Identity breaches surge as help desk hijacks raise IAM risk

At a glance

What this is: NHI Mgmt Group's analysis, drawing on RSA Security's report: Identity-related breaches, help desk hijacks, and high breach costs are rising together, with passwordless adoption still lagging.

Why it matters: IAM teams need to treat help desk processes, authentication design, and identity governance as one control surface because attackers are exploiting the seams between them.

By the numbers:

• Identity-related breaches rose to 69% of organisations over the last three years, according to RSA Security.
• 45% of organisations said identity-related breach costs exceeded the typical cost of a breach, according to RSA Security.
• 24% of organisations said identity-related breach costs exceeded $10 million, according to RSA Security.
• 65% of organisations are seriously concerned about service desk bypass attacks, according to RSA Security.

Context

Identity breach frequency and breach cost are now moving together, which turns IAM from a front-door control into a business-loss containment problem. RSA Security’s 2026 RSA ID IQ Report shows that organisations are not only seeing more identity-related incidents, but also absorbing larger financial impact when identity controls fail.

The report also points to a practical weak point that defenders still underestimate: the help desk. Social engineering of support workflows can bypass otherwise mature authentication and access controls, making recovery processes, password resets, and identity verification part of the attack surface rather than administrative plumbing.

Passwordless adoption sits in the same risk picture. If organisations cannot move users away from reusable credentials, they keep exposing the identity chain to phishing, social engineering, and recovery-channel abuse rather than reducing the attack surface.

Key questions

Q: What breaks when help desk resets are treated as low-risk support tasks?

A: The reset path becomes a privileged access channel that attackers can target through social engineering. If proofing is weak, the help desk can hand over control more easily than the primary login system would, which turns recovery into the easiest way around the perimeter.

Q: Why do help desk hijacks create such high breach costs?

A: They create high breach costs because they often deliver trusted access, which lets attackers move beyond the initial account into admin functions, data access, and broader operational disruption. The delay between compromise and containment expands remediation, legal, and business interruption costs. Identity incidents become expensive when they are discovered late and allowed to propagate.

Q: What should organisations prioritise after adopting passwordless login?

A: Organisations should next review recovery workflows, privilege boundaries, and secrets management. Passwordless login reduces one class of credential abuse, but attackers will shift to weaker links if those controls remain unchanged. The best next step is to align authentication changes with secrets rotation and least-privilege access.

Q: What should security leaders review after a service desk bypass attack?

A: Security leaders should review who can verify, reset, re-enrol, and override identities, how those actions are approved, and whether logs prove the request was legitimate. They should also test whether support staff can be manipulated into acting outside policy. The goal is to prove that recovery controls are resistant to social engineering, not just documented.

Technical breakdown

Why help desk workflows become a privilege-escalation path

Help desk abuse works because support teams are often allowed to reset credentials, verify users, and override access under time pressure. Attackers do not need to break the authentication stack if they can convince a trusted intermediary to change it for them. That makes the support process a privileged identity control, not a clerical one. In practice, the weakness is rarely a single bad decision. It is the combination of loose identity proofing, weak call-back discipline, and too much trust in a request that looks routine. Once the reset or override happens, the attacker inherits the session or the enrolment path.

Practical implication: treat account recovery and help desk verification as high-risk identity controls with explicit approval, proofing, and logging requirements.

Why breach cost rises when identity controls fail late

Identity breaches often stay hidden long enough to widen impact before they are detected, contained, and investigated. By the time a support-channel compromise is identified, the attacker may already have moved from initial access to credential reset, privileged access, and data access. That delay drives cost more than the initial compromise itself because it expands response effort, downtime, legal exposure, and user remediation. In other words, identity failure is not just an authentication issue. It is a cost-amplifier that converts a single access event into a broad operational incident.

Practical implication: map identity incidents to containment time, privileged access exposure, and recovery workload, not only to the initial entry vector.

Why passwordless adoption remains a control gap rather than a UX preference

Passwordless is not just a convenience choice. It reduces the number of reusable secrets that attackers can steal, phish, replay, or use in recovery workflows. When organisations stall on adoption, they keep a fallback ecosystem of passwords, resets, and support exceptions alive, which preserves the very paths attackers exploit. The problem is usually not technology availability but inconsistent rollout across systems, recovery journeys, and service desk procedures. If passwordless is only partially deployed, attackers will target the weakest remaining credential path.

Practical implication: govern passwordless as a programme that includes recovery and support-channel redesign, not just primary login replacement.

Threat narrative

Attacker objective: The attacker seeks trusted identity control that lets them bypass authentication and extend access into high-value systems or data.

1. Entry begins when the attacker targets the service desk or help desk workflow rather than the login screen.
2. Credential access follows when the support process is manipulated to reset or bypass authentication and hand over control of the account.
3. Escalation occurs if the compromised account has access to additional systems, administrative functions, or sensitive data.
4. Impact is realised through data theft, broader account compromise, operational disruption, or costly incident response.

Breaches seen in the wild

• Co-op cyber attack 2025: Attackers linked to Scattered Spider tricked their way into a Co-op employee account and stole personal data of all 6.5 million members.
• Caesars Entertainment breach 2023: Social engineering of an IT support vendor let attackers copy Caesars loyalty database; about $15 million was reportedly paid.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Help desk security is now an identity governance control, not a support function. The article shows that attackers are bypassing authentication by manipulating the people and workflows that recover identities. That shifts the control problem from front-door login security to the lifecycle of account recovery, reset approval, and support-side proofing. IAM programmes that keep help desk controls outside formal governance are leaving the highest-trust path under the weakest oversight.

Identity breach cost is a governance failure, not just a breach outcome. The report’s cost figures show that when identity controls fail, the loss profile escalates quickly from access compromise to operational and financial damage. This is exactly where identity governance, privileged access policy, and incident response overlap. The practitioner lesson is that the cost curve is shaped by how much standing trust and recovery latitude the organisation allows before detection.

Passwordless adoption is still constrained by the legacy recovery stack. The article makes clear that organisations can talk about passwordless progress while still preserving passwords, resets, and backup authentication as the real fallback path. That creates a parallel risk lane that attackers can continue to exploit. The field needs to stop treating passwordless as a replacement for the login screen and start treating it as a redesign of the full identity journey.

Service desk bypass attacks expose a named concept: recovery-channel privilege. That privilege exists when support staff can reissue, reset, or override identity controls with too much discretion and too little assurance. It is a structural weakness because the attacker does not need to defeat the primary authenticator if they can persuade the organisation to do it for them. Practitioners should recognise recovery-channel privilege as a first-class identity risk, not an edge case.

The market signal is that identity assurance is becoming inseparable from operational resilience. The report connects breach frequency, breach cost, and help desk abuse in a way that pushes identity security beyond authentication tooling. Organisations now need governance that covers support workflows, verification quality, and recovery exceptions as part of the same control plane. The discipline is moving toward lifecycle-wide trust management, not point-in-time sign-in checks.

From our research library:

• 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
• Read next: Account Recovery and Help Desk Security Guide

What this signals

Recovery-channel privilege: the article’s clearest signal is that identity risk now includes the people and workflows used to recover accounts, not just the authenticators used to sign in. That means the next control boundary for IAM is the help desk, where reset authority and verification quality determine whether an attacker can convert social engineering into access.

The reported breach frequency and cost pressure show that identity programmes need to measure more than login success. Organisations should watch for reset volume, override frequency, and how often manual support steps are required, because those are the places where assurance degrades fastest.

For practitioners

• Tighten account recovery governance Require step-up proofing, dual approval for overrides, and full audit trails for any reset, unlock, or identity change that support staff perform.
• Map support workflows to privileged access Classify help desk systems and personnel actions as privileged access paths, then review who can reset, override, or re-enrol identities.
• Reduce password fallback exposure Accelerate passwordless rollout where feasible, but also remove weak fallback routes that still allow passwords, recovery codes, or manual bypasses to reintroduce risk.
• Measure identity incidents by containment cost Track time-to-contain, reset volume, privileged access exposure, and downstream operational loss for every identity-related incident to expose where governance is failing.
• Test help desk social engineering resistance Run targeted simulations against service desk personnel and workflow approvals to measure whether identity verification breaks under realistic pressure.

Key takeaways

• Identity-related breaches are rising fast enough that IAM teams need to treat support workflows as part of the identity attack surface, not a back-office exception.
• The breach-cost data shows that identity incidents can quickly become expensive when access control failure leads to broader operational and recovery impact.
• Passwordless progress matters, but it does not reduce risk unless organisations also harden the recovery and help desk paths attackers use to bypass authentication.

Key terms

• Recovery-Channel Privilege: The level of trust and authority granted to identity recovery processes, support staff, and exception handling workflows. In practice, these channels can recreate or override access, so they must be governed like privileged access rather than treated as ordinary administration.
• Help Desk Hijack: A help desk hijack is when an attacker uses social engineering to get support staff to reset, re-enrol, or bypass identity controls. The tactic turns operational trust into access, making the support workflow part of the attack surface rather than a neutral service channel.
• Passwordless Fallback Path: A passwordless fallback path is the alternate process used when a user cannot use their primary passwordless factor, such as device replacement, recovery, or re-enrolment. If these paths are weak, passwordless shifts risk into support and recovery rather than removing it.
• Identity breach containment: The set of actions and controls that limit how far an identity compromise can spread before it is discovered and stopped. It depends on access boundaries, monitoring, privileged entitlement review, and recovery controls that prevent a single compromise from becoming a broader operational incident.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.