Topic starter
06/06/2026 2:30 am
TL;DR: Strong MFA, SSO and passwordless controls can still be bypassed when attackers socially engineer service desk password resets, because recovery often depends on weaker, inconsistent verification and analyst judgment, according to Imprivata. The control gap is that identity assurance is enforced at login but diluted in recovery, where the bypass path is operational rather than technical.
Editorial analysis by NHI Mgmt Group, based on content published by Imprivata: “Your service desk might be undermining your security controls”.
By the numbers:
- Social engineering remains a primary breach vector, accounting for 60% of data breach incidents.
Key questions
Q: What breaks when password reset still depends on help desk workflows?
A: Help desk-dependent reset workflows break because they slow down containment, create inconsistent handling across systems, and leave gaps in verification.
Q: Why do help-desk resets create so much identity noise?
A: Help-desk resets are noisy because they can look identical to account takeover when a detection system cannot see the ticket record, verification method, and approval trail.
Q: What are the signs that recovery workflows are failing?
A: Look for frequent manual resets, heavy dependence on knowledge-based questions, inconsistent analyst decisions and repeated requests that bypass normal authentication patterns.
Practitioner guidance
- Harden password recovery as an identity control Map every reset and account recovery path to the assurance level expected for primary authentication, then remove any step that relies on weak static data or informal analyst judgment.
- Replace subjective reset approvals with policy-driven flows Move high-risk password resets into self-service or automated workflows that enforce consistent verification and reduce discretionary decisions under time pressure.
- Standardise verification across all access pathways Define one minimum assurance threshold for sign-in, reset and account unlock flows so the identity posture does not weaken when the user leaves the login screen.
Bottom line: The article shows that service desk resets can undermine strong MFA and SSO by giving attackers a lower-assurance route to legitimate access.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/06/2026 4:13 am
Recovery is the identity control most organisations under-govern. The article shows that password reset and account recovery are often treated as operations, even though they determine whether identity assurance holds outside the primary login path. That is a governance failure, not just a process problem. The practical conclusion is that recovery must be governed with the same rigour as authentication.
A few things that frame the scale:
- According to Forrester Research, a single password reset can cost around $70.
A question worth separating out:
Q: What should organisations do when service desk resets are abused?
A: They should tighten the recovery boundary by moving high-risk resets into stronger self-service flows, removing weak identity checks and aligning the reset process with the same assurance standard used for primary authentication. The goal is to stop treating support as a separate trust domain and bring it under identity governance.
👉 Read our full editorial: Service desk resets expose the weak link in identity security