By Daniel Breston (BatDan) — Industry Ambassador, SDI & itSMF UK
The phones are ringing.
Not one or two. All of them. And the chat queue is moving faster than anyone can read it.
Something has happened. Nobody knows what yet. But Alex, a service desk analyst, has a theory about why things have gone terribly wrong. Not because a dashboard flagged it. Because Alex has been watching the pattern for the last forty minutes, and the pattern doesn’t lie.
Alex picks up the next call.
This article is for the service desk manager who has an Alex on their team and hasn’t recognised it yet. It is also for all the Alex’s in our ITSM industry.
I have been in this industry since 1972. Long before it was called ITSM, we were doing exactly this work: answering the phones, holding the line, absorbing the chaos so the business could keep moving. I have held roles from shift supervisor to head of service operations to CIO. I have seen service desks that were the beating heart of an organisation, and I have seen service desks that were treated as a dumping ground.
The difference was never the technology. It was never the framework. It was always the people, and specifically, whether the people running the desk believed they had the skills to interrogate, escalate and be believed. The difference was the leadership culture.
The SDI’s Global Best Practice Standard Version 9 knows this. It says so plainly, in Concepts 3, 6 and 9. It talks about inclusion, belonging, challenger safety, neurodiversity and psychological well-being. The standard has done its job by being written and shared with the community.
But writing it down and living it are two very different things.
This is a story about the gap between them.
It is 9:47 on a Tuesday morning.
The service desk is staffed as normal. Twelve analysts. Two team leaders. The queue is manageable. Nothing unusual on the overnight report.
And then the phones start.
Joe has been on the service desk for three years. He is reliable, conscientious, and well-liked. He follows the process. He logs every call correctly. He meets his targets. When the phones start ringing harder than usual this Tuesday morning, Joe does what the process says; he answers the next call, logs it, resolves what he can, escalates what he cannot, and moves on to the next one.
By 10:15, Joe has handled eleven calls. All logged correctly. All within SLA. Joe is doing his job well.
Alex has been on the service desk for eighteen months. Alex is harder to read and quieter in team meetings. Occasionally, Alex asks questions that seem obvious to everyone else or spots things nobody else has noticed. Alex’s call handling time runs a little longer than average because Alex tends to ask one or two extra questions before closing a ticket. The last performance review noted this as an area for improvement.
By 10:15, Alex has handled seven calls. Also logged correctly. But Alex has done something else.
Alex has been keeping count.
Not formally. Not on a spreadsheet. Just counting. Noticing. The calls are not random. Three people can’t access their accounts. Two people are seeing error messages on the same system. One person mentioned they’d had an email that looked strange. Alex doesn’t know what this means yet. But Alex knows it means something.
At 10:17, Alex goes to the team leader.
“I think something bigger is happening. The calls aren’t coincidences.”
The team leader glances at the dashboard. Nothing flagged. Queue is busy but within range. “Keep going. We’ll see how it develops.”
Alex goes back to the desk.
By 10:45, the volume has doubled. The pattern Alex spotted at 10:17 is now visible to everyone. By 11:00, it has a name: a cybersecurity incident. A phishing campaign has compromised credentials across three business units. The phones are not slowing down.
A major incident is declared. And the service desk (twelve analysts and two team leaders) becomes the front line of a crisis that will run for six hours.
Joe handles it well. He is calm, methodical, and reassuring. He logs every interaction. He follows the major incident procedure. He does everything right.
Alex does something different.
Alex starts recognising callers. Not by name, by pattern. Three people from the same department calling within twenty minutes. Alex flags it to the incident team: “I think the infection vector might be that department. They’re all seeing the same thing.” The incident team investigates. Alex is right. It narrows the scope of the response by two hours.
Nobody calls Alex a hero that day.
The post-incident report notes the strong team performance. It mentions the early escalation attributed to the monitoring system. It doesn’t mention the analyst who spotted the pattern before the monitoring system did.
Alex goes home, but does it again tomorrow.
This is not a story about a superpower.
I want to be careful here, because I have heard people describe minds like Alex’s as superpowers, and I think that framing, however well-intentioned, misses the point.
Alex is not a superhero. Alex is a service desk analyst who thinks differently; who notices things others don’t, who carries a heavier cognitive load than the performance metrics acknowledge, and who is assessed by a system that was designed around Joe.
That system is not wrong to value Joe. Joe is excellent. Joe is exactly what a well-run service desk needs.
But it is wrong to measure Alex by Joe’s yardstick. And it is wrong to mark Alex down for the extra questions, the slower handle time, the pattern recognition that doesn’t fit neatly into a category on the logging form.
The SDI Standard in Concept 3.12 calls for organisations to incorporate “culture, neurodiversity, and personality type” into how they communicate with and manage their people. In Concept 6.8 it calls for a culture where employees feel comfortable being themselves and sharing their unique viewpoint.
Alex has a unique viewpoint. The question is whether the organisation has created the conditions for it to be heard and rewarded.
What does a service desk look like when it does this well?
It looks like a team leader who, at 10:17 on a Tuesday morning, hears “I think something bigger is happening” and says: “Tell me more. What are you seeing?”
It looks like a performance review that asks not only how fast Alex closes tickets, but what Alex notices that nobody else does.
It looks like a manager who understands that the extra questions Alex asks are not inefficiency. They are investment.
It looks like an organisation that updates the monitoring tool such that the next time they are ready to respond far earlier than this incident.
It looks like a culture (and the SDI Standard uses that exact word) where challenger safety is real. Where an analyst can say “the pattern doesn’t fit” without needing to be right about it, because the act of saying it is valued regardless.
This is not soft. This is not a wellbeing initiative bolted onto the side of operations. This is what the standard describes as world-class. The difference between a reactive service desk and a business-led one is precisely this: whether the people on the front line are enabled to share what they know.
Alex knows things. Are you listening?
A word about Joe.
Joe is not the villain of this story. I want to make that clear. Joe is good at his job, and the service desk needs Joe.
But here is something worth sitting with: on the day of the cybersecurity incident, Joe handled the calls correctly and Alex changed the outcome. Both matter. A healthy service desk needs both.
The risk is not that we have Joes on our teams. The risk is that we build systems, processes, and performance frameworks that only recognise Joes, and in doing so, we either lose our Alex or we prevent them from contributing what they have to offer.
That is not a people problem. That is a leadership problem.
I know, because I was one of those leaders for longer than I’d like to admit.
At SPARK26, the SDI’s annual conference, several individuals mentioned how people bring different strengths to service environments. How some analysts see patterns, absorb detail, or notice what others miss, in ways that don’t always show up in standard performance metrics.
The sessions always went quiet in a particular way as they pondered their environment and what they were experiencing. The quiet reflected their culture.
I have worked in this industry for over fifty years. I am not a specialist in human psychology or clinical assessment. I am an ITSM veteran. I was privileged to recognise (finally) that I needed to do what Sherlock Holmes suggested: I needed to observe and not just see.
Some of the best people I ever worked with on the service desks thought differently from the majority. They weren’t always the highest scorers on the metrics. They weren’t always the easiest to manage. But when something unexpected happened – a major incident, a crisis, a pattern that didn’t fit – they were the ones who saw it first.
And too often, we (I) had already managed them out.
The SDI Standard Version 9 gives us the framework. It names what good looks like. It talks about challenger safety, inclusion, belonging, neurodiversity, and psychological well-being. It describes a world-class service desk as one where employees feel valued, heard, and enabled to contribute fully.
The standard has done its job.
Now the question is whether we, as leaders, do ours.
Here are three things a service desk manager can do:
- Listen to learn. When an analyst says “something doesn’t feel right,” treat it as data, not noise. Ask what they’re observing that others aren’t seeing. You don’t have to act on every instinct, but you do have to create the conditions in which instincts can be shared.
- Review your metrics honestly. Are your performance measures capturing everything of value that happens on your service desk? Alex’s pattern recognition didn’t appear on any dashboard, but it shortened a major incident by two hours.
- Look at who you’re losing. Staff turnover data is in the standard – Concept 8.38. But the number doesn’t tell you who walked out the door. It doesn’t tell you whether the analyst who quietly resigned last quarter was your next Alex, ground down by a system that couldn’t see them
The service desk is, as the SDI Standard says, a strategic practice at the heart of business operations.
That is not just a sentence in a framework document. It is true every time an analyst picks up the phone. It was true on Tuesday morning when Alex spotted the pattern. It will be true tomorrow.
The phones are ringing.
Someone is watching the pattern. Counting the calls. Noticing what the dashboard hasn’t flagged yet.
The question is not whether you have an Alex.
You do.
Want more from Daniel? Read his thoughts on combating technostress via leadership and XLAs here.
