How to protect the self-service portal from vulnerabilities

Sponsored by

Your AI strategy has a security problem: 43% of IT leaders now cite security concerns as the top barrier to expanding AI agent deployment, according to research from JumpCloud. Before giving agents more access to apps, data, and workflows, make sure you can govern the identities behind them. See how to secure every identity, human or not.

As companies debate whether to transfer more IT help desk responsibilities to self-service portals powered by AI tools, one question stands out: Is this safe?

In theory, an internal or external attacker could use a company’s AI-powered self-service portal to initiate an unauthorized credential reset, set up a fake business email, or other nefarious activities. That can lead to devastating consequences: Sophos shared in its State of Identity Security 2026 report that 71% of organizations experienced an identity-related security breach in the 12 months leading up to the report, with data theft and ransomware among the most common consequences of successful vulnerability attacks.

Ramy Rahman, a senior solutions engineer at ArmorCode, said that while automating password resets may not seem like a mission-critical vulnerability, this process can be weaponized by attackers.

“We’ve already seen prompts to authenticate be used in attacks, so you really need to make sure that you’re training the users to understand what is approved ways for you to be able to do password resets,” Rahman said.

IT help desks that use AI, including a chatbot, for self servicing could expose sensitive data through unsanctioned usage, produce inaccurate outputs that hurt employee decision-making, or could even face issues around compliance and accountability if not used correctly, according to Witness AI.

Where it can help. Rahman suggested that self-service portals can utilize AI to give employees help with licensing and permissions, for example. This reduces the risk of a security vulnerability resulting from the help desk, because if the AI gives the wrong license, humans in the loop can quickly revoke it.

Salesforce points to AI service desks as allowing a quicker customer resolution time, constant availability, and reduced IT burnout, among other benefits for the IT department. Since the technology is able to free up IT experts from a large volume of repetitive tasks, they’re able to then focus on strategic work or other projects.

Getting ready to (self) serve. Atomicwork’s CEO Vijay Rayapati told IT Brew that organizations have to first establish control over identity management before implementing AI-enabled tooling for self-service portals.

“Support desks have always been an attack surface,” Rayapati said. “If you want to unleash [artificial] intelligence in your enterprise, you have to first get control of identity.”

Organizations can prioritize visibility into the AI agent’s actions by procuring tech from vendors that offer built-in observability functions, Rayapati added. IT teams also need to work on governance, data classification, and visibility before they start automating and potentially allowing a self-service AI to “create some damage.”

Without well-documented system architecture, an AI model could produce irrelevant or outdated responses for employees seeking help. Rahman pointed to the possibility of a company changing vendors over the years, and not updating the IT knowledge base to take those changes into account, which could undermine a self-help portal.

“Don’t try to boil the ocean in terms of automation out the gate because you’ll probably do more harm than good, and then you’ll lose organizational capital,” Rahman said. “People will lose trust in you.”