Verify the Caller Without Leaving the Ticket

A caller says they are locked out. Your agent opens a ticket, asks a few questions, and decides. Whatever check happens in that gap is the control. Where does it live on your help desk: in the tool, or in the agent’s head?

CISA’s advisory on Scattered Spider describes what that gap invites. The group’s operators “conduct spearphising calls to convince IT help desk personnel to reset passwords and/or transfer MFA tokens” (CISA, advisory AA23-320A, published November 2023, revised July 2025). The description names no ticketing tool. The question for your team is how far an agent has to go from the ticket to run a real check.

Does ATO Protect work inside Zendesk, Jira Service Management, Ivanti or Freshdesk?

Yes. Trusona builds and supports integrations for ServiceNow, Zendesk, Jira, Ivanti and Freshdesk (Trusona FAQ). For the four besides ServiceNow, the integration is delivered through the ATOP API. None of the four is a listed app in its platform’s marketplace, so there is no install button. Your team, or a partner of yours, wires the API call into the ticket workflow you already run.

The API gives your team control over where the check sits in the workflow and what happens with the result. Someone on your side makes those choices. Trusona puts its side of setup at under 30 minutes, a company figure with no published methodology.

Why the ticket is the right place for the check

The ticket already holds the caller’s claimed name, the request, the agent who took it and the timestamp. It is the record you will be asked for after an incident. A verification that happens in a separate tool, or only in the agent’s judgment, leaves that record saying “agent verified caller” with nothing behind it.

Moving the check into the ticket keeps the agent in one place, which matters on a queue where handle time is measured. It also puts the outcome next to the request it authorized, so “who approved this reset, and on what basis” has an answer in the same system as the reset.

What the check is, wherever it runs

The check does not change with the ticketing tool. From the ticket, the agent sends a secure verification link by SMS, email or chat to the number on file. Whoever opens it has to scan a government-issued ID, which is checked in real time against the authority that issued it. Knowing the employee’s ID number and manager’s name does not satisfy that.

The same properties apply on every platform. A first-time caller gets the same check as a regular one, because no pre-registration is needed. The employee completes it in the mobile browser, so there is no app to install. There is no selfie or liveness check, since generative AI can now defeat those methods. All user PII from the verification session is deleted. SIM swap and port-out detection can flag a number that has recently moved, and man-in-the-middle detection is patented (US Pat. 10,601,859).

What to decide when you implement it

Because the four integrations run on the API, several choices belong to your team. Settle them before anyone writes code.

1. Which requests trigger a check. Password reset and MFA reset come first. Enrolling a new device and changing a recovery email belong on the list too.
2. Where the result shows up in the ticket. Trusona does not prescribe a field for Zendesk, Jira Service Management, Ivanti or Freshdesk. Where the verdict lands depends on how your team implements the API, so pick a place agents will see and an auditor can find.
3. What an agent does on a failed check. The ticket should say the same thing every time: the request stops and goes to a named person.
4. Who can skip the check, and how that gets logged.

ServiceNow works differently

If your help desk runs ServiceNow, there is more published detail, and the setup is different. ATOP + ServiceNow is documented on its own page: the agent triggers the check from the ServiceNow ticket, and the result lands in the ticket’s work notes (Trusona, ATO Protect for ServiceNow). Trusona’s launch post walks through it in the agent’s terms, including the link the employee receives by SMS or email: identity impersonation detection inside ServiceNow. The work-notes detail is specific to ServiceNow and does not describe the other four.

You can start before the integration exists

An integration is not a precondition. Trusona’s FAQ says a team can go live in under seven minutes through a web portal, with no integration required (Trusona FAQ). That gives you a way to learn which requests need the check before you decide where it sits in the ticket.

Questions to bring to your own help desk

• When an agent resets a password today, what in the ticket shows how they knew the caller was genuine?
• Is the check something the tool prompts, or something the agent remembers?
• If your ticketing tool changed next year, would the check survive the move?
• Which of your agents work from the ticket alone, such as an outsourced overflow desk, and what does the check look like for them?

For the product at the help desk, see ATO Protect for IT Help Desk, and the field manual on Scattered Spider shows what the call looks like from the attacker’s side.

Frequently asked questions

Does ATO Protect work inside Zendesk, Jira Service Management, Ivanti and Freshdesk? Trusona builds and supports integrations for all four, plus ServiceNow. The four besides ServiceNow are delivered through the ATOP API.

Is ATO Protect available in the Zendesk, Atlassian or Freshworks marketplace? No. The integrations for Zendesk, Jira Service Management, Ivanti and Freshdesk are delivered through the ATOP API, not as marketplace apps.

Where does the verification result appear in the ticket? That depends on how your team implements the API. Trusona does not set a fixed field for Zendesk, Jira Service Management, Ivanti or Freshdesk. In ServiceNow, the result is written to the ticket’s work notes.

How long does setup take? Trusona puts its side of setup at under 30 minutes. That is a company figure with no published methodology, and it does not include the work of wiring the result into your ticket.

Does the caller need to install an app or register first? No. The caller opens a verification link in their mobile browser, and no prior enrollment is needed.

Does ATO Protect use a selfie or liveness check? No. Generative AI can now defeat those methods, so Trusona checks a government-issued ID against the authority that issued it instead.

What happens to the caller’s ID data? All user PII from the verification session is deleted.

Can we try it without integrating? Yes. A team can go live in under seven minutes through a web portal, with no integration required.

The ticket already records who asked and who approved. Put the check where the record is, and it can say how the agent knew.