HR's job adverts name your internal tools. What do you ask them to change, and what does it buy?

### Why this is a judgment question, not a technical one The facts that make lures credible are published by people who do not report to you, for reasons that are good. Recruiters name systems because it attracts candidates who already know them. Marketing publishes bios because speakers sell. Filings are compelled. Certificates are logged because that is the price of being trusted. Every reduction you ask for is a cost to someone else's objective, and they can refuse. That is what makes this a decision about scope, evidence and where the money goes rather than a control to deploy. ### First: establish the floor Before asking for anything, be clear about what is not available at any price. - **Certificate transparency entries.** Publication to public append-only logs is a condition of issuance for publicly trusted certificates. Entries are not withdrawable, and the hostnames in already-issued certificates are permanently public. - **Statutory filings.** Officers, signatories and structure are public because the law requires it. - **Everything already published.** Adverts, bios and pages that have been indexed or archived do not become unpublished when you take the page down. So the surface has a hard floor, and any proposal that implies emptying it is not a proposal. ### Second: scope the ask to the increment What is left is a narrow band of details with high lure value and low business value: - Adverts that name the internal expense, ticketing, payroll or approval system by name. The hiring signal is preserved by describing the capability instead. - Adverts and bios that spell out the approval chain - who signs off on what, and at which threshold. Almost none of that helps a candidate decide to apply. - Bios that pin a named individual to a named authority, which is what turns an organisation-level lure into an attributable instruction. This is an ask a recruiting lead can say yes to, because it is specific, it is small, and it does not ask them to advertise less clearly. ### Third: be honest about the return The honest gain is that the operator has to spend more time, and possibly reach a less precise result. That is a real effect and a small one. Research hours are the cheapest input in the whole operation, and the crew has the option of simply spending another morning. Any business case that promises the end of tailored lures against the company is a case that will be checked and found wrong, and it spends credibility you will need for the larger ask. ### Fourth: the decision the leadership question is really about With a floor on the input and a cheap workaround for the adversary, the strategic conclusion is that the durable spend is on the outcome, not the input. The value of a control class here is exactly whether it still works when the request is perfectly credible: | Approach | Holds when the lure is perfect? | | --- | --- | | Reduce published facts | No - buys hours, has a floor | | Rely on the reader judging plausibility | No - priced against the cheap rung | | Authentication that cannot be relayed to an attacker-controlled site | Yes | | Out-of-band confirmation bound to the specific request | Yes | | Payment or supplier-detail change requiring a second path | Yes | That is the argument to make to a budget holder: the input side has a floor and an adversary who can re-earn any ground you take with two more hours of reading; the outcome side does not. ### Fifth: how to run the ask so it survives Take the partial win. Get the wording change into the advert template rather than negotiating advert by advert, so it becomes the default rather than a recurring request. Give the recruiting team a phrasing they can use instead of a prohibition, because a prohibition without a substitute is ignored under deadline. Do not chase historic content that is already archived. And bring the same honesty to the review afterwards: the measure of success is that the template changed, not a claim that anything was prevented. ### The wrong answer The weak version of this answer is an instruction to stop publishing, delivered as if security could issue it, priced as if it were free, and justified by a benefit it cannot deliver. The strong version concedes the floor, scopes the ask to what a hiring team can accept, states the modest return in the adversary's own currency of hours, and then spends the real budget where a credible message cannot be talked out of failing.