Penetration Testing for UK HR Companies and Recruitment Technology Businesses

Why HR Companies Are High-Value Targets

Human resources companies and HR technology platforms sit at the intersection of employment, personal data, and financial information. The data they hold — CVs, employment histories, salary details, performance reviews, disciplinary records, right-to-work documentation, bank account details for payroll, and sometimes medical or disability information — is among the most sensitive personal data in the economy.

A breach at an HR platform does not just expose one organisation's employees. A SaaS HR system, a recruitment database, or a payroll processing platform may hold data for thousands of client organisations and tens of thousands of individuals. The scale of exposure from a single compromise makes HR platforms attractive targets for both financially motivated attackers and state-sponsored actors interested in workforce intelligence.

Under UK GDPR, employment data carries significant obligations. Salary data, performance records, disciplinary history, medical accommodations, and right-to-work status are all categories that require appropriate technical and organisational measures. A penetration test that identifies and addresses vulnerabilities before an attacker does is both a security investment and a demonstration of the "appropriate technical measures" UK GDPR requires.

What a Penetration Test Covers for HR Systems

Candidate and employee portal security

HR platforms and recruitment systems typically offer candidate portals — where applicants submit CVs, complete assessments, and track application status — and employee self-service portals — where employees view payslips, update personal details, and access HR documents.

A penetration test examines:

**Authentication security** — Password policy enforcement, brute force protection, [multi-factor authentication](/blog/two-factor-authentication-website-security-uk) availability and enforcement, session management, and account lockout behaviour.

**Access control between candidates and employees** — Can a candidate access another candidate's documents? Can an employee access records belonging to employees of a different client organisation? [IDOR vulnerabilities](/blog/what-is-idor-vulnerability) — where changing an ID in a URL or API request exposes another user's data — are particularly common in platforms that have grown quickly and added features without rigorous access control review.

**Data exposure in API responses** — Many HR platforms have a web frontend backed by a JSON API. The API may return more data than the frontend displays — including salary bands, internal ratings, rejection reasons, or fields marked as admin-only. A penetration test examines API responses for data that should not be returned to the authenticated user's role.

**Document access controls** — CV files, right-to-work documents, and offer letters are typically stored in cloud object storage (S3, Azure Blob, GCS). If the URLs to these documents are predictable or if the storage bucket is misconfigured to allow public access, documents are exposed without authentication.

Multi-tenancy isolation

SaaS HR platforms serve multiple client organisations from a shared infrastructure. The isolation between tenants — ensuring that Organisation A cannot access Organisation B's data — is critical and is a frequent source of vulnerabilities in multi-tenant applications.

A penetration test with multiple test accounts across different tenants specifically probes:

- Whether requests from Tenant A can be used to read, modify, or delete Tenant B's data - Whether admin functionality in one tenant can be accessed from another tenant's user account - Whether API endpoints correctly scope queries to the authenticated user's tenant

Payroll and financial data

HR platforms that handle payroll processing hold bank account details, tax information, and salary records. These endpoints require particular scrutiny:

- Are bank account update flows protected against [CSRF attacks](/blog/what-is-csrf-attack)? - Is salary data returned only to users with appropriate role permissions? - Are payroll export files generated with appropriate access controls, or can they be downloaded without sufficient authorisation?

Integration security

HR platforms integrate extensively with third-party services — background check providers, payroll bureaus, benefits platforms, applicant tracking systems, and accounting software. Each integration is an attack surface:

- Are API keys for third-party integrations stored securely (not in client-side JavaScript or version control)? - Are [webhooks from third-party services validated](/blog/api-key-security-best-practices-uk) with cryptographic signatures before being processed? - Do integrations transmit data over encrypted connections with certificate validation?

Bulk data export and reporting

HR platforms often offer reporting and export functionality — download all employees, export this year's applications, generate a payroll report. These bulk export endpoints require access control as rigorous as individual record endpoints. A user who cannot read another tenant's employee list should not be able to trigger a bulk export that includes it.

What Yrzo AI Covers

The [Advanced scan (£799)](/checkout/pro) is designed for HR platforms and recruitment technology businesses. It includes:

- Authenticated testing across multiple user roles (candidate, employee, HR manager, admin) - Multi-tenant isolation probing where test accounts across different tenants can be configured - [IDOR testing](/blog/what-is-idor-vulnerability) across all candidate, employee, and client record endpoints - API response data exposure analysis - Document access control verification - CSRF protection on all state-changing operations - Integration endpoint security review

The report provides severity-rated findings with specific remediation guidance. [Start with a free scan](/free) to see your unauthenticated attack surface, or [contact us](/contact) to discuss a scoped engagement for your HR platform.

Related reading: [Penetration Testing for Recruitment Agencies UK](/blog/penetration-testing-recruitment-agencies-uk) · [What Is IDOR Vulnerability?](/blog/what-is-idor-vulnerability) · [API Security Testing UK](/blog/api-security-testing-uk)