Earlier quoted context omitted.
Only tangentially related but my wife used to work at a private institute research lab which was affiliated with a large university, and therefore used computing resources. The University IT security staff did a great job enabling 2FA across the entire network.. big job, well done. They didn’t do the slightest bit of requirements analysis of those people using the network such as affiliated research labs. One day my…
Great case in point. In a well run org, that would've been elevated to a "security incident" just the same as a hack, with their jobs potentially on the line, rather than a week of pleading to them to have mercy.
a company may very well consider this a “security incident” or other high-priority issue, but at least in my experience, the method of reporting something like this can be vague. While the right answer should be a place to submit a ticket, even internal systems nowadays seem to not let the users set the priority on tickets and instead let L1s try to resolve everything, who may not have the experience to recognize something needs to be elevated. At that point, it seems the only good option is to run the issue up the chain and back down through the right department (which is probably more effective, at the end of the day).