Closing the Identity Gap: Securing the IT Service Desk

Organizations have heavily invested in MFA and identity controls, yet attackers are increasingly targeting the IT service desk to bypass these defenses. By impersonating employees and leveraging social engineering, threat actors convince support staff to reset passwords or register new authentication devices, effectively gaining unauthorized access.

• Attackers use OSINT (social media, leaked data) to impersonate employees convincingly.
• NIST guidelines no longer recognize knowledge-based security questions as safe.
• AI-driven deepfakes make it difficult for staff to distinguish legitimate callers.
• Robust, automated identity verification is essential to secure account recovery.

The Failure of Knowledge-Based Authentication

Many help desks still rely on knowledge-based questions to verify identity, such as asking for a department name or a manager's identity. In 2026, this is fundamentally insecure. With professional profiles like LinkedIn and vast amounts of leaked corporate data, attackers have enough information to pass these checks with ease. Using these questions violates NIST digital identity guidelines, leaving a gaping hole in corporate security.

Groups like Scattered Spider have turned the service desk into a primary target. A 2025 Gartner survey highlighted that 62% of organizations suffered from deepfake-enabled social engineering. As generative AI makes these impersonations more natural, it is becoming unreasonable to expect help desk agents to spot them manually.

Modernizing Verification Workflows

Beyond security, inefficient account recovery is costly, with password resets often averaging $70 per ticket. Organizations should move away from agent-dependent verification toward standardized systems like Specops Secure Service Desk. By incorporating multi-channel verification (SMS, email, or third-party authenticators), companies can ensure identity is confirmed securely before any sensitive account changes occur.

Strategic Importance for Organizations

For modern businesses, the service desk must be considered a critical security node. Relying on an agent's intuition when verifying callers is a liability. By enforcing a consistent, multi-factor verification process for account recovery, companies reduce the surface area for social engineering while simultaneously streamlining IT operations. Robust identity verification is the final piece of the modern security puzzle.