What global security risk actually looks like today and how to manage it
A contract worker’s relationship with a company rarely looks like a full-time employee’s. Engagements begin and end on their own schedule. A worker might work with one client for three months, then move on, or handle two engagements at the same time. This constant change is what makes contingent work flexible and valuable. It also creates a different kind of data and access risk, one that most security advice does not address.
Most guidance on securing a workforce assumes a stable team that logs into the same systems every day. Contingent and contract work does not follow this pattern. Each engagement has its own beginning and end, and each one is a moment when access must be set up correctly and closed out completely. This is not simply an IT task. It is a compliance question, closely related to the classification and payroll work a compliance partner already manages.
Why Contingent Engagements Create a Different Risk Pattern
Full-time hiring is mostly a one-time event. A new hire receives access to what they need at the start, and that access can stay fairly stable for years. Contingent work does not follow that pattern. According to the American Staffing Association, staffing companies hired 12.7 million temporary and contract employees over the course of 2023, while only about 2.2 million were working in a given week during 2024. That gap illustrates the point clearly. A large share of contingent placements start and end within the same year, sometimes within a few weeks.
Every one of those placements is an access event. Each one starts with provisioning, systems, credentials, and sometimes physical equipment, and all of it must be fully closed out at the end. Multiply that by how often contingent engagements turn over, and it becomes easy to see how gaps can form. An account that should have been closed out sometimes stays open by mistake. A credential outlives the engagement it was created for. The pattern comes down to mismatched pace: access processes are typically built for stable, long-term employment, while contingent engagements move far faster.
There is a newer risk worth naming here too. Industry reporting has documented a rise in fraudulent candidates who use fabricated identities to get hired into remote contract roles, then use that access to reach a client’s systems. The U.S. Department of Justice has prosecuted cases involving workers who used stolen identities to secure remote contractor positions at more than 100 companies. This is a reminder that the access-event risk does not always start at onboarding. Sometimes it starts before the engagement even begins, with the question of who is being hired.
The Stakes of Access
The cost of getting this wrong continues to rise. The 2026 Cost of a Data Breach Report from IBM found the global average cost of a breach reached $4.99 million, a record high and a 12% increase from the year before.
The 2026 Verizon Data Breach Investigations Report adds useful detail. The human element was present in 62% of the breaches Verizon studied, and for the first time since the report began, exploited software vulnerabilities passed stolen credentials as the leading way attackers gain access.
Both findings support the same conclusion. Attackers do not need a sophisticated hack when an account was never closed out, a credential outlived its engagement, or access was granted to someone who was not who they claimed to be. In a workforce with this much turnover, those small gaps are not unusual exceptions. They are a predictable outcome of a process that is not built for how frequently engagements start and stop.
The Data Flow Behind a Contingent Engagement
A full-time employee’s data mostly lives in one place: the employer’s own systems. Contingent work rarely looks that simple. A worker’s personal and payroll information often passes from the worker, to a staffing agency or an EOR or AOR partner, to the end client, sometimes across a border along the way.
Each handoff in that chain is a point where data needs to be handled correctly. Who is responsible for protecting a worker’s information while it sits with the staffing partner? What happens to it once it reaches the client? These are the same questions that come up in classification and payroll compliance, applied to data instead of dollars.
This is where a lot of general security advice does not go far enough for contingent work. The risk is not primarily about a worker’s laptop or home network. It is about how many parties touch that worker’s data over the life of a single engagement, and whether each one is handling its part of that relationship correctly.
Where Classification and Compliance Overlap
Multi-jurisdiction data protection law adds another layer to this. Under the General Data Protection Regulation, organizations that handle personal data are treated differently depending on whether they are acting as a data controller or a data processor, a distinction that closely resembles the worker-to-agency-to-client relationship. California’s Consumer Privacy Act sets a similar distinction, giving residents rights over their personal information and setting expectations for how service providers in a chain like this one are meant to handle it.
Businesses that also communicate with contingent workers by email need to stay compliant with anti-spam law, whether that is the CAN-SPAM Act in the United States or anti-spam legislation in Canada. These are a smaller piece of the picture here, but worth knowing about if a contingent workforce spans both countries.
These laws were not written specifically for staffing arrangements, but they apply to them all the same. A business relying on contingent talent across multiple countries is often managing more than one of these frameworks simultaneously, in addition to the classification and payroll requirements that already apply. Coordinating all of it without an experienced partner adds real complexity.
What Responsible Access Management Looks Like
Good access management for a contingent workforce is not about locking down every device or mandating a specific security tool. It is about building the engagement lifecycle itself around clear checkpoints.
That starts with confirming who is actually being hired, since verification at the beginning of an engagement matters as much as what happens after someone starts. From there, access should be granted based on what a specific engagement requires, reviewed if the scope of the engagement changes, and fully revoked the moment it ends, not weeks later when someone finally notices.
None of this is complicated in principle. What makes it difficult is doing it consistently across a contingent workforce where engagements are constantly starting and ending, sometimes across multiple clients and countries at once. That consistency requires real, ongoing effort, and it is the same kind of operational discipline that classification and payroll compliance already require.
Bringing Compliance and Access Together
The risks described here come from how an engagement is structured: when access should begin, when it should end, and how a worker’s data moves between the staffing partner and the client. That structure is the same one that governs classification and payroll compliance.
People2.0 handles the classification and payroll side of contingent engagements across jurisdictions, work that already requires complying with the data protection laws governing the payroll and personal information involved. Getting that foundation right gives a business an accurate, up-to-date record of when each engagement begins and ends, the same information that should be driving access decisions on the client’s side.
If contingent engagements make up a meaningful part of your workforce, especially across multiple countries, it is worth asking whether your classification, payroll, and engagement records are as current as they should be. That’s the conversation we have with businesses every day.
Want to learn more? Reach out to People2.0 to find out how we help businesses like yours manage contingent talent compliantly, wherever your workforce operates.
FAQ
What makes data and access risk different for a contingent workforce compared to full-time employees?
Full-time hiring is mostly a one-time event, with access set up once and left largely unchanged for years. Contingent work does not follow that pattern. Engagements start and end constantly, so access has to be granted and closed out correctly every time, not just once.
What is the biggest risk when giving contract workers access to company systems?
The biggest risk is not usually a sophisticated attack. It is an access process that was not designed for how quickly contingent engagements turn over, so accounts and credentials outlive the engagements they were created for.
Who is responsible for a contingent worker’s data as it moves between a staffing partner and a client?
Responsibility depends on each party’s role in the relationship. Data protection laws such as GDPR and CCPA distinguish between organizations that control data and those that process it on another party’s behalf, a distinction that applies directly to how worker data moves from the worker, to a staffing or EOR/AOR partner, to the end client.
Do data protection laws apply differently to contingent workers across different countries?
Yes. A business working with contingent talent across multiple countries is often subject to more than one data protection framework at once, since these laws were not written with staffing arrangements specifically in mind but still apply to them. This adds a layer of complexity on top of standard classification and payroll compliance.
How does a compliance partner help manage this risk?
A compliance partner like People2.0 manages the classification and payroll side of a contingent engagement across jurisdictions, which requires complying with the data protection laws governing that payroll and personal information. That work keeps engagement records accurate and current, which is the same information a business needs to make sound access decisions.
Editorial oversight by Jeremiah Akin, Senior Manager, Global Brand and Content
