Endorsed flags nearly half of US remote IT applications for North Korean patterns

Endorsed's 175,000 applications were selected on the outcome, which is the first thing to hold onto: every one of them had already tripped a mid-to-high-risk flag ^[1], so the Texas 26.5%, California 14.4%, Florida 7.2% split ^[6] describes the shape of the flagged pool, not the shape of the applicant market. What that pool does give you is scale in a form a recruiter can feel, because 26.5% of 175,000 is 46,375 applications claiming a Texas origin ^[2], and the three favoured states together account for 48.1% of the flagged set ^[3].

The load-bearing figure is the other one. Among US-based remote IT roles, where CEO David Head says the fraud concentrates ^[11], the flagged share went 11% in the third quarter of 2024, 44% a year later, and an estimated 47% in the most recent quarter ^[5], which is roughly 4.3 times the starting rate ^[1]. Head's own caveat is the reason the number cannot be operationalised as a list: no single trait, he says, should make an applicant suspicious, and the risk sits in patterns of inconsistency rather than a name or a background ^[10]. The personas are chosen precisely because they are unremarkable, borrowed from real applicants ^[12], which is why a screen has to reach devices, networks, documents and behaviour, with a human at the end of it ^[22]. Human review at a 47% flag rate is arithmetic, not architecture: at 53% unflagged, a funnel needs about 38 applications to yield 20 that a person never has to adjudicate ^[4].

Now the cash, which points the other way. Cybersecurity venture funding was flat at $8.5bn in the first half of 2026 while deal count fell 23.8% ^[16], meaning the average cheque grew about 31% ^[5] as investors concentrated. Identity and access management went from $0.8bn in the first quarter to $0.3bn in the second ^[19], a 62.5% cut ^[7], which is 7.9% of the quarter's $3.8bn ^[6] against roughly 17% of the first quarter's implied total ^[8]. PitchBook's stated reason is a fear that AI-native security startups lose their shine to frontier models such as Anthropic's Mythos ^[20], and its bull case for the category rests on machine identities outnumbering humans about 45 to 1 ^[21], which is a different problem from a man in Pyongyang claiming UT Austin ^[7].

This is probably wrong, but the durable business is the per-application toll rather than the detector, because a hiring pipeline that must process 38 applications per 20 clean ones has a variable cost that scales with headcount plans instead of with breach anxiety, and Endorsed's 11 million analysed applications ^[3] are a corpus a frontier model would have to buy or rebuild. The counter-thesis is in the same funding data: if the correlation work becomes a feature ^[20], the toll goes to zero and the corpus is the only asset left. What would break my read is conversion. If flagged applications convert to confirmed imposters at a few percent, then 47% measures a threshold rather than an adversary, and employers will rationally under-screen and eat the tail, as the hundred-plus companies behind one New Jersey facilitator's nine-year sentence did ^[15].