AIRLOC — agentic threat model

Not certain from the listing — likely utilizes commercial LLMs for resume parsing, strategy formulation, and communication. Threats include prompt injection via malicious resumes designed to force-pass screening or bypass bias-mitigation guardrails.

Not certain from the listing — ingests and stores highly sensitive candidate PII, resumes, and onboarding documentation. Threats include data exfiltration of applicant databases and knowledge-base poisoning that could skew candidate matching algorithms.

Not certain from the listing — orchestrates multi-step workflows from sourcing to onboarding. Threats include insecure tool integration with Applicant Tracking Systems (ATS) and email clients, potentially allowing unauthorized automated actions.

Not certain from the listing — deployed as a closed-source SaaS platform. Threats include standard cloud infrastructure compromise, unauthorized database access, and lack of sandboxing for processing untrusted candidate-submitted files.

Not certain from the listing — claims to remove human bias and ensure fairness, which requires rigorous bias auditing and drift detection, but no specific evaluation or observability frameworks are detailed.

Not certain from the listing — handling recruitment and onboarding data mandates strict compliance with GDPR, CCPA, and employment non-discrimination laws, but the listing does not cite specific compliance certifications or access controls.

Not certain from the listing — likely interacts with external job boards, background check providers, and HR ecosystems. Threats include API key exposure and cascading trust failures across integrated third-party HR platforms.