I've documented and escalated 498 product defects to R&D. 315 of them reached DONE.
Every one went in with logs, artifacts, and reproduction steps.
Engineers fix what they can reproduce. Make them guess and your ticket dies in the backlog.
Here's the part that matters for threat work: sometimes what let the attack through isn't the attacker's skill. It's a bug in your defenses. You only find that if you investigate your own tools with the same suspicion you give the threat.
Treat your security stack like a witness, not a judge.