There is no such thing as a low-risk industry in 2026. There may have once been a time when companies outside the regulatory spotlight could reasonably assume the risks playing out elsewhere had nothing to do with them. That assumption hasn't aged well.

For a long time, industries got sorted into clean categories. Healthcare and finance landed on the high-risk side because regulators put them there, and the reason was obvious. Lives and money are at stake. Meanwhile, the majority of organizations that don’t fall into those prior “high-risk” categories never built the processes to meaningfully deal with risk. There just wasn't pressure to prepare. Until now.

Here's a test that applies to every business in every industry. Do you have customers? Do you have coworkers? Does anyone in your workforce interact with another human being? I’m guessing that, like every business that has ever operated, the answer to all three is yes. Which means every business has a workforce risk profile.

The Data Doesn’t Know What Industry You’re In

Cross-industry fraud research has been telling a consistent story for years.

The Association of Certified Fraud Examiners publishes a major study every two years based on real fraud investigations. The 2024 edition covered 1,921 cases across 22 industries. Fraud was present in every single industry they examined. Not a sampling of regulated sectors. All of them.

The average organization, regardless of industry, loses an estimated 5% of its annual revenue to occupational fraud. The ACFE describes that figure as conservative, since most cases go unreported and indirect losses like reputation damage, productivity hits, and the talent that walks when trust breaks down don’t show up in a spreadsheet.

Here’s what makes that number harder to dismiss: the industries with the highest median losses per case weren’t the ones anyone would predict. Mining: $550,000 per incident. Wholesale trade: $361,000. Manufacturing: $267,000. These are not industries known for aggressive risk management. They’re industries where the assumption of low risk ran unchallenged, and the fraud ran the clock.

That clock runs for about 12 months on average before someone catches it. In industries that aren’t actively looking, the assumption is that it runs longer.

None of this means the risk gradient doesn’t exist. Healthcare and finance face different severity profiles than a staffing firm or a restaurant group. But a gradient doesn’t have a zero end. It just has a lower end.

AI Found the Unlocked Door

The tools for exploiting industries with weak defenses got dramatically cheaper and dramatically better.

Generative AI made identity fraud scalable. Building a convincing fake identity used to take real skill, real time, and real money. It doesn't anymore. Palo Alto Networks' Unit 42 documented a researcher with no image manipulation experience building a synthetic identity convincing enough for a video interview in 70 minutes on a consumer laptop.

When fraud gets cheaper, the math of who gets targeted changes. Fraudsters used to go where the payoff was biggest, which meant going where the defenses were already strongest. Banks. Hospitals. Government. Now they can afford to go where the payoff is smaller but the work is easier. Unregulated industries are now the most common targets because the defenses are lowest there.

Nobody had put retail on the high-risk list. That's precisely why it got targeted.

“Low Risk” Is Especially Dangerous After the Hire

The risk doesn’t stop once someone gets through the door.

The industries most likely to under-screen before the hire are the same ones least likely to have any mechanism for catching what changes afterward. The assumption carries through the entire lifecycle.

A background check is a photograph. It tells you who someone was on the day you ran it. After that, it has nothing to say about the financial stress that built up, the new criminal activity, the credential that expired, or the license that quietly lapsed. If you’re not watching, you won’t know until something forces the issue.

What makes this especially acute in industries that classify themselves as low risk is a combination they tend to share: high customer contact and minimal oversight. Retail. Hospitality. Home services. Logistics. These workforces are on the roads, in customers’ homes, handling their deliveries, interacting with real people.

The regulatory mandate to screen may be lower. The trust obligation isn’t.

Trust as a Standard, Not a Mandate

Most companies in “low risk” industries don’t have trust infrastructure because nobody required it. But you don’t need a regulator to decide that your customers and coworkers are worth protecting. That decision is available to any business right now, and the companies making it proactively are building something the ones waiting for an incident aren’t.

A real trust program covers both sides of the hire. For companies worried about cost, there’s a practical answer: Sequential Screening runs the least expensive check first and only continues if the candidate clears it.

You have customers. You have coworkers. They interact with other people every day. There is no industry where people are utterly alone and pose zero risk to another human being. If that’s true, and it is, then the question of workforce trust isn’t reserved for healthcare and finance. It’s a question every business answers, one way or another. The only variable is whether you answer it before something goes wrong, or after.