Skip to main content
A Security desk has an unusual constraint: the requests you most want are the ones people are most reluctant to file. Someone who clicked a link is deciding whether reporting it is worse than staying quiet. Every design decision here should reduce that friction.

​
What Security owns in Ravenna

Incident intake

A reporting path so easy that people use it, wired to on-call.

Access reviews

Who has what, reviewed on a schedule, with the trail to prove it.

​
Suggested shape

Two surfaces, deliberately different:
  • A public channel for reporting. #security should be somewhere anyone can post without asking permission, because a private workspace adds a step exactly where you cannot afford one.
  • Private tickets for anything under investigation. This is how you get open reporting without the investigation being visible to the company.
Every workspace member can see every private ticket in their workspace. Private tickets hide an investigation from the wider company, not from the Security team. If you need a genuinely restricted subset, that is a separate workspace with a smaller membership.
Learn more about private tickets and Portal and privacy

​
Integrations that change the response

The on-call integrations matter more than they look. Both check live schedule data every time a workflow runs, so an escalation routes to the person on the rotation rather than to whoever the workflow author knew in March.

​
The agent’s role, and its hard limit

An agent is genuinely useful here for the documented questions: what counts as a reportable incident, how to report a phishing email, what the password policy is, whether a tool is approved. It has one absolute limit. It must never assess whether something is a real incident, tell someone a message is safe, or reassure a reporter. A false negative on a phishing question is a breach.

Answer security policy questions from the knowledge base. Never assess whether a specific message, link, or file is malicious or safe, and never tell a reporter that something is not a problem. For any report of a suspicious message, a lost device, or possible unauthorized access, create a ticket immediately and tell the reporter that Security has been notified.

​
Where Security desks stall

Every barrier between “I think I clicked something” and a filed report costs you reports.
Wipe and recovery key retrieval belong behind approval, always.
If the data is exported, it is stale before the review finishes.
This is the failure mode to test for explicitly.

​
Next

Incident intake

Make reporting the path of least resistance.

Access reviews

Reviews that produce evidence.
Last modified on September 17, 2026