Self-service password reset (SSPR) is an identity recovery feature that lets users regain access without help desk intervention, usually by answering challenge questions, approving a push notification, or verifying a phone number or email. It improves usability and reduces support costs, but it also becomes a high-value target because whoever controls the recovery channel can potentially control the account.
In cyber security, SSPR matters because attackers often prefer to bypass a password entirely by taking over recovery methods. If email inboxes, SMS numbers, authentication apps, or help-desk-linked recovery workflows are weakly protected, an attacker may reset the password and log in as a legitimate user. Defenders should protect recovery factors with strong multi-factor authentication, alert on reset events, restrict self-service for privileged accounts, and review unusual identity changes quickly.