The MSP-as-a-Service Boom and the Outsourced Help Desk: Most Providers Were Never Built to Scale

A shared, outsourced help desk can look like the fastest way for a managed service provider to scale. It also puts the keys to your clients' accounts in the hands of people who do not know your clients, following a script that attackers can learn. Before you rent a shared back office, decide who checks that a caller is who they say they are.

The rise of the shared back office

Some companies now sell managed service providers a different kind of offer: rent the whole operation. A holding company or large provider runs the network operations center, the security operations center, the outsourced help desk, onboarding and even pre-sales for you, under your brand, from a shared pool of staff that serves many providers at once. The pitch is to stop building and start renting.

It is easy to see why it sells. Experienced technicians are hard to hire, payroll is hard to shrink when demand dips, and turning fixed salaries into a variable fee feels like relief. For a provider that cannot fill seats, a shared outsourced help desk solves this quarter's problem.

What renting the operation costs you later

The price is knowledge. When the people who answer your clients' calls work for someone else and rotate across dozens of providers, what they learn about your clients stays with them. You keep the contract and lose the understanding that made you worth hiring. When the work changes, and AI is changing how a lot of service work is done, you are waiting for a shared platform to update its playbook instead of adapting your own.

Why an outsourced help desk is a security risk

The help desk is where identity gets reset. Whoever can convince it to change a password or move a multi-factor sign-in to a new phone can walk into the network. Attackers know this.

A joint advisory from CISA and the FBI, last updated in July 2025, describes a criminal group that "targets large companies and their contracted information technology (IT) help desks." Its members "posed as employees to convince IT and/or helpdesk staff to provide sensitive information, reset the employee's password," and transfer multi-factor sign-in to a device the attackers control. In spring 2025, impersonation aimed at account resets was at the center of attacks on major UK retailers.

Marks and Spencer's chairman told members of Parliament in July 2025 that its attack began with "sophisticated impersonation" of "one of the retailer's third-party users," Bloomberg reported. Co-op told the same hearing that its attack "also involved hackers impersonating an employee," by answering security questions to trigger an account reset. The UK's National Cyber Security Centre responded by urging every organization to "review helpdesk password reset processes, including how the helpdesk authenticates staff members credentials."

1. Apr 17, 2025 Attackers enter M&S systems. The retailer detected them two days later, its chairman later told MPs.
2. Apr 22, 2025 M&S announces the attack. Co-op and Harrods were also targeted that month.
3. May 4, 2025 NCSC issues advice. It tells organizations to review help desk password reset processes.
4. Jul 8, 2025 Retailers testify. M&S describes impersonation of a third-party user; Co-op describes a reset triggered with security answers.
5. Jul 29, 2025 CISA and the FBI update their advisory. New techniques include posing as employees to get help desk resets.

Why shared scripts make an outsourced help desk easier to fool

A shared outsourced help desk works because it follows standard procedures across many clients. That is also its weakness. Agents who handle hundreds of companies cannot recognize a voice, know who is on holiday or notice that a request does not fit how a client works. They check the boxes on the script. An attacker who learns the script once can try it against every client the desk serves.

Where the team sits does not fix this. A domestic team following a predictable script can be fooled as easily as an offshore one. What matters is whether the person resetting the password knows your people and has a verification step an attacker cannot talk past.

What to ask before you hire an outsourced help desk

Security agencies have told managed service customers for years to settle responsibilities in writing. The joint advisory on threats to managed service providers from CISA, the NSA, the FBI and partner agencies advises customers to confirm "whether the MSP or the customer owns specific responsibilities," and says contracts should detail "how and when MSPs notify the customer of an incident." For an outsourced help desk, that means getting clear answers to these questions:

1. How is a caller verified? Security questions are not enough. Ask for a call-back to a number on file, a manager's approval, or a check in a system the caller cannot fake.
2. What needs a second person? Resets for administrators, finance staff and executives should never be one agent's decision.
3. Who else uses the same desk? Know whether the agents serving your clients serve many other providers too.
4. What gets logged? Every reset, who asked, who approved, and how the caller was verified.
5. How fast will you hear about an incident? Put the notification time in the contract.

The same CISA and FBI advisory recommends phishing-resistant multifactor authentication for all services to the extent possible. Sign-in methods that cannot be read out over the phone leave a help desk agent less to hand over.

The case for a team that knows your clients

A dedicated team inverts the shared model. Instead of renting hours from a pool, you work with people assigned to your business who learn your systems, your clients and their habits. That knowledge builds up instead of resetting every time a shared agent rotates to another account, and it is exactly what makes impersonation harder: the person on the phone knows who should be calling.

Dedicated capacity usually costs more up front than a shared seat on an outsourced help desk. It also keeps the operational knowledge on your side, adapts to your clients instead of the average client, and keeps your clients' identity resets out of a playbook shared with your competitors.

Where LTFI fits

LTFI runs each company on its own server that Kief Studio hosts and manages, rather than one shared platform for every customer. Anything that sends, posts, publishes or spends waits for the person who owns it, and every action lands in the activity log, so you can see who did what and who said yes. Rules, permissions and credentials stay with people; an AI teammate cannot change them. Providers can sell LTFI to their clients as their own, with each client on its own server, through the MSP and agency program. A related note looks at why fewer vendors does not add capacity.

Frequently asked questions