Skip to main content
A help desk test does not call your staff. It calls your help desk numbers, pretending to be one of a few employees who agreed to lend their name. Each call is graded on whether the agent verified the caller and whether a reset was granted. The console describes it like this: Call your IT help desk as a locked-out employee and see whether the agent verifies the caller before resetting a password or reading out a code.
The employees named are never called. They only lend their name, and only after you record their consent on their contact.

​
Before you start

  • An attacker with a voice. The cover story and script are written for you per call. See Create an attacker.
  • At least one contact with Can be impersonated in help desk tests ticked on their contact form. See Add the people you will call.
  • The help desk numbers, in international format, and their opening hours.
  • Agreement from whoever owns the help desk. You will name them at launch.

​
Steps

1

Choose Help desk test

Open Red Team, Campaigns, New Campaign. Pick Single call, then under Single call type: pick Help desk test. A box titled How a help desk test works appears. The wizard’s second step is now Help desk instead of Who is called.
2

Who calls

Pick an attacker. Its voice is used on every call. No template is needed: each call gets one of three cover stories, with the employee’s own facts filled in.
3

Help desk

Fill in four blocks.The failure ticks are: A reset was granted, or a code or temporary password was read out (on), A reset was promised, even if it had not happened by the end of the call (on), and Personal details about the employee were confirmed (manager, email, employee ID) (off). If you untick all three, a granted reset still counts.The box What will happen shows the call count: each number once per employee, inside the opening hours.
4

From where and when

The same step as any campaign. See Schedule, pacing and retries. The help desk opening hours win over the call window: a campaign launched at night waits for the desk to open.
5

Authorise and launch

Fill in the authorisation block as usual, then tick The help desk is in scope for this test and write who agreed in the box below it. The helper text reads: A help desk campaign cannot start without this. See Authorise and launch.The summary card shows the numbers, hours, employee count and what counts as a failure. Click Launch.

​
What happens next

The caller rings each number, inside the opening hours, and asks for a reset. It accepts a callback, a manager’s approval or a ticket politely and ends the call. It never threatens, never asks for anyone’s own password, and stops at once if the agent says they will report the call or asks whether it is a test. If coaching is on, help desk staff hear a help desk version of the reveal at the end of a failed call. See Coaching. The results show one row per agent, with the verification observed on each call: No verification, Callback to a number on file, Manager approval, Ticket or self-service or Identity questions, and whether a reset was granted. The first line you read is in the form 2 of 6 help desk calls ended with a reset granted without verification. See Read your results.

​
Problems

The step reads: No contact has given consent to be impersonated yet. Open a contact, tick “Can be impersonated in help desk tests”, then come back. Contacts without that tick are hidden.
Each number needs a leading plus and the country code, for example +44 20 7946 0000. Spaces are fine.
Tick The help desk is in scope for this test and write at least a few words in the note. The error reads: Tick the box and name the help desk that is in scope.
The desk is closed by the hours you set. Check Help desk opening hours and its time zone. Your fair testing rules do not apply to help desk calls, so they are not the cause.