Help desk staff can skip critical identity verification steps under pressure, especially when social engineers impersonate executives with stolen personal details.
A middleware layer that integrates with AD/ITSM tools and physically blocks password resets until a 2FA challenge is completed. Includes real-time cross-referencing of caller claims against live signals (e.g., Teams status, device enrollment, geo-location) and flags anomalies automatically.
subscription per seat, tiered by org size
This is a 'career-ending mistake' problem. The Reddit post alone (843 upvotes) shows helpdesk staff live in fear of this. MGM lost $100M+ from a single helpdesk social engineering call. CISOs are terrified. The pain is acute, frequent, and has massive downside. People literally lose their jobs over this.
TAM: ~500K mid-to-large enterprises globally with L1/L2 helpdesks. At $5-15/user/year for IT staff seats, realistic SAM is $500M-$1B. Not a massive consumer market, but B2B enterprise security budgets are large and growing. The niche is well-defined but not enormous.
Strong WTP signals. After MGM/Caesars, security budgets explicitly allocated for helpdesk hardening. CISOs have budget authority and this is now a board-level concern. Enterprise buyers pay $3-9/user/month for generic MFA — a purpose-built helpdesk solution at $3-8/user/year is a no-brainer line item. Compliance mandates (SOC2, NIST) are creating forced purchases.
Core concept (block password reset until 2FA) is straightforward. However, real-time cross-referencing of Teams status, device enrollment, and geo-location requires deep integrations with Microsoft Graph API, Intune, AD, and ITSM platforms (ServiceNow, Jira Service Management, Freshservice). Each integration is nontrivial. MVP with AD + one ITSM + basic 2FA gate is achievable in 6-8 weeks for a strong dev, but the anomaly detection and multi-signal cross-referencing pushes beyond solo dev MVP territory.
Critical gap exists: NO existing product combines enforced verification workflow + real-time anomaly detection + contextual signal cross-referencing (Teams status, geo, device posture). Specops enforces workflow but has no intelligence. Nametag has strong identity proofing but no behavioral analysis. Silverfort has risk analysis but no helpdesk-specific workflow. The middleware approach that blocks AND detects is genuinely unoccupied.
Textbook SaaS subscription. Security tools are never canceled once deployed (liability risk). Per-seat pricing scales with org size. Once embedded in the helpdesk workflow, switching costs are extremely high. Upsell path to analytics, compliance reporting, and additional integrations. Net revenue retention in security SaaS typically exceeds 120%.
- +Extreme pain intensity with career/company-ending consequences — buyers are motivated by fear, which is the strongest B2B purchase driver
- +Clear competitive gap: no one combines enforced workflow + anomaly detection + contextual signals in a single middleware layer
- +Market timing is perfect — post-MGM/Caesars, CISOs have explicit budget for this. You're riding a wave of regulatory and board-level pressure
- +High switching costs once deployed — embedded in helpdesk workflow makes this very sticky
- +The Reddit signal (843 upvotes, 89 comments with people sharing their own near-misses) is authentic demand, not hypothetical
- !Enterprise sales cycles are 3-9 months — you need runway and patience. Mid-market may be faster but less revenue per deal
- !Integration complexity is real — AD, ServiceNow, Intune, Teams, Okta, Duo all have different APIs and auth models. Each new integration is engineering investment
- !Incumbents (Microsoft, Okta, Cisco/Duo) could add a 'verify before reset' feature as a checkbox item and commoditize your core value prop overnight
- !Nametag is well-funded and laser-focused on this exact niche — you'd be entering a direct fight with a venture-backed competitor that has a head start
- !Selling security to enterprises requires SOC2 Type II, pen test reports, and security certifications — building trust takes time and money before you even sell
Integrates with service desk platforms to enforce identity verification before password resets or account unlocks. Agents cannot proceed until caller passes verification via SMS, email codes, Duo/Okta push, manager approval, or security questions. Deep Active Directory integration.
Purpose-built identity verification for IT helpdesks using cryptographic identity proofing — caller scans government ID and takes live selfie matched via facial recognition. Agent gets verified identity confirmation before proceeding. Designed explicitly to stop MGM/Caesars-style social engineering attacks.
Primarily an MFA platform adapted for helpdesk verification. Agents can trigger Duo Push notifications to the caller's registered device before proceeding with password resets. Also offers Device Trust and Trusted Endpoints features.
Combines Okta Verify MFA push with document-based identity proofing
Unified identity protection platform that extends MFA to any resource including service desk tools. Performs real-time risk analysis on authentication events. Agentless deployment that covers legacy systems, AD, LDAP, and RDP.
A ServiceNow or Freshservice plugin that intercepts password reset tickets and blocks resolution until a 2FA challenge (Duo Push, Okta Verify, or email OTP) is completed by the actual account owner. Add a simple dashboard showing: reset requests blocked, verification success/failure rates, and flagged anomalies (e.g., reset requested outside business hours, requester geo doesn't match AD location). Skip biometric/document proofing for MVP — focus on the enforced gate + basic anomaly flags. Target 3-5 design partners from the Reddit thread commenters.
Free tier: 10 agents, basic 2FA gate, email OTP only → Starter ($4/agent/month): Duo/Okta push integration, basic anomaly dashboard → Pro ($8/agent/month): Multi-signal anomaly detection (Teams status, geo, device posture), compliance reporting, SIEM integration → Enterprise (custom): Custom integrations, dedicated support, SLA guarantees, on-prem deployment option
3-5 months to first paying customer. Month 1-2: Build MVP with one ITSM integration + basic 2FA gate. Month 2-3: Deploy with 3-5 design partners from sysadmin communities. Month 3-5: Convert design partners to paid, begin outbound to similar companies. Enterprise deals may take 6-9 months but mid-market (500-2000 employees) can close in 4-8 weeks with a compelling pilot.
- “I completely fucked up and forgot to authenticate the user”
- “I reset the AD password without authenticating the user”
- “implement some automation to ensure that password resets physically cannot be processed without a 2FA code”
- “an opportunity for management to maybe add a few more guardrails”