation

Pronouncing words correctly often creates a positive impression. You can explain your ideas or response slowly. What matters is that your answers should be clearly understood. Do not get nervous or rush through the responses. If you are pronouncing any word wrong, practice it till you get it right.

Practice Mock Interviews

Mock interviews can be a game-changer. Practice with friends or AI tools. You can use a timer to create a real environment. Record your responses and listen actively. It lets you identify all your errors. Work on them and retake mock interviews.

Improving your English for interviews takes time. It requires daily practice and patience. Work on clear speech, expand your vocabulary, and practice mock interviews. Consistent effort is an underrated skill. It can help you speak confidently and enhance your chances of success. more

Career development

12h

Commentary: Helping vulnerable vets transition to a post-service life

By clicking submit, I authorize Arcamax and its affiliates to: (1) use, sell, and share my information for marketing purposes, including cross-context behavioral advertising, as described in our Privacy Policy , (2) add to information that I provide with other information like interests inferred from web page views, or data lawfully obtained from data brokers, such as past purchase or location... data, or publicly available data, (3) contact me or enable others to contact me by email or other means with offers for different types of goods and services, and (4) retain my information while I am engaging with marketing messages that I receive and for a reasonable amount of time thereafter. I understand I can opt out at any time through an email that I receive, or by clicking here

Military life is a family mission anchored in shared purpose, sacrifice, and service. Every deployment, relocation, and empty chair at the dinner table reflects not only the service member's duty to the country, but also the family's quiet endurance. Together, they live a calling few outside the military will ever fully understand.

That calling often disappears the moment service ends. Nearly 250,000 service members leave active duty each year. Some walk away with decades behind them; others with only a few stripes. But regardless of rank, many face an identity crisis the moment they take off the uniform for the last time.

Behind every folded uniform lies quiet uncertainty -- and for too many, that uncertainty turns tragic. Veterans are at the most significant risk in the first year after leaving service, when mission, identity, and community disappear overnight.

According to the Department of Veterans Affairs' (VA) most recent report, veterans who separated in 2021 died by suicide at a rate of 46.2 per 100,000 within their first 12 months of separation. Those who separated between 2010 and 2019 experienced first-year suicide rates ranging from 34.8 to 51 per 100,000.

The message is unmistakable: a transition without purpose is not just a vocational challenge -- it's a life-and-death issue.

This is not only the veteran's burden. When a service member loses purpose, the family loses its anchor. Spouses absorb emotional and financial stress; children feel instability. A fractured transition destabilizes the very institution that undergirds military readiness: the family.

The Department of War (DoW) and the VA share responsibility for this runway. DoW owns the final years before separation, and the VA inherits what comes after. Between them sits the Transition Assistance Program (TAP), the military's designated on-ramp to civilian life.

But TAP is not an actual transition program. It is a checklist: PowerPoints, résumé templates, and briefings. In a national survey by the Veterans of Foreign Wars, more than half of veterans said TAP didn't adequately prepare them, describing it as a 'fire-hose of information' delivered with 'no time to absorb or apply it.

TAP prepares veterans for a paycheck, not rediscovering their purpose. It explains benefits, but rarely helps service members answer the fundamental questions every warrior faces at separation: Who am I now? And it leaves families almost entirely outside the process.

The military trains its people for every mission except the last one -- rediscovering who they are when they hang up the uniform once and for all.

It's time for a different approach.

Some programs already provide a path that works. At Texas A&M University, the VET+MAP program helps service members -- and their families -- rediscover their purpose, mindset, and identity before separation. It treats purpose as the center of transition, not an afterthought. It asks the questions résumé workshops cannot answer: Who am I? Why am I here? What am I called to build next?

Joint Special Operations Command (JSOC) applies similar principles, treating transition like any other mission. Each departing operator receives mentors, purpose-driven planning, and a trusted network. The result is not just employment -- it's direction and renewed purpose.

Together, these programs offer a clear roadmap for the DoW to strengthen transition outcomes by integrating the purpose-based lessons pioneered at Texas A&M and JSOC into a formal pilot program.

A three- to five-year pilot could be launched across select installations and include four essential components:

1. Early purpose-based preparation (12-18 months before separation)

Not résumé writing -- identity rediscovery, mentorship, mindset development, and community building. What gifts, talents, and passions remained dormant throughout the military journey?

2. Family integration

Transition is a household event, and TAP's current structure fails to recognize that reality.

3. Measurable outcomes

TAP has never measured what actually works. A partner such as Texas A&M or Syracuse University's Institute for Veterans and Military Families (IVMF) could evaluate:

-- Post-service employment and education

-- Mental-health and suicide-risk indicators

-- Family stability at one, three, and five years after separation

4. Leader accountability

The DoW does not evaluate leaders on how well their people transition, leaving a critical part of readiness unmeasured. The DoW could change that by adding transition-readiness metrics to unit and leader evaluations, tying accountability to how well service members -- and their families -- are prepared to succeed after service.

Such a pilot would give the DoW the evidence needed to redesign transition for the modern era. It would also acknowledge a truth that military families have learned for generations: purpose gives direction, and a unified family provides a catalyst to success. When either breaks down, the nation pays the price. When both are supported, the country gains leaders grounded in resilience, discipline, and service.

Transition is not workforce development. It is identity development, and identity begins at home. Readiness does not end when a service member leaves the formation; it continues in the strength of the family that runs -- rather than limps -- into the next chapter.

If we get this right, we can finally begin turning the tide on veteran suicide. Purpose, identity, and belonging are not soft concepts -- they are protective factors. When service members leave the force with a renewed sense of mission and families equipped to run with them into civilian life, the risks of despair decline dramatically.

The next mission begins before service members hang up the uniform for the last time. We can either leave them to rediscover their purpose on their own, or we can build a transition system worthy of their service -- and the families who stood by them through it all.

America's strength has never rested solely in its weapons, but in the men and women in uniform, and the families behind them, who know their calling does not end when their service does.

____

Chris Wingate is the Government Relations Director at The Heritage Foundation and a former Senate staffer for Senators Ted Cruz (R-TX) and Joni Ernst (R-IA). He is a retired Army Lieutenant Colonel and Aeromedical Evacuation Officer. more

Career development

2d

Notes on sending thank-you notes

Send a smartly written note. It's an effective way to extend the conversation and reinforce your message that you're the right person for the job.

I realize that the concept of mailing a handwritten thank-you note after a job interview sounds really old-fashioned.

But I still believe that sending such notes - even to an avatar - conveys more than mere courtesy. It's an effective way to extend... the conversation and reinforce your message that you're the right person for the job.

Not long ago, I thought that sending an emailed thank-you note wasn't good enough.

But lately I've changed my mind because so much has changed, especially for high tech companies that don't acknowledge that handwriting even exists anymore. Heck, most elementary schools don't even teach cursive.

Now I recommend taking a two-step approach: First, send an emailed thank-you note to courteously acknowledge having the interview, closely followed by a handwritten note -- because I'll always believe in the emotional value of handwritten notes.

If you have lousy handwriting, go slow, because a note that's illegible is worse than not sending a note at all. After all, if the recipient can't read what you've written, what's the point?

Remember that an employer will also regard your note as an example of your work. You send me a sloppy note, I'll assume you'd be a sloppy employee.

Be brief. It's a note, not a treatise.

Be specific. Refer to actual elements of a conversation or meeting. Let the recipient know you weren't just listening but that you were also thinking.

Do send thank-you notes to everyone you interviewed with, not just HR.

The fact that several people were either on a panel or met with you privately during the day means they'll likely have input on the decision to hire you or someone else.

If you were interviewed by a robot, surely at least one human who oversees hiring exists in the company. Get a name and send him/her/it a written thank-you note.

You might be the only candidate who takes that extra step.

Too frequently, I get meaningless notes like this:

"Dear Mr. Blair, Thank you so much for the excellent seminar today. I liked your ideas. Thank you again, XXX."

That says nothing except that the sender attended a seminar. I don't know what seminar he's talking about, let alone his notion of "great ideas."

He could hardly be less memorable - except that he said "thank you" twice. Once is enough.

I usually don't remember applicants who don't send thank-you notes, but I'll likely remember those that do, and maybe favorably.

Some examples of actual thank-you notes I've received:

GOOD:

Dear Phil, Thank you for providing great insider tips, suggestions and enthusiasm at the recent Job Search/Skill-Building seminar. You inspired me. Your idea about putting keywords on resumes was particularly enlightening. I appreciate the renewed spirit you bring to all of us "Career Managers" as we search for our next opportunity.

Dear Phil, I wanted to take this moment to express my appreciation for your time and advice last week. It was very good and I have taken it much to heart. I am sure it will help me moving forward.

Love, _____

The merit and demerits of the notes above should be pretty obvious.

In the "good" note, the writer gets straight to the point, specifically mentions an event and something she learned and refers to a key philosophy: We must all proactively manage our careers. I know she paid attention and valued my time.

The "bad" note barely qualifies as a note. The language is too casual, too vague (no reference to when the actual meeting occurred), and insultingly bland.

This person would have been better off not sending a note. Saying something is "interesting" is another way of saying you don't have much to say.

Finally, the "awful" note is too wishy-washy. But where it truly bombs is in the closing. A professional thank-you note is no place for love.

Be careful with your words. Make sure they say what you mean and that you mean what you say.

Thank you for writing. more

2

Ezinna Iroegbu
2
15h
This is a very beautiful suggestion. I have never thought of this before. Thank you, I honestly do appreciate this beautiful tip.