Notifications
Clear all
Topic starter
25/08/2026 6:10 pm
TL;DR: Help desks remain a high-value attack surface because social engineers can impersonate employees, exploit empathy, and trigger password or MFA resets that open the door to lateral movement and ransomware, according to Trusona. The control problem is not speed versus security, but whether verification, approval, and audit are strong enough to stop a single reset from becoming enterprise access.
NHIMG editorial — based on content published by Trusona: Stop Being the Weakest Link: Help Desk Security Made Simple
By the numbers:
- Nametag reports that 50 to 90 percent of attacks involve social engineering, awareness is essential.
Questions worth separating out
Q: How should security teams protect helpdesk reset workflows from social engineering?
A: Security teams should treat reset workflows as privileged access paths.
Q: Why do helpdesks remain such an effective social engineering target?
A: Helpdesks can change identity state, so a successful call can bypass the normal authentication path entirely.
Q: What breaks when help-desk verification is too uniform?
A: High-risk accounts receive the same treatment as routine users, so attackers can use the path of least resistance to reach the most valuable access.
Practitioner guidance
- Segment recovery flows by account criticality Apply stricter verification, dual approval, or in-person proofing when a reset can affect administrators, executives, or accounts with downstream privileged access.
- Replace knowledge-based checks with stronger proofing Use device-bound or cryptographic verification instead of questions that attackers can answer from public data or breach records.
- Lock down MFA re-enrolment and recovery contact changes Prevent agents from changing phone numbers, email addresses, or factor bindings without an independently verified second step.
What's in the full article
Trusona's full blog covers the operational detail this post intentionally leaves for the source:
- Step-by-step help-desk reset scripting for different account tiers, including high-privilege users.
- Specific verification patterns for identity proofing, including callback controls and device-based checks.
- Practical monitoring ideas for logging reset requests, MFA re-enrolment, and repeated suspicious calls.
- Examples of how social engineers abuse empathy, urgency, and uniform processes in real incidents.
👉 Read Trusona's analysis of help desk security and identity resets →
Help desk identity resets: are your verification controls strong enough?
Explore further
25/08/2026 6:11 pm
Help-desk verification is now an identity governance control, not a service desk courtesy. The process determines who can rebind access, reset factors, and alter recovery paths, which means it directly shapes attack resistance across IAM and PAM. When the support workflow is weak, the organisation has effectively delegated identity authority to the attacker’s persuasion skills. Practitioners should treat reset governance as part of the identity control stack, not an optional operational convenience.
A few things that frame the scale:
- The average cost of a data breach reached USD 4.45 million in 2023, according to Ultimate Guide to NHIs , Why NHI Security Matters Now.
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
A question worth separating out:
Q: Who is accountable when a help-desk reset is abused in an identity attack?
A: Accountability sits with the governance chain that failed to preserve verified workflow evidence, not just the analyst who saw the alert. Security, IAM, and service-desk owners all need a documented control path for ticket linkage, approval proof, and reset validation. If the evidence is missing, the organisation cannot prove the reset was legitimate.
👉 Read our full editorial: Help desk identity resets remain a prime social engineering target
