An IT employee got a call from one of our best customers. The caller wanted to know about the company's network infrastructure, systems, and team. New opportunities of integration are in sight for bot

Providing even one employee name without authorization can aid an attacker in targeting personnel through spear phishing or pretexting, making this response still a security risk.

A customer service policy cannot override information security policy; disclosing sensitive infrastructure and team details to any caller without verification and authorization creates serious risk.

Hanging up without explanation is unprofessional and unnecessary; the correct approach is to politely decline and seek management guidance rather than abruptly ending the call.

Even a trusted customer relationship does not grant automatic access to internal network infrastructure details or staff information. Providing such data without management authorization violates security policy and could facilitate a social engineering attack or unauthorized access, so the employee must escalate for approval first.