Run a help desk test

Call your own IT help desk as a locked-out employee and see whether the agent verifies the caller before resetting anything.

A help desk test does not call your staff. It calls your help desk numbers, pretending to be one of a few employees who agreed to lend their name. Each call is graded on whether the agent verified the caller and whether a reset was granted.

The console describes it like this: Call your IT help desk as a locked-out employee and see whether the agent verifies the caller before resetting a password or reading out a code.

The employees named are never called. They only lend their name, and only after you record their consent on their contact.

​

Before you start

• An attacker with a voice. The cover story and script are written for you per call. See Create an attacker.
• At least one contact with Can be impersonated in help desk tests ticked on their contact form. See Add the people you will call.
• The help desk numbers, in international format, and their opening hours.
• Agreement from whoever owns the help desk. You will name them at launch.

​

Steps

1. Choose Help desk test

   Open Red Team, Campaigns, New Campaign. Pick Single call, then under Single call type: pick Help desk test. A box titled How a help desk test works appears. The wizard’s second step is now Help desk instead of Who is called.

2. Who calls

   Pick an attacker. Its voice is used on every call. No template is needed: each call gets one of three cover stories, with the employee’s own facts filled in.

   Cover story	Used
   Locked out before a client meeting	First call, then every third
   New phone and lost MFA	Second call, then every third
   Travelling and cannot receive codes	Third call, then every third

3. Help desk

   Fill in four blocks.

   Block	What to enter	Limits and defaults
   Help desk numbers	One number per line, for example [phone]. Add another number adds a line	1 to 5 numbers
   Help desk opening hours	Opens, Closes and Time zone	09:00 to 17:30
   Employees the caller may pretend to be	Tick the consenting contacts listed	Up to 20
   What counts as a failure	Tick the things that count	See below

   The failure ticks are: A reset was granted, or a code or temporary password was read out (on), A reset was promised, even if it had not happened by the end of the call (on), and Personal details about the employee were confirmed (manager, email, employee ID) (off). If you untick all three, a granted reset still counts.

   The box What will happen shows the call count: each number once per employee, inside the opening hours.

4. From where and when

   The same step as any campaign. See Schedule, pacing and retries. The help desk opening hours win over the call window: a campaign launched at night waits for the desk to open.

5. Authorise and launch

   Fill in the authorisation block as usual, then tick The help desk is in scope for this test and write who agreed in the box below it. The helper text reads: A help desk campaign cannot start without this. See Authorise and launch.

   The summary card shows the numbers, hours, employee count and what counts as a failure. Click Launch.

​

What happens next

The caller rings each number, inside the opening hours, and asks for a reset. It accepts a callback, a manager’s approval or a ticket politely and ends the call. It never threatens, never asks for anyone’s own password, and stops at once if the agent says they will report the call or asks whether it is a test.

If coaching is on, help desk staff hear a help desk version of the reveal at the end of a failed call. See Coaching.

The results show one row per agent, with the verification observed on each call: No verification, Callback to a number on file, Manager approval, Ticket or self-service or Identity questions, and whether a reset was granted. The first line you read is in the form 2 of 6 help desk calls ended with a reset granted without verification. See Read your results.

​

Problems

No employees appear to tick

The step reads: No contact has given consent to be impersonated yet. Open a contact, tick “Can be impersonated in help desk tests”, then come back. Contacts without that tick are hidden.

It says every number must be in international format

Each number needs a leading plus and the country code, for example [phone]. Spaces are fine.

Launch stays grey after the authorisation block

Tick The help desk is in scope for this test and write at least a few words in the note. The error reads: Tick the box and name the help desk that is in scope.

The calls did not start

The desk is closed by the hours you set. Check Help desk opening hours and its time zone. Your fair testing rules do not apply to help desk calls, so they are not the cause.