How to source passive candidates

What is a passive candidate?

A passive candidate is someone who’s currently employed and not actively job hunting, but who would consider a new role if the right one came along. They’re not browsing job boards, and they’re not going to apply to your posting, no matter how well you write it. The only way to reach them is to find them and make the first move.

What is passive candidate sourcing?

Passive candidate sourcing is the practice of proactively identifying and reaching out to people who fit a role but haven’t applied to it. Instead of posting a job and waiting, you search professional platforms, technical communities, and referral networks for people whose visible work matches what the role needs, then approach them directly. It’s the recruiting equivalent of headhunting yourself instead of outsourcing it.

Why is it harder to find passive candidates today?

Most of the people you actually want aren’t looking. Gallup's Q4 2025 workforce data show that only 11% of US employees are actively searching for a new role, with another 40% watching passively but not applying to anything. If your only channel is a job posting, you're reaching barely a tenth of the market and hoping the rest come to you.

That’s the exact spot recruiters land in when they search this: they’ve posted the role, or they know posting has never worked for a specialist or senior position, and they’ve concluded the person they need isn’t going to apply. So they start doing it themselves. An HR person going through LinkedIn profile by profile. A recruiter trying every variation of a job title, hoping something sticks. It’s slow, it’s manual, and without a method, it’s a gamble: reach out to enough people and hope one says yes.

It’s also getting harder for a structural reason, not just a mindset one. The roles that struggle most to fill from postings — specialist engineering, senior leadership, anything with a thin talent pool — are exactly the roles where the best-fit person is already employed and has no reason to be browsing job boards. “Not enough candidates of our profile” is a search-strategy problem, not a market-size one: the candidates exist, they’re just not where a job posting can reach them.

Without a method, sourcing starts to feel like gambling: send enough messages and hope one lands, without any real sense of why the ones that worked, worked. The fix isn’t more effort. It’s a repeatable way to find people, not just one more late night scrolling LinkedIn.

Where do passive candidates spend time online?

Passive candidates don’t hide, but they don’t hang out where job seekers do either. They’re active on the platforms where they do or show their actual work, which means the right place to look changes with the role. Chasing a data scientist through LinkedIn alone, when their real portfolio lives on Kaggle, wastes a search that could have taken minutes.

Pick the platform based on the role, not the other way around. A senior backend engineer is more findable on GitHub than LinkedIn. A product designer is more findable on Dribbble than either.

These platforms also cross-reference each other, which is useful before you’ve built any real verification into your process. A GitHub bio often links to a personal site or a LinkedIn profile; a Dribbble portfolio usually credits the studio or company behind the work. Following that trail from a niche platform back to a full profile gives you more to go on than a LinkedIn search alone would.

How do you use LinkedIn to find passive candidates?

LinkedIn is still the default starting point, but a plain keyword search barely scratches the surface of what’s on the platform. Boolean search and X-ray search get you much further.

Boolean search combines search operators — AND, OR, NOT, and quotation marks — to narrow LinkedIn’s own search to exactly the profile you want. For example:

X-ray search does the same job through Google, searching LinkedIn’s public profile pages directly instead of LinkedIn’s own search box, which is useful when you want results LinkedIn’s interface won’t surface or when you’re working without a Recruiter seat:

Here’s a second example, this time for a marketing role, run as an X-ray search:

Both techniques work on the same principle: be specific about the skill, title, and context you need, and explicitly exclude the noise (recruiters, job posts, and unrelated roles) that floods a generic search.

X-ray search matters even if you do have a Recruiter seat, because it searches Google’s full index of public LinkedIn profiles rather than LinkedIn’s own (more restricted) search index, which occasionally surfaces profiles LinkedIn’s native search misses entirely.

None of this replaces judgment. A search string gets you a shortlist, not a hire. Read the profiles it returns for actual evidence of the skill, not just the presence of the keyword, before you decide who’s worth a message.

How can AI tools help you source passive candidates at scale?

Manual searching doesn’t scale past a handful of roles. AI sourcing tools help by scanning LinkedIn, GitHub, and other public sources for you, matching profiles against the skills and experience a role calls for, and surfacing a ranked list in minutes instead of days.

That’s genuinely useful, and it’s also where most sourcing tools stop, which is the actual problem. A tool that scans faster is still just keyword matching at speed: it finds people whose profile mentions the right skill, not people who can do it. A GitHub profile, a conference talk, and a well-written headline are visibility signals, not verified ones, and treating them as equivalent is how recruiters end up spending outreach time on people who look right on paper and aren’t.

The fix is to treat sourcing as a two-step job: find the signal, then verify it before you invest a message in it. This is verified-signal sourcing, and it changes what “found a candidate” actually means.

This isn’t screening; you’re not evaluating someone who’s applied. You’re deciding, before you reach out, whether the person worth a message is actually worth the message. Skipping that step is how a recruiter ends up with a shortlist of people who look right on paper and turn out not to be, three interviews in.

TestGorilla’s Sourcing tool is built around exactly that sequence, pairing candidate discovery with skills tests from TestGorilla Evaluate so you can confirm a skill match before you spend a single outreach message on it.

What tools help you source passive candidates?

Beyond LinkedIn Recruiter, a handful of tool categories cover most of what you need:

• X-ray and Boolean search tools that extend your search reach across LinkedIn and the open web, useful when you’re working without a Recruiter seat or want results LinkedIn’s own search doesn’t surface.

• Contact-discovery tools that find verified emails and phone numbers once you’ve identified a candidate, so your outreach doesn’t depend on an InMail credit or a cold LinkedIn message.

• AI sourcing platforms that scan public profiles at scale and rank matches against a role’s requirements, cutting down the manual search time.

• Skills-verification tools that confirm a candidate’s ability before outreach — the step that turns a list of visible people into a list of qualified ones.

Which combination makes sense depends on the roles you’re hiring for and how much of the process you want automated versus hands-on; a full breakdown of tools by category deserves its own comparison rather than a shortlist here.

How do employee referrals help you source passive candidates?

Your current team already knows people who fit the roles you’re struggling to fill; they just need a reason and a specific ask. A generic “know anyone good?” gets generic answers. A specific one — “we’re hiring a senior data engineer who’s worked with real-time pipelines, does anyone from your old team come to mind?” — gets you an actual name.

Referred candidates also arrive pre-qualified in a way cold outreach never does: someone on your team is vouching for both the skill and the fit, which tends to shorten the whole process. Make the ask specific, make it easy to respond to, and make referring a regular habit tied to open roles, not a one-off email when hiring gets desperate.

Timing matters too. Asking right when a role opens gets you names from whoever happens to be thinking about it that week. Asking on a regular cadence, tied to your actual hiring plan, gets you names sourced from people who’ve had time to think about who they’d genuinely vouch for. Keep a simple record of who’s been asked about what, so the same person isn’t fielding the same request from three different recruiters on your team.

What mistakes should you avoid when sourcing passive candidates?

• Treating visibility as qualification. An active GitHub profile or a conference credit tells you someone is engaged with their field, not that they can do the specific job you need done. Verify the skill before you spend a message on it, not after they’ve responded.

• Searching by title alone. Titles vary wildly between companies; a “Senior Engineer” at one company can be a “Staff Engineer” at another with the same actual scope. Searching by skills, tools, and context gets you closer to the right person than title matching ever will.

• Skipping the exclusion terms. Without NOT clauses for “recruiter,” “jobs,” “open to work,” and similar, your results fill up with people actively job hunting or other recruiters, not the passive candidates you’re actually trying to reach.

• Sourcing without a specific profile in mind. “Someone good” isn’t a search. Know the skill, the seniority, and the context you’re looking for before you start, or you’ll end up with a long list and no way to prioritize it.

• Sourcing once and stopping. A single search pass finds today’s visible candidates. A pipeline you build and revisit finds the ones who weren’t visible yet last month, and it means the next open role doesn’t start the whole search from zero.

How do you reach out once you've found someone?

Finding the right person is only half the job; what you say to them determines whether they respond at all. Passive candidates didn’t ask to hear from you, so a generic message gets ignored, or worse, gets you flagged as spam. For the specifics on writing outreach that gets a reply, see TestGorilla’s guide to recruitment messages that get responses.

Sourcing well is also easier when it’s not a scramble every time a role opens. Building toward a pipeline before you need one — sometimes called proactive recruitment — means you’re never starting this search from zero. For more on that approach, see TestGorilla’s guide to proactive recruitment.

This piece is one part of a bigger picture. For the full playbook on building a sourcing process end to end, see TestGorilla’s guide to candidate sourcing.

FAQ

What is a passive candidate?

A passive candidate is someone who’s currently employed and not actively looking for a new job, but who would consider a strong opportunity if it came their way. They won’t apply to a job posting, so reaching them requires proactive outreach rather than waiting for an application.

What is passive candidate sourcing?

Passive candidate sourcing is the process of identifying people who match a role’s requirements and reaching out to them directly, rather than relying on job postings to attract applicants. It typically involves searching platforms like LinkedIn, GitHub, and niche professional communities, then approaching a match with a personalized message.

How do you use LinkedIn Recruiter to source passive candidates?

LinkedIn Recruiter lets you combine Boolean operators (AND, OR, NOT) with filters for title, skills, and location to narrow a broad talent pool down to a specific profile. Structuring searches around skills and context, rather than job titles alone, and excluding noise terms like “recruiter” or “jobs” gets more relevant results.

What are the best tools for sourcing passive candidates who aren't on job boards?

The right tools depend on the role, but most sourcing stacks combine LinkedIn Recruiter or X-ray search for finding candidates, a contact-discovery tool for verified emails and phone numbers, and increasingly an AI sourcing platform that scans public profiles at scale. Pairing any of these with a skills-verification step catches candidates that keyword matching alone would miss or misjudge.

What mistakes should you avoid when sourcing passive candidates?

The most common ones are treating a visible profile as proof of skill, searching by job title instead of skills and context, skipping exclusion terms that filter out noise, sourcing without a specific candidate profile in mind, and running a search once instead of building a pipeline you revisit over time.