Last reviewed 3 November 2026 against the sources linked in this post.
At 4:50 pm a caller says they are the finance director, locked out before a board call, and asks for a password reset and a new MFA code. The voice is confident, and the agent wants to be helpful. That is the gap IT help desk training has to close. Verizon's 2026 Data Breach Investigations Report found the human element in 62% of breaches, and it says attackers have been impersonating help desk agents and users who need a password reset, with moderate success.
Certificates teach ticketing and troubleshooting. This list covers the other half: verifying who is on the line before you touch an account. You get 8 ready-made courses in 3 groups, what each fixes and how to roll them out. Each group ends with an Our pick. The one legal point describes a US federal rule, so use this as a syllabus, not a ruling.
All 8 courses at a glance
| Course | What it covers | Length | Law behind it? |
|---|---|---|---|
| Passwords, passkeys and multi-factor authentication for staff | Safe sign-ins, MFA, passkeys and recovery shortcuts | 30 min | No |
| Phishing & social engineering | Red flags, verification and reporting | 30 min | No |
| Social engineering, fraud and deepfakes | Phone, payment and impersonation scams | 35 min | No |
| Security awareness essentials | Core habits for anyone with admin access | 35 min | Yes (US federal rule, covered financial institutions) |
| Malware and ransomware | How infections spread and the first minutes | 30 min | No |
| Cyber incident response and breach reporting | First-response steps and reporting routes | 35 min | No |
| ITIL 4 and IT service management | Incident, problem and change on the service desk | 45 min | No |
| AI security for everyone | Shadow AI, prompt injection and manipulated outputs | 30 min | No |
Only the security awareness course sits on a US federal rule, and only for some organisations: the FTC Safeguards Rule says covered financial institutions must provide security awareness training to their personnel. It does not set a course for everyone else.
Account security and social engineering
Passwords, passkeys and multi-factor authentication for staff
This 30-minute course covers why accounts are the target, strong and unique sign-ins, multi-factor authentication and passkeys, fake sign-in pages and the grey areas of sharing, shortcuts and recovery. Agents reset passwords and MFA all day, so they need the safe way to verify before they act. A "what would you do?" scenario on a tempting shortcut is the moment to poll the room.
Phishing & social engineering
Phishing and social engineering target help desk agents directly. This 30-minute course explains how attackers use trust, urgency and authority, teaches red flags and ends with a 12-question final check at 80% to pass. Agents also learn to report what they spot. A spot-the-red-flags round works well as a Pick Answer quiz. For more attack types, see our guide to social engineering examples.
Social engineering, fraud and deepfakes: phone, payment and impersonation scams
The caller who sounds like your finance director may be a faked voice. This 35-minute course follows a convincing request for new bank details, teaches verifying requests with a known number and covers deepfake voice and video. Agents learn to treat seniority, politeness and secrecy as pressure, not proof. A Word Cloud on "why would someone skip the check?" captures that fast.
Security awareness essentials
This 35-minute course sets the baseline for anyone with access to administrator tools: why people are targeted, the stages of an attack, red flags across email, text, phone, web and USB, core habits and how to report. It ends with a 12-question final check at 80% to pass. It is the one course here with a US federal rule behind it, the FTC Safeguards Rule noted above, which covers some financial institutions. Check your own position with your counsel.
Our pick: Passwords, passkeys and multi-factor authentication for staff. Resets and MFA changes are exactly what attackers ask the desk for, so the verification habit here is the one that stops the 4:50 pm call.
Incidents and malware
Malware and ransomware: how infections spread and what to do
Agents field the first report of a strange pop-up or a locked file, so they need to know how infections start. This 30-minute course follows an infection from a free font download, then covers the common routes, safe habits, backups and updates, and the first minutes. A "how did it start?" question works as an Open Ended slide, and the pressure-and-payment lesson covers what to say when a user wants to pay.
Cyber incident response and breach reporting for non-specialists
When the quiet laptop turns out to be a breach, the first ten minutes count. This 35-minute course gives agents the signs to spot, how to report, what the response team does next and why people stay silent under pressure. It includes a tabletop drill of your own role. Agents use it to escalate through the incident process and preserve evidence instead of improvising.
Our pick: Cyber incident response and breach reporting for non-specialists. The desk is often where an incident is first reported, and a clear first-ten-minutes routine beats a clever fix.
Service management and AI risk
ITIL 4 and IT service management: incident, problem and change on the service desk
This 45-minute course opens with one fault raised forty times, then explains the service value system, guiding principles, how incident, problem and change differ, prioritising by impact and urgency, SLAs and writing a good ticket. It structures daily service-desk work. In the classify lesson, agents sort real tickets into incident, problem or change, a natural Pick Answer round.
AI security for everyone: shadow AI, prompt injection and manipulated outputs
Users now ask the desk about AI tools nobody approved. This 30-minute course covers shadow AI, prompt injection, hidden instructions in PDFs and emails, free AI extensions and how to request an approved tool or report an incident. Agents need it to answer those questions safely. A Rating Scale on "how confident are you spotting a hidden instruction?" gives a before-and-after read.
Our pick: ITIL 4 and IT service management. Good process is what makes verification stick under pressure: a desk that classifies and prioritises well has the time to check a caller.
How to roll the plan out
Order it by exposure. Because the human element appears in 62% of breaches in the Verizon report, start with the courses that teach verification.
- In the first week of a new agent: passwords, passkeys and MFA, phishing and social engineering, and security awareness essentials.
- Within the first month: fraud and deepfakes, malware and ransomware, incident response and the ITIL 4 course.
- Each year: a refresher quiz on each course, plus the AI security course whenever a new AI tool is rolled out.
- When it applies: if you are a covered financial institution, keep security awareness training current as the FTC Safeguards Rule describes, and ask your counsel what else applies in your country or state.
Ways to run these courses on AhaSlides
You can build any of these as a self-paced course with the AhaSlides course creator, run them as a live Q&A session deck, or both, with a post-course survey and a 30-day check-in to see what changed.
- Pick Answer: show a caller's request and four possible responses, or ask which ticket is an incident and which is a problem.
- Word Cloud: ask "Why would an agent skip the identity check?" The biggest words show which pressure to train against.
- Rating Scale: before and after, ask "How confident are you that you would refuse an urgent MFA reset?" from 1 to 5.
- Open Ended: collect anonymous near-misses from the desk at the end of a live session.
FAQ
What training do IT help desk staff need?
Help desk staff need ticketing and ITIL basics plus identity verification and social-engineering awareness. The courses above cover both, and entry certificates can add the technical side.
How do attackers target help desks?
They impersonate employees to request password or MFA resets, so agents must verify identity first. The Verizon report describes attackers posing as help desk agents or as users needing a password reset.
Is help desk certification worth it?
Entry certificates help hiring, but security awareness training can reduce real incidents at the desk. This post does not sell a credential, so treat the two as complementary.
What should a help desk agent do after a suspected breach?
Escalate immediately through the incident process and preserve the evidence. Do not try to clean up first, and report even if you are unsure.
This post is general information, not legal advice. For a decision about your own workplace, speak to a qualified lawyer or the regulator.
