Why Your Help Desk is Your First Line of Cyber Defence

Why Helpdesks Are So Vulnerable

Most helpdesks aren’t built for deception. They’re built for speed, consistency, and service – solving problems as quickly and smoothly as possible. That mindset is important, but it can also create risk when attackers know how to exploit it.

Several factors make helpdesks particularly vulnerable:

• Time pressure: Support teams often work to strict KPIs, aiming to resolve tickets quickly and keep operations running. In a high-volume environment, stopping to challenge a request or escalate a verification can feel like a delay. But in reality, it’s a safeguard.

• Limited context Many helpdesks are staffed by junior technicians or outsourced providers. They may not know employees personally, which makes impersonation harder to spot. A convincing tone and a plausible story are often all it takes. In the M&S breach, access was reportedly gained through a third-party support provider. Without established relationships or internal context, the support team had few cues to fall back on.

• Process gaps: Some organisations rely on single-factor ID checks to reset access or credentials – like an email address or job title. Others don’t have clear escalation routes when something doesn’t feel right. In both cases, helpdesk staff are left to make judgement calls with limited guidance.

• Lack of targeted training: Cyber awareness training, if it’s offered at all, often focuses on general users rather than IT support teams. Many helpdesk staff haven’t been trained to recognise impersonation, vishing, or MFA abuse. In some cases, they haven’t even seen examples of these tactics in context.

How Attackers Use Helpdesks to Get In

Attackers don’t need to break your systems if they can persuade someone to open the door for them.

There’s no shortage of methods. Some of the most common include:

• Impersonation and pretexting: Attackers scrape job titles and contact details from LinkedIn, then call or email the helpdesk claiming to be a locked-out employee or a new starter. The tone is usually urgent. “I’m meant to be on a call right now. Can you just reset it for me?”

• Vishing (voice phishing): This technique was used in the 2022 breach at Okta. Attackers called a third-party helpdesk contractor, posing as an internal user, and persuaded them to share sensitive access information. Once inside, they moved laterally through Okta’s systems, affecting hundreds of clients.

• MFA fatigue: Used in the Uber breach, this method involves bombarding a user with repeated multi-factor authentication prompts until they eventually click “approve” just to stop the notifications. In Uber’s case, the attacker followed up the MFA prompts with a message pretending to be IT support, encouraging the employee to approve the request to “resolve an issue.”

• Remote access abuse: Some attackers convince helpdesk staff to install “support tools” or grant remote access to resolve a fabricated issue. These tools can act as malware droppers or backdoor entry points.

In each of these cases, the helpdesk becomes the point of failure – not because of malicious intent, but because the attacker knew exactly how to exploit a gap in verification or training.

How to Strengthen Your Helpdesk Against Cyber Threats

If attackers are targeting helpdesks as a way in, then support teams need the tools, time, and training to stop them.

Here’s what that can look like in practice:

• Multi-step identity checks: Before resetting passwords or granting access, support teams should verify identity using more than one method – ideally combining something the person knows (e.g. internal ID) with something they have (e.g. verified contact method) or something that can be cross-checked with another team. Even small changes – like requiring a second colleague to approve a reset – can make social engineering attempts much harder to pull off.

• Safe escalation routes: If something doesn’t feel right, helpdesk staff should be able to pause and escalate without worrying about missing KPIs or slowing things down. Processes should make it easy to raise a flag, and make clear that raising one is the right thing to do.

• Role-specific training: Training should reflect the real scenarios helpdesk teams face – including impersonation, voice phishing, and MFA abuse. One-size-fits-all awareness sessions don’t prepare support staff for the tactics being used against them. Scenario-based exercises, refreshed regularly, help build familiarity and reduce hesitation in the moment.

• Security built into support workflows: Verification steps shouldn’t sit outside the normal support process. They should be part of how tickets are logged, resolved, and closed.

None of this requires a major overhaul. It starts by recognising that helpdesks aren’t just there to solve problems. They’re often the first opportunity to stop an attack from progressing.

With the right structure and training, they can do exactly that.

How Apprenticeships Build Secure Helpdesk and IT Teams

For many organisations, especially those facing skills gaps or resource pressure, the challenge isn’t just having the right procedures. It’s having people who know how to use them well.

That’s where structured development comes in. For helpdesk teams, apprenticeships offer a practical way to build capability from the ground up, while embedding security thinking into everyday work.

Level 3 IT Support Technician:

Building Secure Habits at the Frontline

Baltic’s Level 3 IT Support Technician apprenticeship is designed to embed secure working into the everyday tasks of an IT support role. Cybersecurity isn’t delivered in isolation; instead, it’s built into every module, so secure behaviours become standard practice.

Apprentices learn how to:

• Recognise early signs of malware, unauthorised access, or suspicious system behaviour
• Apply secure system configurations and maintain asset registers
• Keep systems up to date and plan for disaster recovery
• Support cloud-based services and manage secure remote access

These are the day-to-day tasks that help prevent security breaches before they escalate. They’re especially valuable in high-volume environments where good habits and consistency matter.

Level 4 Network Engineer:

Expanding Secure Practice Across the Infrastructure

Once secure working habits are established at the frontline, the next step is extending that mindset into infrastructure. Baltic’s Level 4 Network Engineer apprenticeship supports that shift by helping organisations build and maintain secure-by-design systems.

Apprentices learn how to:

• Design segmented, policy-aligned networks
• Integrate cloud and on-prem environments with security in mind
• Apply layered defence measures including VPNs, DNS protection, and access controls
• Plan for continuity, resilience, and change management

These skills help reduce reliance on reactive fixes and support more proactive risk management across the IT estate.