{ "source": "Cooked Index — occupational AI risk register", "page": "https://cookedindex.com/jobs/computer-user-support-specialists/", "methodology": "https://cookedindex.com/methodology", "notice": "Verdicts are re-examined as evidence accumulates. Re-fetch before relying on this; the page above always carries the current score.", "scored_at": "2026-08-11", "model": "claude-opus-5", "occupation": { "title": "Computer User Support Specialists", "soc_code": "15-1232", "category": "Tech", "us_employment": 717190, "median_annual_wage": 61860 }, "verdict": "COOKED", "risk_resistance": 30, "contested": false, "near_boundary": false, "dimensions": { "task_resistance": 6, "embodiment": 10, "liability_shield": 1, "trust_premium": 7, "judgment_accountability": 6 }, "reasoning": { "task_resistance": "Password resets, MFA re-enrollment, mailbox permission changes, VPN client reinstalls and Tier-1 triage against a documented runbook are exactly the pattern-matched, text-in/text-out steps that self-service portals and LLM agents in the ticketing system now close without a human touching the queue — a 6 rather than a 2 only because Tier-2 escalation work like reproducing an intermittent Outlook profile corruption or an obscure line-of-business app conflict still needs someone poking around a live machine.", "embodiment": "A real fraction of the week is racking a replacement laptop, imaging it via PXE, running cable to a new desk, clearing a paper jam, or standing in a conference room fixing the HDMI/Teams Room panel before a meeting starts — that is hands-on work, but it happens in offices and wiring closets on known hardware, not in the weather or on a factory floor, which caps it at 10 rather than the high teens.", "liability_shield": "There is no state licence to hold: A+, ITIL or Microsoft certs are hiring filters that any employer can waive, and when a bad change deletes a user's mail store the exposure runs to the company and the IT manager who approved the process, not to the tech who executed the ticket — hence a 1, not a 5.", "trust_premium": "Named support for a specific floor, department or executive builds genuine goodwill — people ask for you by name and will wait for you rather than open a ticket — but the ticket is closed on the fix, not the relationship, and a competent replacement inherits the queue in a week, so this sits at 7 instead of the 13+ of an advisor whose client leaves with them.", "judgment_accountability": "The decisions are bounded by the runbook, the SLA clock and the escalation matrix: you choose whether to reimage or repair, whether to escalate to networking or to the app owner, but you don't authorise the spend, approve the access, or own the outage postmortem — that discretion is real enough to keep it off the floor and narrow enough to keep it at 6." }, "rationale": "The modal help desk role is ticket triage, password and access resets, walking users through known fixes, and writing up knowledge-base articles — all text-and-screen work that chatbots plus automated provisioning already handle at acceptable quality, and ticket volume per agent has been falling for years. What holds is the deskside tier: physically imaging and swapping laptops, chasing docking stations and printers, and sitting with the executive or the frustrated user who will not self-serve. No license protects the job and the accountability sits with IT management, not the technician.", "outlook": "Headcount contracts significantly over ten years as self-service and automated provisioning absorb tier-1 volume; what remains is a smaller, more technical deskside and endpoint-engineering workforce.", "what_would_raise_it": { "levers": [ { "dimension": "embodiment", "change": "If enterprises keep pushing device refresh cycles and hardware-attestation-based zero-trust (e.g. TPM enrollment, FIDO2 hardware key issuance requiring in-person identity proofing per NIST SP 800-63 IAL2), the residual job becomes physical asset handling and in-person identity verification that no remote agent can do", "plausibility": "already happening", "would_add": 4 }, { "dimension": "task_resistance", "change": "If tier-1 password resets and known-fix walkthroughs are fully absorbed by chatbots and self-service provisioning, the remaining ticket mix is undocumented multi-system failures, OT/lab equipment, and escalation triage — a genuine two-tier occupation where the surviving tier is diagnostic judgment. Watch headcount ratios of deskside to remote agents in large employers", "plausibility": "already happening", "would_add": 4 }, { "dimension": "judgment_accountability", "change": "If support staff are formally designated as first responders in incident-response plans under SEC cyber disclosure rules or state breach-notification law — i.e. the technician's call on whether a ticket is a security incident starts the notification clock — the role owns a consequential ambiguous decision", "plausibility": "plausible", "would_add": 4 }, { "dimension": "liability_shield", "change": "Narrow route only: if cyber-insurance policies or HIPAA/CMMC audit requirements begin naming a credentialed individual (e.g. CompTIA/vendor-certified admin) who must attest that endpoint remediation and access changes were performed and reviewed, some personal attestation attaches. Certifications today carry no personal liability, so this is weak", "plausibility": "unlikely", "would_add": 2 }, { "dimension": "trust_premium", "change": "Only in the white-glove executive-support and MSP-retainer segment, where clients contract for a named onsite person rather than a pooled queue. Watch for SLA language specifying a dedicated named technician. This does not generalize to the mass help desk", "plausibility": "plausible", "would_add": 2 } ], "ceiling_note": "Realistic ceiling is around 45-50. There is no licensing body, no signature requirement, and buyers of bulk IT support have spent two decades explicitly optimizing for lowest cost per ticket — the opposite of a trust premium. Gains concentrate in the deskside and identity-proofing tier, which is a minority of current headcount, so the occupation can become more resistant per worker while employing far fewer workers." }, "adjudication": null, "employment_history": { "points": [ { "y": 2019, "emp": 647330, "wage": 52270 }, { "y": 2020, "emp": 634820, "wage": 52690 }, { "y": 2021, "emp": 654310, "wage": 49770 }, { "y": 2022, "emp": 696830, "wage": 57890 }, { "y": 2023, "emp": 689700, "wage": 59240 }, { "y": 2024, "emp": 697210, "wage": 60340 }, { "y": 2025, "emp": 717190, "wage": 61860 } ], "from": 2019, "to": 2025, "change_pct": 10.8, "comparable_from": 2019, "spans_soc_revision": false }, "pivots": [ { "slug": "network-and-computer-systems-administrators", "title": "Network and Computer Systems Administrators", "verdict": "EXPOSED", "risk_resistance": 40, "median_wage": 99130, "overlap": 77, "skills_to_close": [ "Programming", "Equipment Selection", "Equipment Maintenance", "Repairing" ] }, { "slug": "electrical-and-electronics-repairers-commercial-and-industrial-equipment", "title": "Electrical and Electronics Repairers, Commercial and Industrial Equipment", "verdict": "SAFE", "risk_resistance": 67, "median_wage": 74090, "overlap": 62, "skills_to_close": [ "Repairing", "Equipment Maintenance", "Equipment Selection", "Science" ] } ], "license": "https://cookedindex.com/terms" }