We are excited to welcome you to the Unified Security Exposure Management (USEM) QuickStart Implementation Series, your step-by-step video guide to implementing ServiceNow USEM from the ground up, starting with Vulnerability Response (VR). This s...
Security teams are not lacking data. They are lacking a shared context. A modern vulnerability program produces huge volumes of findings every week, and three very different personas are trying to make sense of them. The vulnerability analyst need...
Introducing T2 SOC AI Specialist: Your SOC's Newest Analyst Works 24/7 A mature SOC takes 4 hours to contain a security incident. That used to be the gold standard. It no longer is. In that same 4-hour window, lateral movement begins within the fir...
ServiceNow's Security & Risk Customer Community Event: Nexus Security & Risk As AI reshapes the security and risk landscape, staying connected with the community tackling these challenges has never been more important. We'd like to invite our Servi...
USEM Launch Details USEM - Unified Security Exposure Management - is the next evolution of Vulnerability Response (VR) USEM features are made available in Vulnerability Response v30x Vulnerability Response v30x was officially launched and released...
We are excited to welcome you to the Unified Security Exposure Management (USEM) QuickStart Implementation Series, your step-by-step video guide to implementing ServiceNow USEM from the ground up, starting with Vulnerability Response (VR). This s...
When running the Recommend Solutions skill on Remediation Task (VUL) records, the job sometimes returns 0 VITs processed and 0 solutions found, even though the remediation task contains multiple Vulnerable Items (VITs). The Problem: The skill faile...
When migrating dashboards and reports from development to production in a ServiceNow scoped application with Application Administration enabled (true), the dashboards may become inaccessible to end users, even though sharing permissions are set corre...
We've been hearing more interest lately from customers asking whether Unified Security and Exposure Management (USEM) could be exposed as an MCP (Model Context Protocol) server. Before we go further, we want to make sure we're solving the right pro...
If you're extending a VR Integration Framework processor (Wiz CC, Qualys CC or any processor built on sn_vulc.ComplianceTestResultBase) and want a new field to show up on the Test Result record, there's one pattern to know and one gotcha that trips a...
If you're planning to attempt the ServiceNow CIS‑VR (Vulnerability Response) certification, the right preparation strategy makes all the difference. Based on my experience, a structured + smart revision approach works best. Here’s how you can efficie...
Caveat: This article is not limited to just SecOps products but rather spans beyond to other product portfolios that operate on the ServiceNow Platform. I am simply publishing here because of my familiarity with SecOps and love for that product suit...
Financial institutions and enterprise organizations face a massive structural shift in the cyber threat landscape. Ransomware does not ride on secret infrastructure or hidden tunnels. It uses your routers, DNS, and the exact same internet backbone yo...
At the Knowledge Conference in May, the AI Kill Switch was demonstrated. Several of our Security Operations customers and partners have inquired about this feature because they are concerned about Agentic Workflows or AI Agents that are misconfigured...
Summary In the Security Exposure Management (Exposure Assessment) workspace, custom columns added to the Exposure Assessment list (Assess by CVE) are lost when you sort by any column. This article documents the symptom and the validated fix: setting ...
Overview When configuring a Microsoft Defender incident profile in Security Incident Response (SIR) to ingest incidents into the platform, the profile exposes a Pull Closed Incidents option. This is a binary control: it either includes or excludes in...
If your organization is looking down the barrel of a ServiceNow SecOps License renewal within the next 12 months, the landscape has fundamentally shifted. Back in April 2026, ServiceNow restructured the licensing and packaging rules for Security Oper...
Security teams are not lacking data. They are lacking a shared context. A modern vulnerability program produces huge volumes of findings every week, and three very different personas are trying to make sense of them. The vulnerability analyst need...
Introducing T2 SOC AI Specialist: Your SOC's Newest Analyst Works 24/7 A mature SOC takes 4 hours to contain a security incident. That used to be the gold standard. It no longer is. In that same 4-hour window, lateral movement begins within the fir...
After migrating to Vulnerability Response v30x — the version that introduces Unified Security Exposure Management (USEM), a significant architectural upgrade to the Vulnerability Response applications — some teams report that legacy deferral/exceptio...
When a user clicks Generate Insights in the Security Exposure Management (USEM), Now Assist may return "There was a problem generating content." and in the log (syslog) shows Dashboard not found: <sys_id> — yet the dashboard record clearly exists whe...
Introduction Artificial intelligence is transforming how organizations operate—but it's also introducing a new class of security risks that traditional tools can't address. From shadow AI running on employee laptops to misconfigured AI agents in low-...
Stay on top of AI security with AI Security Exposure Management A new module that brings AI security findings into ServiceNow, so you can manage them with the same efficiency as the rest of your security workflows. Introduction AI is reshaping t...
As you explore USEM (VR v30x), either as an existing customer that has recently migrated or as a brand new customer starting your journey, you will need to make a plan for managing and promoting your configurations (aka USEM rules) between Service...
Now that AI is native to ServiceNow SecOps products and no longer an add-on, a question that I have been receiving frequently is around how to prevent AI from being activated or utilized in their ServiceNow instance until they are ready. The concer...
Sarah Wood
ServiceNow
LisaLatour
Mary Hain
Steph Morillo
