IT support specialist / helpdesk

NAICS 5415, computer systems design and related services, all employees, seasonally adjusted. The turn is March 2023 and the decline is steady rather than sharp. Two limits decide how much weight this can carry for this occupation. The industry contains software development, consulting and managed services as well as support desks, and cannot separate them — so this is not a support-specific measurement. And most people doing IT support are employed inside a bank, a hospital or a factory rather than by an IT services firm, and every one of them is counted in that employer's industry instead. The series sees the outsourced half of this occupation and not the larger in-house half.

Verifiable change in hiring, headcount, hours or job scope. Highest weight — but causal attribution still has to be argued, not assumed.

England, one university. The university's own notice says self-service lockers for staff and students to pick up laptops, drop off equipment for repair or collect accessories were ready for use from 12 February 2026, and that by reducing face-to-face collections the IT team can focus more time on resolving technical issues; equipment is issued through support requests, hardware orders, repairs, loans or replacements. The hand-over moves to a locker; the repair and preparation of kit stay with people; no staffing change is given.

An employer has put it into production. Can move the baseline — weighted by scale and how similar the setting is.

A joint advisory by US and allied government cyber agencies on a criminal group's methods. It says the group's social engineering attempts are designed first to learn what steps are needed to conduct password resets from help desks, then to gather the reset information for a targeted employee, often over several calls; and, in the July 2025 update, that its members posed as employees to convince IT or help-desk staff to provide sensitive information, reset the employee's password and transfer the employee's MFA to a device they control. Its mitigations recommend phishing-resistant MFA and training against voice phishing; it does not prescribe how a help desk should verify callers, and it describes one group rather than how often desks are fooled.

Failure, rollback, regulation or cost is suppressing adoption. Can lower an assessment or widen its uncertainty.

England, one public employer. The trust's own staff newsletter says its IT Services team rolled out a smart locker system to a third site after successful pilots in two towns; that the pilots distributed 1,000 laptops and saved 2,000 hours of clinical time; and that staff contact the service desk, agree a collection point, receive a code and collect their device from the locker. The service desk still triages first; the hours saved are clinicians', not IT staff's. Dated only as the April 2025 edition.

An employer has put it into production. Can move the baseline — weighted by scale and how similar the setting is.

The casino company's own filing about a cyber incident. It says it identified suspicious activity in its network resulting from a social engineering attack on an outsourced IT support vendor used by the company, and that on 7 September 2023 it determined the attacker had acquired a copy of its loyalty programme database, including driver's licence and social security numbers for a significant number of members; customer-facing operations were not affected. It does not describe how the vendor's staff were deceived or what verification they used.

Failure, rollback, regulation or cost is suppressing adoption. Can lower an assessment or widen its uncertainty.

A commissioned sector study, not a measurement, and the mechanism it names is the part worth keeping. Only one of its three routes is a machine doing the work: AI automating help desk answers and ticket routing. The other two are reorganisation — under Agile and CI/CD the development function takes over maintaining software and overseeing transition and testing, and under SaaS or PaaS the service provider takes over maintaining and updating the software, 'reducing the manpower needed for the in-house capability'. The report's own sentence is that there will be a decreasing need for stand-alone roles because the tasks will be 'subsumed under the Applications Development or DevOps team's job tasks' (for applications support; for systems support, 'under the DevOps team's job tasks'). Work moving to a different team is not the same event as work being automated, and a retelling flattens exactly that difference. Dated October 2022 on analysis dated December 2020, so written before generative AI reached the public — which matters because the help-desk automation it describes is ticket routing and canned answers, not a chat model. Singapore's infocomm workforce only; stakeholder interviews, not employment data.

A named person with standing publicly predicted something, on a date, in an attributable statement. It is recorded so that who said what, and when, stays checkable — and it never moves a task's assessment, because a prediction is not an observation. Its value arrives later: the record sits on the same page as the evidence about that occupation, so anyone reading the forecast reads the record of what happened next beside it. That is the reckoning; this site publishes no verdict on whether a forecast came true.

The entry is the department's own submission to the statutory inventory OMB publishes under the Advancing American AI Act, so the publisher here is the employer describing a deployment it runs, not a vendor or a journalist. The entry gives its operational date only as a month, 09/2019, so it is recorded as the first of that month; the reported date is the April 2026 data upload, which the repository README dates as of 13 April 2026. Read across the whole 2025 file and hand-filtered to genuine IT service-desk use cases, the same inventory holds 12 deployed across 6 agencies, 4 pilots, 26 in pre-deployment across 11 agencies and 1 retired — more are waiting than are running. What the entry does not give is any headcount figure, and it records no measurement of what share of the queue the system closes. Because this deployment predates public generative models by three years, it is evidence about ticket triage automation, not about language models.

An employer has put it into production. Can move the baseline — weighted by scale and how similar the setting is.

This has been one of the main doors into technology work for thirty years, and it is the door with the clearest automation mechanism pointed at it — the easy tickets are the ones that hire beginners. The route through is unchanged in shape but shorter in time: get to the tickets nobody can script, and get named on the tooling that closes the rest, because operating the automation is the version of this job that is being funded.

Your organisation will size the team on ticket volume and then automate the volume. The argument that works is not that the tickets are hard, it is that the metric stopped describing the work — and it has to be made before the headcount is set, because afterwards you are arguing against a number that already looks good.

Reshape the role

Own the automation instead of competing with it

Someone has to decide which tickets the system may close by itself and what it does when it is unsure, and the only person who knows is whoever worked the queue.

Adjacent move

Cross into security operations

Attackers call the desk directly to get passwords reset and MFA moved, US and allied cyber agencies warn, so you already have the context a security team needs: what a normal request from this company looks like.

The repeat half of the queue has the clearest automation mechanism of any office task: narrow problem, known resolution sequence, and success that a machine can check — the account unlocks or it does not, so a system can retry unattended. The long tail does not, because it starts from a user's description that is confident and wrong about a key detail. What that produces is not a smaller version of this job but a harder one, and teams sized on ticket volume that automate the volume usually discover the metric stopped describing the work.

No date. Sort last month's tickets into two piles: the ones where a machine can tell whether the fix worked, and the ones where only a person can. The first pile is what the tooling will take and the ratio between the piles is your exposure — you can compute it this afternoon, and it is far more informative than any industry figure because it is about your queue and not an average of everyone's.

A large share, and worth noticing that this happened before any model arrived — password self-service has been standard for years. That matters for reading the current wave correctly: the easy tickets were already being taken, and what language models add is handling the ones where the user cannot describe the problem in the portal's categories. The direction is the same as it has been for a decade; what changed is the pace.

Partly — a university and an NHS trust have moved the hand-over of devices to self-service lockers, while the repair and preparation of the kit stay with people. But the hand-over is the part the lockers took, so what stays is the repair rather than the walk to the desk. Measure what share of your own week it actually is before treating it as a plan.