## TL;DR
A support ticket becomes a security issue the moment it involves unauthorized access, exposed customer data, compromised credentials, or a reported vulnerability. When that happens, stop normal handling: secure first, pull in the security team, and watch what you put in writing. Speed matters, but the wrong fast move (like telling the customer details) can make it worse.

## The query

```text
when a support issue becomes a security issue
```

## Use this when

- A ticket mentions unauthorized access or a breach
- Customer data may have been exposed
- Someone reports a vulnerability in your product
- You are writing the security-escalation policy

## Not for

- Conducting the security investigation itself
- Writing public security advisories
- Penetration testing or vuln hunting
- Deciding legal disclosure obligations (that is legal's call)

## Steps

### 1. Learn the signals that flip a ticket to security

Unauthorized logins the customer didnt make, data visible to the wrong account, credentials or sessions behaving impossibly, a customer describing how they bypassed your access controls, or any report of exposed personal data. When in doubt, treat it as security and let the security team downgrade it.

Expected output: agents recognize the flip and stop routine handling.

### 2. Secure first, investigate second

Help the customer lock down their account immediately: password reset, session revocation, review of recent activity. Containment before curiosity. Dont go poking at the vulnerability yourself to "confirm" it.

Expected output: the customer's exposure is contained within minutes.

### 3. Pull in security through the defined channel

Every team needs one: a security alias, a page, a form. Use it, dont DM an engineer you know. Include the ticket link, what was observed, and what containment you already did. Then step back and follow their lead.

Expected output: the security team owns the ticket within the hour.

### 4. Control what goes in writing

Log facts, not theories. "Customer reports login from an unrecognized device at [time]" is fine; "we have been breached" is not yours to write. And never describe vulnerability details to the customer or in the public ticket thread.

Expected output: a factual record with no speculation and no leaked details.

### 5. Keep the customer updated on process, not findings

Tell them what is happening ("our security team is reviewing this, I will update you by [time]"), not what the team finds. Findings get communicated through the security team's approved wording, not through support improvisation.

Expected output: the customer feels attended to without receiving unvetted information.

## Variant phrasings

### how to escalate a security issue from support

Steps 2 and 3. Contain, then route through the defined channel.

### support ticket security incident signs

Step 1. The signal list is the whole skill for triage agents.

### what support should do during a data breach

Steps 2, 4, and 5. Contain, document carefully, communicate process only.

## Why it happens

Support is the front door, so security issues arrive disguised as ordinary tickets: a "weird login" here, a "my data looks wrong" there. Agents miss the flip because nothing in normal ticket handling prepares them for it. A written signal list plus a defined channel turns a judgment call into a reflex.

## Edge cases

- The reporter is a security researcher: thank them, route to security immediately, dont debate the finding. Researchers go public when they feel ignored.
- The customer caused it (shared their password): still a security ticket. Secure the account first, educate second, never lecture.
- You are not sure it is security: escalate anyway. False alarms cost an hour; missed breaches cost the company.
- The issue affects many customers: this is now an incident, not a ticket. Follow the incident process and loop in leadership.
- Legal or compliance gets involved: hand them the factual ticket record from step 4. That clean log is exactly what they need.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_Rlq0u5saX5hUtzYt0JS5mQ