Not that long ago, the internet was seen as a dangerous place where sharing personal information was reckless. The advice was simple: keep your details private and never tell strangers online too much about yourself. Fast forward to today and the tables have turned completely. Platforms like LinkedIn have created a culture where sharing information about yourself is not only normal but expected. In fact, it can feel unusual if someone has a sparse profile. We happily post our job title, career history, skills, achievements and even personal reflections. The strange thing is that most people no longer see this information as sensitive, yet in the wrong hands it is a treasure chest.

Take LinkedIn as an example. The entire purpose of the platform is to connect, to be found, to be visible. That is fine when the people looking are recruiters or potential business partners. But attackers are watching too. A well built LinkedIn profile can give them far more than you might imagine. The question we need to ask is what makes one profile more risky than another and how exactly could attackers use that information.

One obvious case is new employees. Attackers know that when someone starts a new job, especially in a larger organisation, they are less likely to know names, structures and processes. That creates an opportunity. A phishing email sent to a new hire asking for an urgent action might slip through more easily than it would with a seasoned employee who knows the ropes. A LinkedIn update proudly announcing “Excited to start my new role at Company X” is not just a career milestone. It can be a beacon to those looking for an easy target.

Then there is the technical information people include without thinking. Profiles that list specific software or hardware in use at a company can be an attacker’s dream. If you publicly state that you manage “Office 365 security” or “VMware clusters” it immediately signals potential areas to probe. To you it looks like professional credibility. To someone else it looks like a roadmap for attack.

Department matters too. Finance staff for example are always considered high value targets because of the potential for invoice fraud, payment redirection or insider information. A LinkedIn profile that clearly highlights a finance role puts a bullseye on that person’s back. Similarly, anyone in human resources or IT can become a valuable stepping stone for social engineering attempts.

Beyond the basics of job titles and descriptions lies the real goldmine: background information. People often write about past achievements, volunteer work, hobbies and personal reflections. All of that can be stitched together into convincing pretexts for manipulation. An attacker who knows you previously worked at a certain company can pretend to be an old colleague. Someone who spots your shared interest in cycling might use that to strike up a casual conversation that leads to trust. Social engineering thrives on these connections, however flimsy.

And that is just the profile itself. The posts people make are often even more revealing. A casual office selfie might capture an ID badge in the corner of the frame, giving an attacker everything they need to forge a copy. A holiday post proudly declaring you are away for two weeks can invite someone to impersonate you while you are out of contact. Photos of the office interior, shared to show off a new workspace, can provide useful details for planning a physical intrusion. None of this is obvious when you are in the moment of posting, but all of it can be weaponised.

What makes this challenging is that the culture of LinkedIn is built on sharing. If you post nothing, your profile looks incomplete. If you post too much, you might be oversharing. The key lies in awareness. Recognising that information which feels harmless can still provide value to someone with malicious intent is the first step. We should not shut ourselves off completely, but we should be more conscious about what we put out there.