Run a phishing exercise for the whole service desk and review the results

Service desk engineers handle password resets and sign in to customer tenants all day, so attackers aim convincing mails and phone calls at them. A successful phish could hand over a session with the rights to reset customer accounts.

Measures

Staff take a phishing exercise every quarter, and the service desk calls the customer back on a known number before any reset. The residual score stays where it is until the exercises show fewer clicks.