Create phishing incident tickets for on-call engineers before SLAs lapse

Your channel reaction flags become untracked phishing reports, delaying triage and containment. Security engineers get a prioritized incident and alert so containment starts before outreach SLAs lapse.