Skip to main content
Diopter
Log inBook a demo
Red team simulationHelp desk vishing

We call your help desk as your employee.

We ask for a password reset, then a new device on their MFA. You find out where they stopped us, or that they didn't.

Phone, Teams, RingCentral, and other voice channels.
Attack 01
We call
Your help desk
As
One of your employees
To get
An MFA reset

Why this one

The service desk is built to help people who are locked out, in a hurry and annoyed. An agent that sounds like exactly that person is hard to turn away, and it will call back twice more if the first attempt fails. Read what vishing looks like on a real desk.
What we score

Your desk resets credentials all day, and it should.

The question is what it checks first. That is four separate controls, not one judgment call.
One call, four gates
  1. 01

    Identity

    Gives an employee name, their manager, and a plausible reason to hurry.

    HeldAsks for something only the real person could know

    Gave wayAccepts a name and a manager

  2. 02

    Channel

    Offers a callback number, which is the attacker's own.

    HeldCalls back on the number already on file

    Gave wayCalls back on the number it was handed

  3. 03

    MFA

    Asks to enroll a new device once the password is reset.

    HeldRequires a second control before enrollment

    Gave wayEnrolls the device on the same call

  4. 04

    Alerting

    Keeps the call short and ordinary so nothing looks worth escalating.

    HeldSomething reaches a queue, a channel or a person

    Gave wayNo record beyond the ticket

Your readout says which side each gate landed on, by team. The gates that opened are the policy lines worth changing first.
How it runs

Four stages, about a week.

  1. 01 · Map

    Who to be

    Who works there, who runs IT, how the desk is reached.

  2. 02 · Call

    The opening

    As a real employee, locked out, with a reason to hurry.

  3. 03 · Push

    The ask

    Password first, then a new device on their MFA.

  4. 04 · Report

    The record

    What held, what didn't, by team.

You scope it. You sign it. You can stop it.

Run this one against your own team.

The first exercise is free, and you keep the readout.help desk defense on live callspricing

Run this chain free
Help desk defenseAll three attacks