Hello everyone,
Before focusing entirely on the ServiceNow ecosystem, I spent time studying cybersecurity and doing some penetration testing. One of the biggest lessons that experience taught me is that it's one thing to learn how to build something, but it's an entirely different thing to learn how not to build it.
When we design architecture, it is easy to assume that everyone interacting with our application is a standard consumer or a well-intentioned user. But they could just as easily be an intruder. Designing for misuse—not just expected use—is a critical step that should never be overlooked.
I recently built a custom Security Incident Automated Response Framework. Because I am developing this in a personal environment without an enterprise corporate network, I am leveraging custom API-driven simulations to trigger the workflow. The goal was to integrate generative AI to automate incident triage.
While the happy path works flawlessly, I wanted to stress-test the architecture. In the attached video, I walk through the custom action and demonstrate how the workflow breaks down when faced with:
Unescaped double quotes breaking the JSON payload.
Injected HTML tags crashing the REST step.
Direct prompt injections attempting to jailbreak the AI.
I would love to hear your thoughts on this architecture and please let me know where I can improve on this approach!
I am currently waiting for my instance to come off the waitlist, but hopefully, once it is back up, I will be sharing Part 2 where we engineer the exact script logic to sanitize these inputs.
delay.
https://www.linkedin.com/posts/yaaseen-sheriff_servicenow-secops-artificialintelligence-ugcPost-7482...
