a company may very well consider this a “security incident” or other high-priority issue, but at least in my experience, the method of reporting something like this can be vague. While the right answer should be a place to submit a ticket, even internal systems nowadays seem to not let the users set the priority on tickets and instead let L1s try to resolve everything, who may not have the experience to recognize something needs to be elevated. At that point, it seems the only good option is to run the issue up the chain and back down through the right department (which is probably more effective, at the end of the day).