An IT services firm should test AI first on the replies its help desk writes, and keep password resets with a person.
A help desk is the team that answers users' computer problems by phone, chat or ticket. Some large companies hire an outside IT services firm to run their help desk. In this post, help desk staff are always people. The AI tool is software that suggests replies while staff answer users.
One public study measured an AI tool that guided support workers' conversations. The National Bureau of Economic Research issued it as a working paper in April 2023 and revised it in November 2023. The study used data from 5,179 customer support workers who got the tool at different times. The Stanford Digital Economy Lab funded the research.
With the tool, workers resolved 14 percent more issues per hour on average. Newer and less skilled workers improved by 34 percent. The paper's summary reports minimal change for experienced and highly skilled workers. That working paper covered customer support, so an IT services firm should measure the effect on its own help desk tickets.
Password resets carry a different risk. The US Cybersecurity and Infrastructure Security Agency (CISA) warned about a criminal group called Scattered Spider in November 2023. CISA last updated that Scattered Spider advisory on July 29, 2025. The advisory says the group "targets large companies and their contracted information technology (IT) help desks."
The advisory cites public reporting that members of the group posed as employees to IT and help desk staff. They talked staff into resetting the employee's password. They also got staff to move the employee's multi-factor login, the second check after a password, to a device the group controls. The advisory also describes the group calling help desk staff to get passwords reset. After those calls, the group takes over users' single sign-on accounts, where one login opens many systems.
The UK National Cyber Security Centre gave advice after attacks on retailers in May 2025. It told organizations to review how the help desk checks a person's identity before resetting a password. It said this applies especially to employees "with escalated privileges", meaning wide access to systems.
So the firm's rule should keep every password reset and multi-factor change with a person. Staff confirm the caller's identity first, using steps the head of security writes down. Help desk tickets can also hold a client's own data. A client contract may limit where that data goes. So the firm's lawyer should check each contract before that client's tickets go into the AI tool.
The test covers one kind of ticket, such as how-to questions about email. The help desk manager runs it for three weeks on tickets from clients the lawyer has cleared. The manager compares issues resolved per hour with the three weeks before, split between newer and experienced staff. The IT services firm pays for the test from its own budget and bills no client for it.
What to do first:
- Firm's lawyer: by October 30, list which client contracts allow ticket data to go into the AI tool.
- Head of security: by October 30, write the identity check staff run before any password reset or multi-factor change.
- Help desk manager: run the test from November 2 to November 20 and report issues resolved per hour by December 4.
- Chief executive: decide by December 11 whether the tool moves to a second kind of ticket.
An owner of several IT services firms can run the same test in each firm, each read against its own ticket records. The CISA advisory draws on FBI investigations as recently as June 2025.
