Help desk and user support

A help desk that helps your staff and stops people pretending to be them.

Most of a small office’s IT time goes to ordinary requests: resets, new hires, departures, a laptop that will not update. Those same requests are now a favorite attack path, so every one of them needs a procedure, not just a friendly voice.

Section 1

Threat Briefing

CISA and the FBI report that the Scattered Spider group poses as IT and help desk staff to trick employees, and, in the July 2025 update, poses as employees to convince help desks to reset passwords or move MFA to a device the attacker controls. The group also uses SIM swapping, MFA fatigue and legitimate remote management tools. (CISA AA23-320A)

Capacity is the other problem. In the Sophos 2025 survey, 40.2% of ransomware victims cited a lack of expertise and 39.4% a lack of people or capacity as factors in the attack. (Sophos)

Unpatched software is where attacks start most often: exploited vulnerabilities were the top root cause at 32%. (Sophos) CISA keeps a public catalog of vulnerabilities known to be exploited in the wild. (CISA KEV)

Section 2

Risk and Compliance Matrix

Exposure	Framework or rule it maps to	What it costs you
Password or MFA reset granted to a caller who only sounds right	NIST CSF 2.0 PR.AA (identity and authentication); CISA AA23-320A mitigations	Full account takeover, mailbox access, fraudulent payments
Former staff accounts still active	HIPAA 45 CFR 164.308(a)(3) workforce security; FTC Safeguards 16 CFR 314.4(c)(1) access controls	Data taken by people who no longer work for you; findings in an audit
Unapproved remote access tools on PCs	CISA AA23-320A (abuse of legitimate RMM tools); NIST CSF 2.0 DE.CM monitoring	Hidden persistent access that survives a password change
Patches applied when someone remembers	CISA KEV catalog; NIST CSF 2.0 ID.RA and PR.PS	The most common ransomware entry point stays open

Section 3

Architecture and Remediation Directives

Verify identity before any password or MFA change: call back on the number already on file, or require approval from a named manager. Never move MFA on an inbound call alone.
Use a written onboarding and offboarding checklist tied to HR dates, so accounts, licenses and devices are created and removed the same day.
Allow one remote support tool (Ares RMM) and alert on any other remote access software that appears on a device.
Patch on a schedule with deadlines measured in days for anything listed in the CISA KEV catalog, and report patch status monthly.
Log every request as a ticket so you can see who asked, who approved and what changed.

Section 4

Vendor-Neutral Verification Checklist

Three tests that work against any provider, including us. Run them before you sign anything.

Ask your current provider for its written procedure for password and MFA resets. Then schedule a test call where someone asks for a reset for a coworker, and see whether the procedure is followed.
Export the list of active user accounts from Microsoft 365 or Google Workspace and compare it with your current staff list. Every extra account needs an owner or a removal date.
Ask for an installed software report across your computers and look for remote access tools you did not approve.

FAQ

Frequently asked questions

How do staff reach the help desk?

By the client portal, email or phone. Every request becomes a ticket so nothing depends on someone remembering a hallway conversation.

What are your support hours?

Standard support runs during business hours, and the coverage window for your time zone is written into your plan. Every request gets a reply within one business day, and urgent issues are worked first. See the plans page for what each plan covers.

Why do you verify callers before a password reset?

Help desk impersonation is a common way attackers take over accounts. A quick callback or verification step costs a minute and blocks that route.

Do you support Macs and phones?

Yes. We support Windows and macOS computers and the business apps on staff phones, including mobile device management where your plan includes it.

Can you handle new hires and departures?

Yes. Send a request with the start or end date and we prepare accounts, devices and access, and remove them on the last day.

How we package it