The recruitment of an insider source within a target corporate entity in GLMZ is rarely a discrete event. Professional intelligence operations treat recruitment as a lifecycle measured in months or years, beginning with target identification and progressing through cultivation, testing, activation, and eventual retirement or termination. The compressed geography of the megacity—where corporate campuses, residential blocks, and commercial zones interpenetrate at every scale—provides unusual density of incidental contact opportunities that practitioners exploit systematically. A target who commutes through the Midlake Transit Hub, patronizes a specific food vendor in the Garfield Commercial Arcade, and attends a weekly social gathering in the Pilsen Remnant can be cultivated through apparently coincidental contact across multiple contexts before any operational intent is revealed.

Target selection criteria in the current environment weight neural interface access heavily. An insider with a standard corporate implant and mid-level data access privileges is valued less than one whose role requires elevated interface permissions—manufacturing supervisors, logistics coordinators, and medical staff with patient data access all carry implants with broader read permissions than their apparent seniority would suggest. Secondary criteria include financial stress indicators (available through credit flow analysis on semi-public financial mesh networks), social isolation patterns (inferred from social platform absence or reduced activity), and recent disciplinary or professional grievances against the target employer, which create ideological or emotional vulnerability that experienced recruiters call 'leverage surface.'

The testing phase of recruitment is where most failures occur and where experienced handlers distinguish themselves. A target must be induced to take a small, low-risk action that constitutes technical disloyalty—sharing an innocuous internal document, providing a minor scheduling detail, making an introduction that shouldn't be made—before any significant ask is made. This 'foot in the door' action serves two functions: it provides the handler with initial intelligence value, and it creates a psychological commitment in the source that makes subsequent cooperation feel like continuation rather than initiation. The action is also, in most cases, sufficient to expose the source to corporate disciplinary consequences if revealed, creating an implicit coercive dynamic that experienced handlers leverage carefully to avoid triggering resistance.

Source retirement is the most understudied and operationally neglected phase of the lifecycle, and the most dangerous. Corporate counterintelligence operations in GLMZ have become sophisticated at identifying sources through behavioral pattern analysis of data access logs and communication metadata, meaning the operational window for any given insider is finite and shortening. Sources who are burned without adequate exfiltration planning face consequences that range from termination of employment to grey floor detention. The most professional intelligence operations maintain retirement protocols as formal standing plans, including pre-arranged exfiltration routes, fabricated identity packages, and resettlement resources. Less professional operations—including the internal intelligence arms of smaller corporate entities—have a documented history of abandoning sources when operational exposure risk rises, a practice that has made recruitment significantly harder across the industry as reputational knowledge of source abandonment has spread through informal networks.