Description
Service desk engineers handle password resets and sign in to customer tenants all day, so attackers aim convincing mails and phone calls at them. A successful phish could hand over a session with the rights to reset customer accounts.
Measures
Staff take a phishing exercise every quarter, and the service desk calls the customer back on a known number before any reset. The residual score stays where it is until the exercises show fewer clicks.