We are excited to welcome you to the Unified Security Exposure Management (USEM) QuickStart Implementation Series, your step-by-step video guide to implementing ServiceNow USEM from the ground up, starting with Vulnerability Response (VR). This s...
Introducing T2 SOC AI Specialist: Your SOC's Newest Analyst Works 24/7 A mature SOC takes 4 hours to contain a security incident. That used to be the gold standard. It no longer is. In that same 4-hour window, lateral movement begins within the fir...
USEM Launch Details USEM - Unified Security Exposure Management - is the next evolution of Vulnerability Response (VR) USEM features are made available in Vulnerability Response v30x Vulnerability Response v30x was officially launched and released...
ServiceNow training and certification sets you and your business up for success, which is why it’s critical to make training an essential part of your ServiceNow program. By building the right skills, you can deliver more value more quickly, increase...
When a vulnerability like PHP2Shell hits the headlines, the clock starts immediately. Leadership wants to know one thing: are we exposed? The two CVEs driving the conversation are currently listed as CVE-2026-109618 and CVE-2026-109619. With Unified ...
PHP2Shell is three problems wearing one name: a security problem, a patch problem, and an enterprise coordination problem. Most organizations solve the first two and fail the third. The security problem Two PHP flaws, each rated 9.2 on CVSS v4.0, all...
Ever wondered why an integration run took three hours, or whether two integrations are fighting for the same queue? I built a small scoped app to help answer those questions. Exposure Management Integration Run Analytics reads your integration run,...
If you're planning to attempt the ServiceNow CIS‑VR (Vulnerability Response) certification, the right preparation strategy makes all the difference. Based on my experience, a structured + smart revision approach works best. Here’s how you can efficie...
Executive Summary Zero-trust architecture represents a fundamental shift in cybersecurity strategy—from perimeter-based defenses to continuous verification of every access request. As organizations grapple with remote workforces, cloud migrations, ...
Security teams are not lacking data. They are lacking time, clarity, and confidence when making decisions under pressure. In Vulnerability Response, analysts and IT remediation owners constantly ask questions such as: Which vulnerabilities are inter...
Welcome to the SecOps Quick Start Guide If you're just starting your Security Operations (SecOps) journey, then you've come to the right place. This guide will help you understand what the SecOps products are, how they work in tandem with our Workspa...
In a Playbook, the OOTB activity “Show List of Records” displays related records, but clicking the Open List button in the Playbook Activity Viewer does nothing in the Security Incident Response (SIR) Workspace. CauseThe PLAYBOOK#OPEN_LIST event is...
TL;DR: CVSS tells you how bad a vulnerability could be. SSVC tells you what you should actually do about it — right now, given your exposure. If your patch queue is still sorted by CVSS score alone, this article explains what you're missing and how t...
Overview Vulnerability Response Integration with Wiz supports multiple integration instances against the same Wiz tenant. Each instance has its own configuration, its own copy of the Wiz integrations, and its own schedule and run history. This exampl...
We are excited to welcome you to the Unified Security Exposure Management (USEM) QuickStart Implementation Series, your step-by-step video guide to implementing ServiceNow USEM from the ground up, starting with Vulnerability Response (VR). This s...
In 2026, AI accelerated both the ability for attackers to strike faster and stronger, and defenders to respond faster and more comprehensively. Recent incidents, including AI agents that autonomously coordinated to breach infrastructure at Hugging Fa...
With the September release, AI security findings from Wiz flow directly into Unified Security Exposure Management (USEM) alongside every other exposure your team already works. What you need to install Pre-requisite: You should have migrated your V...
We're excited to introduce enhancements to the Wiz Container Vulnerability Response (CVR) integrations that provide richer runtime context for vulnerable container images and remove previous deployment-scale limitations. What's New? We've introd...
When a modal is configured to display a record form, the message "Component is not configure" appears the moment the modal is triggered. The component is configured. What happens is that the modal renders before the Form Controller has finished resol...
From an Application Vulnerable Item (sn_vul_app_vulnerability) record, a modal had to open a new record form (Story table) with the Configuration Item field already filled in with the CI from the source AVUL record. Event handlers of the "set field v...
Continuing the "Success with VR" webinar series, this webinar highlights how Container Vulnerability Response and Configuration Compliance is configured, as well as how end users will remediate and have oversight on container vulnerabilities. John ...
When running the Recommend Solutions skill on Remediation Task (VUL) records, the job sometimes returns 0 VITs processed and 0 solutions found, even though the remediation task contains multiple Vulnerable Items (VITs). The Problem: The skill faile...
When migrating dashboards and reports from development to production in a ServiceNow scoped application with Application Administration enabled (true), the dashboards may become inaccessible to end users, even though sharing permissions are set corre...
We've been hearing more interest lately from customers asking whether Unified Security and Exposure Management (USEM) could be exposed as an MCP (Model Context Protocol) server. Before we go further, we want to make sure we're solving the right pro...
Sarah Wood
ServiceNow
LisaLatour
Mary Hain
Steph Morillo
