A help desk headset crackles at nine on a Tuesday morning with a familiar complaint.
Somebody is locked out of their own account again.
The fix takes four minutes, maybe five.
Nobody in the building thinks of it as a financial event.
But multiply that click by a workforce, then by a year, and a strange number falls out the other end.
So what turns a password reset into real money, and why does it connect to breaches costing millions?
Why one small click carries a surprisingly large bill
The math starts with a single support ticket. Forrester Research states that the average help desk labor cost for a single password reset is about $70 , once a technician’s time, the software license, and the lost working minutes are added up.
That figure is not a guess pulled from nowhere. It comes from repeated industry surveys tracking how help desks actually spend their hours, and it holds up across companies of wildly different sizes because the underlying steps barely change: verify the person, reset the credential, log the ticket.
Then there is the volume problem. Password related calls make up a huge share of everything a help desk handles, with the Gartner Group finding that between 20% and 50% of all help desk calls are for password resets .
None of that sounds alarming on its own. But a thousand employees taking even two resets a year, at that per ticket price, quietly crosses six figures before finance notices the line item.
The everyday scene behind the spreadsheet
Picture the actual moment. An employee forgets a login after a long weekend, tries three guesses, locks the account, and calls in.
A technician on the other end spends several minutes confirming identity before resetting anything, because skipping that verification step is exactly how attackers trick help desks into handing over access in the first place. Security researchers who track these incidents describe the support call itself as the weakest lock in the building.
That is not a hypothetical risk. Real intrusions have started with nothing more exotic than a phone call to a support line, which is part of why help desk procedures have grown slower and more cautious even as ticket volume keeps climbing.
Meanwhile the employee on hold is not working. A Ponemon Institute survey conducted for Yubico found respondents spend an average of 12.6 minutes each week, or 10.9 hours per year, entering and resetting passwords , time that never shows up on an expense report but still comes out of the workday.
Where the harder numbers come from
The credential problem scales into something far bigger once a stolen password actually succeeds in opening a door. IBM’s Cost of a Data Breach Report put the worldwide average breach cost at $4.88 million, a 10% increase over the previous year’s $4.45 million .
Breaches that start with stolen or compromised credentials specifically have averaged close to five million dollars per incident in recent editions of that same annual study, with the average cost of a breach involving compromised credentials coming in at $4.81 million , based on an in-depth analysis of real-world data breaches experienced by 604 organizations globally that disclosed what an intrusion actually cost them from detection through recovery. That figure sits close to the current global average, but it carries a separate penalty.
Credential based intrusions tend to run longer before anyone notices; these breaches took an average of 292 days to identify and contain, the longest of any attack vector studied . So the two numbers meet in an uncomfortable place: the $70 reset is the price of staying safe, while the multimillion dollar average is the price of a password that gets abused anyway, often through the very channel built to fix it, a pattern echoed in one recent password spray campaign that hit thousands of accounts through automated login attempts.
IBM’s researchers have also tracked how automation changes the outcome. Organizations that extensively deployed security AI and automation saved an average of $2.2 million per breach compared with companies using none of it at all.
Why the sample behind these numbers holds up
These figures are not drawn from a single anecdote. Forrester’s per-ticket estimate has circulated across the help desk software industry for years and continues to be cited by independent research firms covering enterprise IT spending. IBM’s breach-cost figures come from its long-running annual study, which draws on in-depth interviews with hundreds of organizations that experienced a real breach, broken down by industry, region, and attack vector. Gartner’s share-of-calls estimate traces back to its own service desk benchmarking work and has likewise been repeated across the industry for more than a decade. None of the three organizations behind these numbers sell password reset software, which is part of why the figures keep reappearing in vendor-neutral analyst reports rather than only in marketing material.
Where this math gets complicated
None of this means the reset button itself is dangerous. It means the surrounding process, built decades ago around something a person can simply forget, has become the weak hinge in an otherwise modern security setup. Even so, not every organization faces the same exposure.
A small retailer with forty employees and a single shared login looks nothing like a hospital network or a bank running tens of thousands of accounts across contractors, vendors, and remote staff. That is why industry estimates vary so widely, from a few hundred thousand dollars a year in reset overhead for a mid sized firm to multimillion dollar annual totals at the largest employers.
Worse, the fix many companies reach for first, like a quick security checkup prompt, only patches the surface. Passwords themselves are the thing being phased out at the biggest technology companies, not merely reset faster.
What it means for anyone who has ever clicked forgot password
The quiet upside is that this is a solvable kind of expensive. Passkeys, biometric logins, and hardware security keys are already replacing typed passwords across major platforms, and every account that switches over removes one more ticket from that support queue permanently.
That shift attacks both numbers at once, the everyday $70 reset and the multimillion dollar breach tail, because a credential that cannot be phoned in, guessed, or reused cannot be stolen the old fashioned way either.
Until that transition finishes, the forgot password link stays what it has quietly become, a small unglamorous object carrying a real measurable price every time somebody clicks it. And for now, the industry building its replacement is moving faster than most employees clicking it have noticed.
