An IT support agent can clear most password resets without a person touching them. A password reset is also the request an attacker makes when ringing a helpdesk, because it hands over an account. Both statements are true, and the same piece of software sits on top of both.
Most of what gets published about agentic AI for IT support is about the first fact: how many tickets the agent deflects and what a ticket costs once it does. Those numbers are real enough to be useful, and neither decides whether you should deploy one. The deciding number is smaller and harder to find. It is what the agent is allowed to do, and who can talk it into doing something else.
The desk, side by side
A widely shared compilation from Stealth Agents, which cites HDI and Gartner survey work, reports that 68% of large enterprise IT departments use AI for at least Tier 1 triage, and that password reset and account unlock requests see 75% to 90% deflection. Its cost-per-ticket figures put a fully loaded human-handled Tier 1 ticket at $22.50, against $1.80 to $4.50 for AI self-service.
We could not trace those figures back to the original HDI report, so we treat them as direction and not as measurement. Direction is enough, because the logic holds without the decimals. A password reset is the most formulaic ticket a desk receives, and clearing most of them tells you almost nothing about the second-easiest.
So set the two desks against each other on the questions that matter, using reasoning where the numbers run out.
| Question | Human Tier 1 | AI agent |
|---|---|---|
| Routine resets and unlocks | Handled, at labor cost | Reported deflection of 75% to 90% (compilation above, untraced) |
| Cost of a routine ticket | $22.50 fully loaded (same compilation) | $1.80 to $4.50 for self-service (same compilation) |
| Who is on the other end | One caller at a time, who may sound wrong | Anyone able to raise a ticket, including outside addresses that become tickets automatically |
| What happens at the fifth attempt | Suspicion tends to rise | No fatigue and no suspicion, a patient target that is always on |
| What a "closed" ticket means | Usually that someone spoke to the user | That a conversation ended, which is not the same as a fixed problem |
| Record of why it acted | Memory and notes | A log, if you built one |
The two rows that matter most are the middle ones. Helpdesks were targets for social engineering long before agents: the standard attack is calling the desk and asking for a reset in a convincing voice. An agent does not remove that attack. It hands the attacker a target that never tires, and it reads text from whoever writes it. Some of that text will be written to manipulate the agent. Google Ads data pulled through DataForSEO on 11 October 2026 (US, English) shows "prompt injection" at 5,400 searches a month, climbing from 3,600 in September 2025 to a spike of 9,900 in August 2026.
The other row to read twice is "closed". A ticket the agent closes and a ticket the agent solves are different events, and most dashboards report the first. A user who gets an answer that does not work opens another ticket, calls the desk or asks a colleague, and the deflection counter has already gone up. Track the repeat-contact rate beside deflection from day one: how many users with a closed ticket return about the same issue within a week.
When each one gets the ticket
The agent has to be able to reset passwords and unlock accounts, and often change group membership or assign licenses. Each of those is an administrative action taken in response to text typed by whoever raised the ticket. That is why the sorting rule is about authority and not about difficulty.
Give the agent the ticket when it only needs read access to diagnose, or when the action is a reset or unlock on a standard account. Give it to a person when the request changes group membership, touches a privileged account or alters access in any way. The agent can propose and a human clicks. Verify identity outside the ticket as well: if the request is the only evidence of who is asking, the agent has nothing to check against, and the check belongs in your identity system through multi-factor confirmation. This is also why we would build such an agent as a user with a defined role inside the systems it acts on, and not as a service account with a wide key. AI agent security and prompt injection goes into the mechanics.
Gartner forecasts that over 40% of agentic AI projects will be canceled by the end of 2027. The weak-risk-controls cause bites fastest here, because a bad automated fix can lock out a user. The general pattern is in why agentic AI projects get canceled.
Start with your own ticket log. Export three months of tickets and sort them by type, then pick the largest category that carries the lowest risk if the answer is wrong. That is the pilot, and the log is its baseline. Run it for 90 days with resolution tracked: if repeat contacts fall and the desk's time on that ticket type falls with them, you have a case, and if not you spent a small amount to find out. Our IT support services work in this order, audit first, action list second, platform last, and you can get in touch with the ticket log in hand.
