Category: HR
Secure Workday browsing
Secure Workday browsing means protecting HR and payroll workflows from phishing, session theft, and data leakage, because HR portals contain high-impact personal data.
Quick answer
HR systems hold employee records and pay data. Verify bank and payroll changes outside the requesting message. Open HR portals from a bookmark.
Last updated
2026-01-29
Main browser risks for Workday
- Phishing that imitates HR portals and “benefits update” prompts to steal credentials.
- Session hijacking enabling access to employee records and payroll settings.
- Impersonation attempts to request direct deposit changes or W-2 access.
- Copy/paste leakage of sensitive HR data into untrusted tools or AI prompts.
- Malicious links and attachments related to hiring and onboarding workflows.
Typical sensitive data in Workday
- Employee PII and HR records.
- Payroll and compensation information.
- Benefits enrollment and tax documents.
- Org structure and manager relationships.
- Hiring and candidate data (depending on usage).
- Admin settings and audit logs.
Recommended controls by role
HR
- Use bookmarks for official HR portals; avoid logging in via links from email.
- Open unexpected “benefits” and “payroll update” links in isolation and verify the sender.
- Avoid pasting sensitive employee data into untrusted tools or AI prompts.
IT Admins
- Enforce strong auth and short sessions for HR admins.
- Isolate unknown domains and redirect chains common in HR phishing campaigns.
- Restrict downloads of HR documents from untrusted sources; scan before opening.
Security
- Monitor for unusual login activity and changes to payroll and direct deposit settings.
- Use isolation for investigating suspicious HR-themed phishing landing pages.
- Deploy controls to reduce leakage of HR data into untrusted browser tabs and AI tools.
Where Shield fits with Workday
The controls above are general security practices, not Legba features. Workday is not a Legba integration.
Legba's part is narrow. Shield opens a page in an isolated browser off your device. Use it for a link you do not trust.
Limits
Shield moves page execution off your device. Downloads and copied data still cross that boundary. It cannot stop you sharing passwords with unfamiliar sites. Treat downloads and sign-in prompts with care.
Free for 30 days. No card required.
Workday security questions
Why are HR portals targeted?
Does isolation help with HR phishing?
What’s a quick HR security win?
How do we reduce data leakage risk?
References
- 01
- 02Cloudflare: Browser IsolationCloudflare
- 03
Keep exploring
- How to open a suspicious link safelyVerify the sender first. Isolate only what you must inspect.
- ShieldShield opens a page in an isolated browser off your device.
- All guidesThreats, secure apps, and AI security pages.
- All secure app guidesBrowse apps by category.
- Browser threatsUnderstand threats and mitigation patterns.
- AI security guidesBrowse guides about AI prompt leakage and prompt injection.
