An IT employee got a call from one of our best customers. The caller wanted to know about the company's network infrastructure, systems, and team. New opportunities of integration are in sight for bot

Providing even a partial detail such as a team member's name without authorization still constitutes an unauthorized disclosure that can enable further targeted attacks.

A customer service culture or policy does not supersede the organization's information security policy, and customer relationships do not justify sharing sensitive infrastructure details without authorization.

Hanging up without explanation ignores proper security procedure, which requires politely declining the request and directing the caller through verified, authorized channels rather than simply disconnecting.

Providing sensitive organizational or technical information without management authorization violates the principle of least disclosure, regardless of how legitimate or familiar the caller appears. This scenario is a textbook social engineering scenario where an attacker poses as a trusted customer to gather reconnaissance data. Proper protocol requires verifying the request through official channels and obtaining explicit management sign-off before any sensitive details are shared.