Topic starter
12/06/2026 9:35 pm
TL;DR: Help desk attacks increasingly target users who cannot present a registered authenticator, including contractors, partners, and workers replacing lost devices, leaving organisations to fall back on weak manual checks, according to RSA Security. The real issue is not just authentication failure, but a verification gap that undermines auditable, phishing-resistant identity control across extended workforces.
Editorial analysis by NHI Mgmt Group, based on content published by RSA Security: “The Identity Verification Gap Is Closing: What RSA Help Desk Live Verify Does and Why It Matters”.
Key questions
Q: What breaks when a help desk relies on authenticator-only verification?
A: The process breaks for contractors, partners, temporary workers, and anyone who cannot produce a registered authenticator.
Q: When should organisations use stronger identity verification for support desk actions?
A: Organisations should use stronger identity verification whenever a support interaction could change access, expose sensitive data, or enable privileged actions.
Q: How can security teams tell whether help desk controls are actually working?
A: Look for verification quality, escalation rates, recovery approval consistency, and the number of resets that rely on manual overrides.
Practitioner guidance
- Define a fallback verification path for users without authenticators Create a separate, auditable flow for contractors, partners, temporary workers, and lost-device cases so the help desk does not revert to security questions or informal checks.
- Apply bidirectional verification to support interactions Require the help desk agent and the caller to validate each other in the same session before any password reset, recovery, or access change is approved.
- Route high-risk requests through adaptive policy Use location, behaviour, off-hours access, and sensitive workflow triggers to determine when a stronger verification path is needed for the session.
Bottom line: Help desk verification fails when organisations assume every caller can use the same authenticator-based flow, because extended workforces and lost-device scenarios break that assumption.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/06/2026 11:45 pm
Extended workforce identity verification is now a governance boundary, not a help desk detail. When contractors, partners, and temporary workers sit outside the authenticated population, the help desk becomes the place where identity assurance either continues or collapses. That shifts the problem from support operations into identity governance, because every fallback path now carries audit and fraud consequences.
A few things that frame the scale:
- Password-related issues can represent 10–50% of service desk calls, many of which are avoidable.
A question worth separating out:
Q: What is the difference between identity proofing and support authentication at the help desk?
A: Identity proofing establishes who the person is before a sensitive action is taken, while support authentication confirms the person in the current interaction is entitled to proceed. In a help desk setting, both matter, because a caller may be known to the organisation but still not be entitled to reset or recover access without additional verification.
👉 Read our full editorial: Closing the help desk identity verification gap for extended workforces