Hi @Valqe ,

Well, none of the options you have quoted is correct unfortunately.

The best fit for your use case is Vulnerability Response application , yes off course it comes with additional charges.

But your solution is like a Workaround or a tactical solution not really a Strategic Solution.

If you really want to move forward with a workaround solution, then go with Solution "a" on your question and just add a field having choice as Issue or Risk, then based on the choice you can run a flow for it's lifecycle.

Issue Triage is not a right fit.