Analysing your account's security posture

Zendesk scores your security settings and says what to fix. Worth reading, and worth reading critically.

Zendesk scores your security settings and says what to fix. Worth reading, and worth reading critically.

Check it

1. Open Admin Center, then Account, then Security, then Security overview.
2. Read the panels at the top for the overall picture, then open the sections beneath them. A section header carries a red circle when something inside it is Critical and an amber triangle when something is Recommended. A header with no icon is Healthy, so you can see which sections to skip before opening anything.
3. Work through what is marked Critical first, then what is marked Recommended.
4. Note anything you deliberately choose not to do, and why.

Start with authentication

Two-factor authentication and sign-in methods are usually at the top, and rightly. They are also the recommendations most often postponed because they affect every agent.

Postponed is a decision. Make it deliberately rather than by leaving the page.

What it can see

Settings. It knows whether two-factor is required and how long sessions last.

What it cannot

Whether five people share one login. Whether an agent role can read every ticket in the company. Whether the leaver checklist is followed.

Those are the things that go wrong, and no assessment detects them.

A good score is not a clean bill

It means the settings are configured well. Treat it as one input alongside your own access review, not as the review itself.

There is a second reason to hold it lightly, and it is easy to miss: the page shows only the security settings your plan has. A lower plan therefore has fewer things to be marked on, so a clean overview there says something about your plan as much as about your account. Comparing your score against another organisation's means comparing two different lists.

Record your exceptions

Where you decline a recommendation for a real reason, write it down. Otherwise it resurfaces every quarter and somebody eventually applies it without knowing why it was declined.

Recheck after changes

New integrations, new admins, a new sign-in method. Each can move things, and the assessment is quick to reread.

See also

• General security practices for your Zendesk
• Restricting access with IP restrictions
• Checking devices and applications that accessed your account