Knowledge Hub

It is what you are allowed to do with it after you have found it.

The difficulty stands out especially when, during a background check based on open sources, information surfaces that relates to a criminal offense, an investigation, a legal proceeding or conduct of a criminal nature.

It can be a court ruling published in a legal database.

An old article on a news site.

An announcement by a public authority.

A report about an indictment.

A publication about a conviction.

Or even a public document that describes a factual event without using the words "criminal record" at all.

In such a situation a natural question arises:

If the information did not come from the police and was not pulled from the criminal register, but was found in an ordinary internet search, is it permitted to pass it on to the employer and take it into account in a hiring decision?

The answer is not a simple yes or no.

And the reason is that you have to separate three different questions:

1. Is it permitted to collect the information?

2. Is it permitted to pass it on to the party making the decision?

3. Is that party permitted to use it in an employment decision?

These are three entirely different stages.

First of all: what is "criminal information" under the law in the first place?

Israel's Criminal Information and Rehabilitation of Offenders Law, 2019, defines "criminal information" as information from the criminal register and from the police register.

The criminal register includes, among other things, details of convictions and certain decisions listed in the law.

The police register includes other types of information, such as pending cases and additional police information in accordance with the provisions of the law.

The initial implication matters:

Not every piece of information describing criminal conduct is necessarily "criminal information" in the technical sense of the law.

A newspaper article is not the criminal register.

A court ruling published to the public is not the police database.

An announcement by a public authority does not become a police register just because it describes an offense.

But this is exactly where the complexity begins.

The source of the information is not the end of the discussion

It is very easy to reach the following conclusion:

"If I found it on Google, I am allowed to use it."

That is a dangerous conclusion.

The Criminal Information Law does not deal only with how a person obtains information.

Section 38 provides that whoever is not entitled to receive certain criminal information, or criminal information at all, shall not take it into account in making a decision.

The section goes on to provide that "additional information relating to the said criminal information" shall not be taken into account either.

In other words, the fact that information came from an open source does not necessarily detach it from the restrictions that apply to the use of criminal information.

The test is not only:

"Where did the information come from?"

You also have to ask:

"What did we actually learn from it?"

And:

"What do we intend to do with this information?"

This is a critical distinction.

OSINT cannot become a bypass route for obtaining information whose use the law was designed to restrict.

In other words:

If an employer is not entitled to receive certain information from the criminal register, it is wrong to assume that it can simply reconstruct that same information through a search of open sources and then use it as if the restriction did not exist.

But the opposite direction is not correct either

Here it is important to avoid the opposite mistake.

The fact that a public source describes criminal conduct does not automatically turn every detail in it into information that must not be collected, reported or considered.

A background check may uncover factual information with clear significance for risk assessment.

Sometimes that information is also connected to a criminal proceeding.

The question is not only which legal label can be attached to it.

You have to understand the context.

Is it a conviction?

An investigation?

An indictment?

A closed case?

An acquittal?

A claim made by a party in a civil proceeding?

A factual finding by a court?

A press report whose outcome is unclear?

Or documented conduct relevant to the role, even if the legal proceeding itself is not the focus of the check?

Each of these cases is different.

An example: a candidate who is supposed to manage money

Suppose a person is a candidate for the role of CFO.

The role includes signing off on payments, access to bank accounts, permissions in financial systems and responsibility for significant sums of money.

During a background check, a public and reliable court ruling is found describing that person's past involvement in an act of financial fraud.

Here, two extreme reactions would be problematic.

The first reaction:

"It is a public court ruling, so we are automatically allowed to pass it on and recommend against hiring."

That conclusion is too broad.

The second reaction:

"There is a connection to a criminal offense here, so we are not allowed to relate to the information at all."

That conclusion is also too broad.

A professional background check needs to break the finding down.

What exactly did the ruling determine?

Is it a conviction or only a description of a claim?

When did the event take place?

What was the person's part in it?

Did the proceeding end in a way that changes the meaning of the finding?

Are there additional sources that corroborate it?

And the central question from a risk management perspective:

What is the connection between the finding and the role being assessed?

When a person is about to receive control over money, a reliable finding concerning fraudulent financial conduct may carry far clearer significance than in a role with no access to funds, assets or financial permissions.

But here too, relevance to the role is not a "get out of the law" card.

It is part of the check, not a substitute for the legal analysis.

Relevance is a central condition, but not the only condition

This is perhaps the most important distinction.

In the background check world we are used to thinking in terms of relevance.

Rightly so.

The purpose of a background check is not to collect every detail that can be found about a person.

The purpose is to identify information with a real connection to the risk arising from the role.

For example:

A history of financial fraud may be highly relevant to a role that includes access to funds.

An incident of information misuse may be relevant to a role with permissions to sensitive databases.

Violent behavior may take on special significance in a role that includes responsibility for the safety of others.

A material breach of trust can be relevant to a role in which the employee will receive broad independence and access to sensitive assets.

But relevance alone is not enough.

Even highly relevant information can be information whose use the law restricts.

So the correct order is:

Legality first.

Relevance after.

And not the other way around.

Not every press mention equals a "criminal record"

There is another professional problem as well.

The internet almost never provides a complete legal picture.

You can find an article from 2018 saying a person was arrested.

But what happened afterwards?

Was an indictment filed?

Was the case closed?

Was the person acquitted?

Is it even the right person?

Was a correction to the article published?

Did a higher court overturn the ruling?

A background check that collects the first mention and stops there can be worse than not conducting a check at all.

Especially when the information has the potential to harm a person.

That is why such a finding requires verification, context and updating.

The acquittal is a good example of the trap

Suppose a search of a candidate's name brings up dozens of articles about a high profile criminal trial.

At first glance the impression is severe.

But after reading the ruling it turns out the person was acquitted.

If the analyst settles for the old headlines, they are effectively creating a picture that is the opposite of the legal reality.

This is one of the reasons a background check cannot amount to a keyword search.

You have to understand the sequence of events and the outcome.

The age of the information matters too

A finding that is one year old is not necessarily the same as a finding that is twenty years old.

The Criminal Information Law itself is built, among other things, on a concept of limitation periods, expungement and rehabilitation.

The purpose is not only to protect information.

It is also to allow a person not to carry forever the full weight of an event from their past.

So when old information appears online, the fact that the internet "remembers" it does not mean an employer must necessarily remember it the same way.

This is especially true for information whose influence the law itself sought to reduce over time.

And what about information that is not a conviction?

Here even greater caution is required.

An arrest is not a conviction.

An investigation is not a conviction.

An indictment is not a conviction.

A closed case is certainly not a conviction.

An article about a suspicion is not proof that the suspicion was correct.

And yet, an OSINT search can bring up all of these.

That is why a professional background check cannot settle for the words:

"We found a negative publication."

You have to say exactly what was found.

Who published it.

When.

What its legal status is.

And what happened afterwards.

The difference between:

"The candidate was convicted of fraud"

And:

"In 2019 it was reported that the candidate was questioned on suspicion of fraud"

Is enormous.

Three questions to ask before such a finding goes into a report

When information connected to a criminal proceeding surfaces during a background check, it is right to separate three layers.

1. Is it permitted to collect it?

Is it information from a legitimate public source?

Was the way the information was obtained lawful?

Is there no attempt here to bypass a legal restriction through a third party?

2. Is it right and permitted to report it?

Even information found lawfully does not have to enter the report automatically.

Its reliability, currency, severity and relevance have to be examined.

You also have to consider whether passing it on could put the decision maker in a position of being exposed to information the law does not allow them to take into account.

3. Is the employer permitted to use it in the decision?

That is a separate question.

An employer may be authorized to receive one type of information and not another.

Certain roles are subject to special arrangements.

Certain bodies hold powers that an ordinary private employer does not have.

And sometimes the law allows information to be taken into account only under certain conditions.

So there is no single answer that fits every organization and every role.

Amendment 10 to the law demonstrates exactly this principle

In 2026 a new and narrowly focused arrangement concerning certain terrorism offenses was added to the law.

Under the conditions set, the law allows an employer to ask the police for a notice stating whether or not an adult candidate has a criminal record entry relating to a serious terrorism offense or to certain offenses under the Counter-Terrorism Law.

The request is conditional on the candidate's written consent, and the notice does not provide the employer with the full details of the register.

The amendment came into force on August 24, 2026.

The very fact that the legislator needed to create such a specific route illustrates an important point:

Access to criminal information for employment purposes is not a matter of "there is consent" or "I found the information".

It is a matter of authority, conditions and purpose.

So what is the role of an OSINT-based background check?

A background check is not a substitute for the criminal register.

And it is not supposed to be a way to reconstruct it.

Its role is far broader and different.

OSINT can uncover information about:

Conflicts of interest.

Companies and business connections.

False claims in a resume.

Professional history.

Sanctions.

Connections to high risk parties.

Civil proceedings.

Media reports.

Public statements.

Unusual business activity.

Behavioral patterns.

Information related to trustworthiness, when it is relevant to the role and collected and analyzed lawfully.

And sometimes, within that space, information with a connection to the criminal world will surface as well.

At that point the professional responsibility is not to make it disappear automatically, and not to rush to pass it on either.

The responsibility is to understand exactly what was found.

The question is not only "what did we find?"

It is:

What is the source of the information?

What is its level of reliability?

What is its legal status?

Is there a later development?

How old is the finding?

Is it the right person?

Is it permitted to pass it on?

Is the employer permitted to use it?

And what is its real connection to the risk arising from the role?

Only after all of these questions are answered can you decide whether the finding should be included in the background check, and in what form.

The bottom line

"Public information" and "information that may be used in a hiring decision" are not synonyms.

But "information relating to criminal conduct" and "information that must never be reported" are not synonyms either.

Reality is more complex.

OSINT is not a way to bypass the Criminal Information Law.

But a background check should not ignore public, reliable and relevant information just because it relates to conduct that may be criminal.

The professional test lies in the combination of four things:

The legal framework.

The source and quality of the information.

The relevance to the role.

And the way the information will be used in making the decision.

Finding information online is the easy part.

Professionalism begins with the question of what is permitted, right and fair to do with it after we have found it.

Get these breakdowns in your inbox, plus the six steps for closing the offboarding window as a one-page brief.Get the one-pager

At the same time, the amendment sharpens an important distinction that many people are unaware of: there is a separation between criminal information held in the criminal register and protected by law, and factual, public information found in open sources (OSINT), which is not part of the criminal register at all. It is precisely this distinction that makes OSINT-based background checks a more important tool today than ever before.

What did Amendment No. 10 change? The amendment adds a new mechanism of a “notice regarding the existence of a criminal record entry,” through the new Section 16A of the law. In certain cases, instead of disclosing the full content of the criminal record, the authorized body will receive a notice stating that a criminal record entry exists, in accordance with the arrangements set out in the law. In addition, this notice was defined as part of the term “criminal information.” The purpose of the amendment is to continue strengthening the principle of rehabilitation of offenders, while balancing the public interest against a person's right to rehabilitate.

What does it mean for employers? For most employers, the basic legal situation has not changed. Even today: an ordinary employer may not require a candidate to present a criminal record; it is prohibited to require a candidate to obtain information from the police on the employer's behalf; and only bodies expressly authorized by law may receive information from the criminal register, and only to the extent set by law. In other words, even after the amendment, most employers cannot base their decision-making process on the criminal register.

But this is where the common mistake begins. Quite a few people believe that if you cannot obtain a criminal record, you are not allowed to know anything about a candidate's past. This is not the correct interpretation. The law regulates access to the criminal register and to criminal information managed by the state. It does not prohibit locating factual information that has already been lawfully published in open sources. This is a very important legal distinction.

What is the difference between a criminal record and open information? A criminal record is information managed in the criminal register of the Israel Police, and access to it is regulated by law. By contrast, information such as judgments published in legal databases, official court publications, Israel Police spokesperson announcements, State Attorney's Office announcements, publications by regulatory authorities, credible news articles, tender and disqualification notices, liquidation, receivership or legal-proceedings documents, public business information, and publications of sanctions or international blacklists does not constitute “criminal information” as defined by law merely because it describes a criminal event or a conviction. This is public information that was lawfully published, and therefore it is not part of the criminal register itself. Of course, the use of such information must also be carried out in accordance with privacy protection laws, the prohibition of defamation, and the principles of relevance, proportionality and good faith.

This is where OSINT-based background checks come into the picture. A quality background check does not try to circumvent the law and does not try to obtain confidential information. On the contrary. It operates solely through public and lawful information sources. When professional OSINT is performed, it is sometimes possible to locate substantive information that is not accessible through the criminal register, for example: convictions published in judgments, involvement in fraud affairs that received publicity, indictments published lawfully, insolvency proceedings, significant civil proceedings, problematic business relationships, conflicts of interest, ties to high-risk companies or parties, indications of fraud or impersonation, and public behavioral patterns with occupational significance. Sometimes it is precisely this kind of information that gives the employer a broader picture than the mere existence of a criminal record.

Does this replace a criminal record? No. These are two entirely different tools. The criminal record is official state information. OSINT is not a criminal register and does not claim to be one. Its purpose is to identify indications of risk from public information that can be verified, cross-referenced and professionally assessed. Therefore, in many organizations, especially in sensitive positions, OSINT checks do not replace the checks prescribed by law, but rather complement them.

The practical meaning for employers: Amendment No. 10 continues the legislator's trend of strengthening the protection of people's privacy and the principle of rehabilitation. However, it does not eliminate employers' duty of care toward their employees, their customers and the organization. Therefore, the more restricted access to official criminal information becomes, the greater the importance of conducting quality background checks based on open, lawful, relevant and verified information.

The challenge for the employer today is not to obtain more information. The challenge is to know how to distinguish between information that may not be received and public information that is permitted, and even worth considering, as part of an informed decision-making process. It is also important to remember that any use of information originating in OSINT must be carried out in accordance with all relevant legislation, including the Privacy Protection Law, the prohibition of defamation, labor laws, and the principles of equality and proportionality. The mere fact that information has been published publicly does not automatically make it relevant or legitimate for every recruitment decision.

Get these breakdowns in your inbox, plus the six steps for closing the offboarding window as a one-page brief.Get the one-pager

This story is not just a story about investments, crypto or the capital market.

It is a story about a failure of due diligence.

Many people think a background check is only meant for hiring employees. In practice, it is no less important when choosing a business partner, an investment manager, a supplier, an advisor, or anyone who is supposed to be given access to money, information or assets.

In this case, some of the information was completely available in open sources: a criminal conviction for fraud offenses; a lengthy prison term; historical media coverage; legal proceedings and rulings; and business and public information that can be located through professional searching.

The problem is that finding the information is not enough. You have to know how to connect the dots.

An OSINT-based background check is not just about collecting data. The real value lies in the analysis and in understanding what the information means for the purpose of making a decision.

When you assess a person who is meant to manage your money or make financial decisions, the question is not only "Did he have a prior conviction?", but rather: Did he disclose it fully? Are there additional warning signs? Are there gaps between the public image and reality? And are there patterns that recur over the years?

Ultimately, most major frauds don't begin with technological sophistication. They begin with trust.

And before extending trust, it is worth conducting a professional background check based on open information sources, in order to make an informed decision grounded in facts rather than in personal impression or charisma.

Get these breakdowns in your inbox, plus the six steps for closing the offboarding window as a one-page brief.Get the one-pager

In my view, that's actually the easy part.

The real challenge begins the moment after we've found the information: are we certain it belongs to the person we're actually checking?

In a world where millions of people share similar names, use nicknames, maintain multiple digital profiles and sometimes leave only partial traces, it's very easy to fall into the trap of a "quick identification."

I often come across cases where investigators, recruiters or managers see a problematic profile online, an old article or a negative mention, and rush to draw conclusions.

But a professional background check is not an exercise in gathering information. It's an exercise in verifying identities.

Before drawing conclusions, you have to verify: is it the same person? Does the geographic location match? Does the timeline line up? Are there additional identifiers that connect the data points? And are there independent sources that confirm the link?

The greatest danger isn't missing negative information. The greatest danger is attributing negative information to the wrong person.

A mistake like that can lead to flawed hiring decisions, damage to the reputation of an innocent person, and even legal exposure.

That's why one of the most important principles in open-source intelligence (OSINT) work is: first you verify. Only then do you conclude.

That's the difference between gathering information and pursuing the truth.

Get these breakdowns in your inbox, plus the six steps for closing the offboarding window as a one-page brief.Get the one-pager

At first it seemed completely credible. Photos, explanations, Google results, mentions on various sites including Wikipedia.

But the deeper I dug, the more I discovered that most of the story isn't grounded in anything at all. Some of the photos were wool sculptures by a Japanese artist. Others were images of entirely different species. And in practice, the only thing that truly exists is a single photograph of an unidentified moth taken in Venezuela (the image at the top left). There isn't even an official scientific recognition of such a species.

What's interesting here isn't the moth. It's the way information turns into "truth."

Today, search engines no longer rely solely on original sources. They are also fed by content created by AI, by automated summaries, by copying between sites, and by information that recycles itself again and again.

And what this means is that even if you try to do a "reverse trace" and check what the real source is, it becomes very difficult. Because at a certain point, the original source disappears, the information is copied hundreds of times, AI systems summarize erroneous information, and unverified content starts to look more credible than reality itself.

And this is precisely one of the great challenges in the world of background checks.

It isn't enough to know how to search for information. You need to know how to doubt information.

You need to understand: Who is the source? Is there any verification? Is this primary information or a copy? Is there a vested interest? And is everyone simply quoting one another?

In an era where AI can generate enormous quantities of convincing content, the ability to think critically becomes a critical professional asset.

This is exactly why professional background checks cannot rely solely on a quick Google search or on AI tools.

In the end, you still need people who know how to connect contexts, identify manipulation, understand what's missing from the picture — and above all, know when not to believe immediately something that looks credible.

Get these breakdowns in your inbox, plus the six steps for closing the offboarding window as a one-page brief.Get the one-pager

The request was clear: locate the source of distribution, stop it quickly, and remove the content.

On the surface, this sounds like a classic open-source intelligence task. But that's exactly where the problem begins.

I want to share with you, with professional honesty, where OSINT is strong and where it simply isn't enough.

Where OSINT delivers real value: you can map how content spreads, identify groups, channels and distribution hubs, track recurring users across different platforms, and understand who is "pushing" the story forward. This provides a very important intelligence picture.

But here comes the critical limitation: you cannot identify with certainty who the person behind the account is, prove who created the content, access closed information (IP, devices, logs), or guarantee complete removal from the internet.

And when it comes to sensitive incidents, especially involving minors or privacy violations, the smallest mistake in identification can turn into a serious legal problem.

The real risk: the problem is not only technological - it is managerial. When you make promises like "we'll find who did it" and "we'll take everything off the web" without understanding the limits, that's a recipe for disappointment at best, and for damage at worst.

So what is the right thing to do in such cases? The right approach is always multidisciplinary: OSINT for mapping and understanding, DFIR for collecting evidence from devices and systems, legal support for approaching the platforms, damage control and prevention of repeated distribution, and continuous monitoring. Anyone who handles this alone, from a single angle, misses the picture.

The bottom line: open-source intelligence is a very powerful tool - but it is not magic.

Knowing what can be done is important. But knowing what cannot be done - that is what separates professional work from risk.

Get these breakdowns in your inbox, plus the six steps for closing the offboarding window as a one-page brief.Get the one-pager

And this is exactly where many organizations fall short.

We live in an era of endless open information: forums, groups, leaks, small hints. But without real business context, without an understanding of what is relevant to a specific organization, it all turns into noise.

And this is not only in the cyber world.

It is exactly the same principle in the world of open-source intelligence.

I see it all the time: organizations think they need "more checks", "more sources", "more data". But the truth is the opposite. The real value comes from the ability to connect the dots.

For example: someone posts on a dark forum offering access to a system. They do not mention a company name. There are no clear keywords. Classic systems will not detect it. But if you understand the context, the type of system, the size of the company, the geographic location, the type of activity, suddenly it is no longer "general information". It is a very specific threat.

And now think about this in the context of insider threats.

Many times the threat does not start from within the organization. It starts outside, on the dark web, in forums, in groups. But it connects to people on the inside: an employee with access, a vendor with permissions, a candidate trying to get in.

Without a connection between external intelligence and an internal understanding of the organization, you miss the story.

And this is the truly important point: AI alone does not solve the problem. Relying on OSINT alone does not solve the problem.

Only a combination of real business context, human analysis that understands behavior, and technology that can operate at scale creates a real advantage.

Whoever keeps collecting information without understanding what is relevant to them will drown in the noise. Whoever knows how to connect the dots in time will identify the threat before it becomes an incident.

Get these breakdowns in your inbox, plus the six steps for closing the offboarding window as a one-page brief.Get the one-pager

For organizations that conduct background checks based on open-source intelligence (OSINT), the question sometimes arises as to whether these regulations will make such checks impossible or undermine their effectiveness.

The professional answer is no.

Regulation changes the way in which the check is performed, but it does not eliminate the need for it, and it does not prevent the conduct of high-quality checks when they are carried out in a professional, lawful, and proportionate manner.

What is Amendment 13 to the Privacy Protection Law? Amendment 13 is intended to strengthen the enforcement capabilities of the Privacy Protection Authority and to align Israeli law with modern international standards. Among other things, the amendment grants the Privacy Protection Authority broader enforcement powers, significantly increases the level of financial sanctions, requires organizations to manage personal information more responsibly, increases the accountability of database owners and data processors, and strengthens the rights of data subjects. In practice, the implication for organizations is that violating privacy provisions may become a significant business, legal, and reputational risk.

How do privacy regulations affect background checks? The most common mistake is to think that privacy legislation prohibits the collection of information. In fact, most regulations around the world do not impose a blanket prohibition on collecting personal information. They require that collection be carried out on the basis of clear principles: a legitimate purpose, proportionality, transparency, data minimization, data security, and limited retention over time. In other words, the question is not "is it permitted to collect information?" but rather "what information is collected, why is it collected, and how is it used?".

The use of OSINT is not exempt from privacy laws. There is another mistaken perception according to which information published online is "free to use". The fact that information is found online does not negate the fact that it is personal information. For example: a LinkedIn profile, social media posts, news articles, business records, and forum content. All of these may be considered personal information and subject to privacy laws. Therefore, an organization conducting background checks cannot rely on the claim that the information was merely "public".

How can high-quality background checks be conducted in compliance with regulation?

Defining a clear purpose: A background check should be directly related to the risk that the organization seeks to mitigate. For example: detecting conflicts of interest, identifying past fraud, detecting behaviors that may harm the organization, examining reputational risks, and identifying problematic business relationships. Collecting information unrelated to this purpose may be considered a deviation from the principle of proportionality.

Collecting only relevant information: A professional check is not measured by the quantity of information collected but by the quality of the information. In many cases, an excess of information actually makes decision-making more difficult. The correct approach is to focus on information of genuine business value and to link it to the required risk assessment.

Using human analysts: One of the central problems in automated checks is the massive collection of information without context. A professional analyst knows how to distinguish between fact and opinion, cross-reference sources, identify errors in identification, understand cultural and linguistic contexts, and exercise judgment. Precisely in a world of stringent regulation, the value of the human element grows.

Transparency and consent when required: In recruitment processes or certain engagements, it is recommended to obtain explicit consent to conduct a background check. Even when the law does not fully require this, clear consent strengthens the legitimacy of the process and reduces legal risks.

Deletion of information and limited retention: One of the fundamental principles in most privacy regulations is limiting the duration of retention. After completing the check and making the business decision, one should examine whether there is justification for continuing to retain the information, whether the reports can be deleted, and whether only partial retention of the data is necessary. This approach reduces data security risks and lowers regulatory exposure.

The advantage of OSINT precisely in the age of privacy: Paradoxically, privacy regulations actually strengthen the standing of high-quality OSINT checks. In the past, many organizations relied on collecting information from numerous databases, some of which were legally problematic. Today, the emphasis is shifting to information gathered from open, lawful, documented, and verifiable sources. When the check is conducted professionally, it is possible to reach significant insights even without access to private or confidential information. In many cases, it is precisely the open information that provides the most important indications regarding behavior, business relationships, reputational risks, or conflicts of interest.

The key is Governance, not prohibition: The central message of Amendment 13 and of privacy regulations around the world is not "do not conduct background checks". The message is: conduct them responsibly. Organizations that build orderly work processes, adhere to proportionality, operate control mechanisms, and use professional analysts will be able to continue conducting highly effective background checks even under stringent regulation.

In fact, in a world where insider threats, fraud, AI-based impersonation, and conflicts of interest are becoming more complex, the need for professional background checks is only growing.

The new challenge is not to find information. The challenge is to know how to collect the right information, use it lawfully, and derive from it insights of genuine value for decision-making.

Get these breakdowns in your inbox, plus the six steps for closing the offboarding window as a one-page brief.Get the one-pager

The core idea is simple but very profound: our body does not merely "express" emotions and thoughts, it also influences them, and sometimes even reveals them before the brain manages to control the message.

For years, body language was viewed as an "add-on" to communication. Today it is already clear that it is part of the thinking system itself. Sitting posture, hand placement, breathing rate, head movements, distance from the camera, use of space, micro-expressions, vocal changes, and even the manner of typing are all part of a behavioral information system.

In business profiling this is critical.

When we conduct a reliability assessment or try to identify the potential for an internal threat within an organization, we are not looking only for a "lie." It is far more complex. We are looking for incongruence.

The Embodiment Effect makes it possible to understand when physical behavior is not synchronized with the narrative a person is trying to produce. For example: a candidate who speaks confidently but whose body is in continuous defensiveness; an employee who declares commitment to the organization but reacts physically with stress when issues of authority, control, or loyalty arise; a manager who presents stability but shows abnormal signs of arousal around financial questions or internal conflicts; a remote candidate who produces "too perfect" eye contact, with an artificial response pace and communication patterns that suggest the use of external aids or real-time AI.

And here the new challenge enters: remote assessment.

In the era of hybrid work and Zoom interviews, some people think it is possible to "hide" behavior through a screen. In practice, the opposite sometimes happens.

The camera reduces background noise and forces us to focus on micro-behaviors: response delays, tone changes, eye darting, over-adjustments, unnatural listening, disconnects between voice and expression, motor freezing, and excessive use of calculated gestures.

Precisely in a remote environment, when you know what to look for, you can identify very significant indications of reliability, stress, concealment, manipulation, or internal conflict.

But it is important to state the professional truth: there is no "magic sign" that proves a lie. This is one of the biggest mistakes in the field.

Professional profiling is not built on myths of "touching the nose = lying." It is built on creating a behavioral baseline, identifying anomalies, cross-referencing information sources, analyzing context, understanding motivations, and reading dynamics rather than just isolated signs.

The Embodiment Effect is especially important in identifying internal threats within organizations, because people can control their words far more than their bodies. And in situations of stress, conflicting loyalties, a sense of threat, or concealment, the body almost always "leaks" information.

The future of the world of business profiling will not be based solely on technology nor solely on human intuition. It will be a combination of deep behavioral understanding, digital analysis, the use of OSINT, anomaly detection, and the human ability to read people even through a screen.

Because in the end, even in the era of AI, a person still leaves a behavioral signature.

Get these breakdowns in your inbox, plus the six steps for closing the offboarding window as a one-page brief.Get the one-pager

These are three personality traits that may initially look like self-confidence, charisma, or assertiveness, but within an organization they can turn into a real internal threat: narcissism, which involves a need for admiration, a sense of superiority, and difficulty accepting criticism; manipulativeness (Machiavellianism), which means using people as tools to achieve goals, without much guilt along the way; and functional psychopathy, which involves extreme coolness, a lack of empathy, and the ability to carry out harmful actions without conscience.

The interesting part is that people with such traits don't always fail job interviews. On the contrary.

More than once they are very impressive. They know how to talk. They know how to sell themselves. They know how to identify other people's weaknesses. And they know exactly which persona the organization wants to see in front of them.

That's why I think one of the biggest challenges today in the world of insider threats is not only identifying a 'problematic past', but understanding patterns of personality and behavior that may turn into an organizational risk in the future.

This can manifest as leaking information, deliberately harming the organization, manipulating employees, creating a toxic culture, or simply making dangerous decisions without any empathy for the consequences.

It's clear that not every person with Dark Triad traits is a criminal or an insider threat. But when you combine access to sensitive information, pressure, ego, lack of oversight, and manipulative ability, you get a combination that managers must be aware of.

And this is exactly where the value of in-depth assessment, proper questioning, intelligence from open information sources, and identifying red flags before harm occurs comes into play.

Because in the end, the most dangerous threat in an organization is usually not the one who looks dangerous. It's the one who knows how to look perfect.

Get these breakdowns in your inbox, plus the six steps for closing the offboarding window as a one-page brief.Get the one-pager

For example, there are cultures in which avoiding eye contact is a sign of respect. For others, it immediately raises questions. There are places where direct communication is seen as positive, while elsewhere it is perceived as rude.

And this is where biases come into play.

When we are not aware of them, we are not really analyzing the person. We are analyzing the gap between them and us.

In business profiling, this is especially critical. Decisions are made about people: candidates, partners, suppliers. An error in interpretation can lead to missing out on an excellent person, or worse, to failing to identify a real risk.

So what do we learn from this?

First of all, professional humility. Understanding that not everything that seems right to us truly is.

Second, context. Always asking: where does this person come from? Does the behavior fit with the culture they come from?

And finally, the right combination of analytical tools and human understanding. Without this, there is no real objectivity.

Anyone who works with people must understand cultures. Otherwise, they are simply guessing.

Get these breakdowns in your inbox, plus the six steps for closing the offboarding window as a one-page brief.Get the one-pager

I remember a time when LinkedIn was a very "clean" place. Professional, calculated, a little sterile. Everyone wrote the same things, everyone sounded the same, and there was almost nothing there that truly revealed who the person behind the profile really was.

And then the enshittification began.

More personal posts. More politics. More extreme opinions. More provocations that gain exposure because the algorithm loves noise.

For anyone looking for a purely professional platform, this looks like deterioration. And to a large extent, it really is.

But from my perspective, something interesting happened here.

It is precisely this "out of place" content that begins to tell the real story.

When I check someone as part of a background check from open sources, I'm not just looking at what they do. I'm looking at how they think. How they react. What sets them off. Where their boundaries are.

And these things almost never showed up on the old LinkedIn.

Today they are there. In abundance.

A political post written without filters, an aggressive response to a professional discussion, a choice to join a provocative trend, these are no longer "noise" to me. They are signals.

What was once a barren wasteland in terms of understanding personality has become a gold mine of behavioral indicators.

So yes, LinkedIn has changed. And maybe not for the better for those looking only for professionalism.

But for those who understand how to read between the lines, it's a platform that tells far more truth than it did before.

Get these breakdowns in your inbox, plus the six steps for closing the offboarding window as a one-page brief.Get the one-pager