An IT employee got a call from one our best customers. The caller wanted to know about the company's network infrastructure, systems, and team. New opportunities of integration are in sight for both c

Providing even the name of a technical contact without authorization is a partial disclosure that can enable social engineering by giving an attacker a named target.

A customer service orientation does not override information security policies; disclosing internal infrastructure details without authorization is a security violation regardless of the customer relationship.

Sharing network infrastructure details, system configurations, or team information with any external caller - even a known customer - without prior management authorization violates fundamental information security policy. Legitimate integration opportunities follow formal channels such as NDAs, authorized contacts, and managed disclosure processes. Acting without authorization exposes the company to social engineering exploitation and potential data breaches.

Hanging up is unnecessarily dismissive and unhelpful; the correct response is to acknowledge the inquiry and route it through proper authorization channels rather than ignoring it.