Create incident to-dos from security tickets before standup

Your incident tickets from the incident inbox land untriaged, causing delayed containment and missed security SLAs. Engineers get assigned to-dos and ownership so containment happens before the next workday.