The help desk is the way in

The most reliable way into a well-defended company does not involve a vulnerability. It involves a telephone call to the people whose job is to help employees who cannot get in.

American and allied agencies have documented the pattern in detail. A joint advisory on the activity tracked as Scattered Spider describes actors who target large organizations and their contracted IT help desks, using social engineering to obtain credentials, install remote access tools and get around multi-factor authentication.

The technique is unglamorous. Someone calls the service desk claiming to be an employee who has lost access, satisfies whatever verification the desk performs, and asks for a password reset and for multi-factor authentication to be enrolled on a new device. Both requests are ordinary. Both are granted thousands of times a year.

What makes it work is that the verification step was designed for a different threat. Knowledge-based checks assume the caller's personal details are private. They have not been private for years, and the details a desk asks for are frequently available in breach data or on a professional networking profile.

Agencies updating that advisory noted the actors adapting rather than retreating, including shifting to impersonate employees when approaching third-party IT providers and pairing the calls with SIM swap attacks and repeated authentication prompts sent until someone approves one.

Outsourcing widens the target. A company that contracts its service desk has extended trust to an organization measured on call resolution time, staffed by people who do not know the employees by sight, and who face a caller insisting they are locked out of something urgent.

Every incentive at that moment points the wrong way. The agent is measured on speed, the caller is agitated, and refusing a legitimate employee has an immediate cost while approving an attacker has a cost that lands somewhere else, later, on somebody else's dashboard.

The fixes are procedural rather than technological, which is why they are hard to sell. Verification moved to something the attacker cannot obtain: a callback to the number in the directory rather than the one that called, confirmation through the employee's manager, or in-person identity proofing before a credential is reset.

The stricter version removes the desk's authority entirely. Reset and re-enrollment become self-service through a device the company already trusts, and the agent's role shrinks to helping with everything that is not authentication.

That change is unpopular for a reason that has nothing to do with security. It makes a genuinely locked-out employee wait, and the executive who cannot join a board call from an airport is exactly the person most likely to demand an exception, and most damaging to grant one to.

Organizations that have closed this path describe it as a governance decision rather than a security project. Somebody senior had to decide that the answer is no, in writing, including when the caller is important and the meeting has started.