Some tickets are not yours to fix. A suspected compromised account belongs with Security, and escalating it is the correct answer that the simulator scores as such.
Escalating a ticket you could have handled yourself loses points. The confirmation says so before you commit: This escalates the ticket to the Security Team. Only do this for genuine security issues. Escalating a routine ticket loses points.
Escalate
- Open the ticket.
- Open the options menu on the ticket and choose Escalate.
- A confirmation appears with the warning above.
- Select Escalate to confirm.
There is no team to choose. Escalation always goes to the Security Team, which is why the confirmation names it for you.
What happens next
Escalating finishes the ticket. It is marked as escalated, leaves your queue, drops out of the Incidents list, and you are returned to the dashboard.
You do not close it afterwards. There is no extra step. The ticket appears in Past Tickets like any other finished ticket.
Escalating too early
On a couple of ticket types, escalating before you have secured the account is premature, and the app tells you what is still outstanding rather than silently refusing. You can still escalate anyway, and the confirmation makes that explicit, but the handler penalises it.
If you get that warning, read what it says is pending. Doing that step first is almost always the higher-scoring path.
When escalating is the right call
The clearest case is a suspected account compromise. If a mailbox is sending mail the owner did not send, the fix is not to remove the forwarding rule and move on. The rule is a symptom, and disabling it leaves the attacker’s access in place. That kind of ticket is meant to go to the Security Team so credentials can be reset and the access investigated.
If you are unsure whether a ticket is yours, the hint panel will tell you. Taking a hint costs nothing, and it costs less than an escalation penalty.