The Help Desk Is Your Biggest Identity Security Blind Spot
Finn Jensen | Founder, FastPasscorp
Help desk impersonation is one of the most reliably effective credential attack vectors in use today. An attacker calls your IT service desk, claims to be a legitimate employee, and uses social engineering to obtain a password reset. No malware. No phishing link. No technical exploit. Just a phone call — and a verification process that wasn't built to resist a prepared impersonator.
The result is a fully authorised credential, issued by your own help desk, in the attacker's hands. From that point, the breach operates like a malicious insider: legitimate access, no technical anomalies, and nothing for your detection tools to flag.
This is the help desk verification gap — and closing it requires more than the controls most organisations currently have in place.
The numbers behind the risk
The IBM/Ponemon Cost of a Data Breach Report 2025, drawing on data from 3,470 organisations across 16 industries and 16 countries, makes the scale of credential-based attacks impossible to ignore. Compromised credentials ranked as the second most common initial attack vector globally, with an average breach cost of $4.67 million and a median dwell time of 241 days before detection.
The report's most quoted observation is also its most important: attackers aren't hacking in. They're logging in.
Every investment in endpoint protection, network segmentation, and phishing-resistant MFA is rendered irrelevant the moment an attacker obtains a fresh, fully authorised credential — one issued by a help desk agent who had no reliable way to confirm who they were talking to.
There's a straightforward question worth putting to your IT service desk: if someone calls right now claiming to be a senior executive, locked out of their account before an urgent meeting, and recites their employee ID, their manager's name, and their date of birth — what exactly prevents your agent from resetting their password?
If the answer involves agent discretion, a best-effort call to a manager, or anything resembling a pause and a shrug, your organisation has this gap. Not a theoretical one — a live, exploitable one, operating every day your help desk is open.
How the attack works
Help desk impersonation doesn't require technical sophistication. It requires patience, preparation, and an understanding of how service desk agents behave under pressure.
The attacker identifies a target — typically someone with meaningful system access. A LinkedIn profile provides their name, title, reporting line, and enough context to sound convincing. Then comes the call.
The agent doesn't need to be fooled into giving out a password. They just need to be persuaded to reset one. A credible impersonator combines fabricated urgency ("I have a board presentation in under an hour"), genuine-sounding familiarity with the organisation, and social pressure that exploits an agent's natural instinct to help. If the verification process relies on an employee ID or a date of birth — both of which are commonly findable — the attacker passes.
The reset is issued. The attacker now has legitimate credentials, and the clock starts. Within minutes, they establish persistence: additional accounts, remote access tools, an enrolled MFA device under their control. By the time the real employee notices and reports the problem, the attacker has already moved beyond the initial credential and embedded themselves in the environment.
This is why the IBM/Ponemon report notes that malicious insider attacks carry the highest average breach cost of any category — $4.92 million. A successful impersonation creates exactly that scenario. The attacker operates with genuine credentials, insider-level trust, and no technical anomalies to trigger detection.
Why standard guidance doesn't close the gap
The 2025 report recommends three controls for credential security. Each is directionally sound. Each hits a wall in real production environments.
Remove agent discretion through automated workflows.
Correct in principle, but automation only removes discretion if the system — not the agent — makes the verification determination. If an agent still decides whether a caller has "passed," and then triggers a workflow, the automation wraps around a human judgement call rather than replacing it.
Deploy multi-factor authentication.
MFA is the most important identity control available. It also fails routinely for reasons that have nothing to do with attackers: lost devices, dead batteries, travel without signal, new hardware not yet enrolled. Each failure produces a help desk call. In that moment, the fall-back verification process isn't supplementing MFA — it is the security boundary. And most organisations have left that boundary weak.
Require manager authorisation for account resets.
A meaningful additional check. Also one that routinely breaks down in practice, because managers are unreachable — in meetings, on leave, in different time zones. Blocking an employee's access for hours waiting on an approval is operationally untenable. Help desk agents find ways around it. Within months, the control has eroded precisely where it matters most.
The gap these recommendations leave — the space between "MFA works" and "MFA isn't available right now" — is where the most expensive credential breaches originate.
What closing the gap actually requires
An effective solution to help desk impersonation has to satisfy three criteria simultaneously: strong enough to resist a skilled social engineer, flexible enough to function when MFA and manager approval are both unavailable, and fast enough not to create a new operational bottleneck.
Three principles make this work in practice.
The system decides; the agent facilitates.
The agent's role is to initiate a verification workflow. The determination of whether identity has been confirmed — and the execution of the credential reset — belongs to the system. No override, no discretion, no pressure point for an attacker to exploit.
Layered fall-backs at equivalent security standards.
MFA as the primary path. Manager approval as a secondary option. When neither is available, dynamic contextual verification as a third route — but not the kind that relies on findable data. Questions drawn live from HR systems, Active Directory, ERP platforms, access logs, and ticketing history. What was the last application you accessed this morning? What was the value of the purchase order you approved last week? Who is your most recently added direct report? A legitimate employee answers without hesitation. An attacker who researched a LinkedIn profile cannot. Critically, the questions are generated fresh for each session — there is no fixed set to prepare for.
A complete audit record on every interaction.
Every verification attempt, successful or not, is logged with timestamp, agent identity, questions used, and outcome. Repeated failures against the same account trigger automated alerts. This creates early warning when an attacker is probing the system, and provides compliance teams with a defensible record.
The honest test
Walk over to your IT service desk this week. Find your most experienced agent. Ask them the question at the top of this post.
If the answer is "I'd use my judgement" or "I'd try to reach their manager" — your organisation has the verification gap. Not as a hypothetical future risk. As a present, operational exposure.
The 2025 IBM/Ponemon report is clear about what that gap costs when it's exploited: $4.67 million on average, with the breach going undetected for the better part of a year. The report defines the problem precisely. Closing it requires going further than its recommendations reach.
About FastPass IVM
FastPass IVM is FastPassCorp's workforce identity verification platform, built specifically to close the help desk verification gap. It removes agent discretion from the password reset process, delivers layered fall-back verification that works without MFA or manager availability, and integrates with Microsoft Entra ID, ServiceNow, and the most widely deployed ITSM platforms.
If this attack vector is on your organisation's radar, we're happy to walk you through how a verification call runs when the agent has no role in the outcome. Get in touch to arrange a 30-minute walkthrough.
Source: IBM / Ponemon Institute, Cost of a Data Breach Report 2025 — 3,470 organisations, 16 countries, 17 industries.
