--- sourceDocument: Zurich Security Management sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/security-management Release : - zurich ft:locale : - en-US ft:publication_title : - Zurich Security Management ft:clusterId : - security bundleId : - security workflow : - Technology --- # Explore # Exploring exposure assessment {#ariaid-title1} Release version: Zurich Updated July 31, 2025 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 5 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Exploring exposure assessment Exposure assessment in ServiceNow uses the Common Platform Enumeration (CPE) framework, part of the Common Vulnerabilities and Exposures (CVEs) system, to evaluate your assets' vulnerability exposure. This is achieved by mapping relevant CPEs to the software discovery model via a matching algorithm, allowing identification of potential exposures. This method helps detect vulnerabilities that traditional scanners might miss, including zero-day vulnerabilities, providing early warning to improve vulnerability management. Show full answer Show less ## Prerequisites and Compatibility * Required applications include Vulnerability Response (version 20.0 or later) with related plugins (e.g., Crisis Management, NVD, CISA integrations). * Basic or Professional Software Asset Management (SAM) plugins are necessary to manage software and asset data. * The Exposure Assessment module depends on data from software discovery models and software installations within the ServiceNow AI Platform® instance. * Ensure the SAM Foundation application (com.snc.assetmanagement) is installed and populated with data. ## Use Cases for Exposure Assessment * **Assess by CVE:** Understand exposure and impact on systems by mapping CVEs using SAM and Discovery data, enabling prompt remediation through manual Vulnerability Incident Tasks (VITs). * **Assess by Software:** Evaluate impact when CVEs are unavailable to identify affected configuration items (CIs), allowing proactive response to zero-day or critical vulnerabilities. * **Assess by Publisher:** Analyze vulnerabilities by software vendor within a timeframe to understand vendor risk and prioritize remediation. ## Matching Algorithm and Data Management The matching algorithm uses several fields from software discovery models (vendor, product, version, publisher, edition) to normalize and reconcile software data, particularly with SAM Professional. This enables accurate linkage between discovered software and vulnerability data. ## System Configuration and Scheduled Jobs * A system property (snvulanalyst.enableexposureforcisa) controls automatic processing of CISA-exploited vulnerabilities. * Scheduled jobs run regularly to update and process exposure data, including: * Checking potential vulnerability exposure every 12 hours. * On-demand insertion and calculation of exposure for CISA CVEs and software records. ## Key Terms and Practical Considerations * **Confidence score:** Measures reliability of recommendations for fields in the exposure assessment. * **Software installation count:** Indicates the number of software assets impacted by a vulnerability, factoring in active vs inactive installations based on system property settings. * From Vulnerability Response version 22.0, inactive software installations can be filtered out for exposure reporting to focus on active assets. ## What This Enables You to Do By leveraging exposure assessment, ServiceNow customers can gain a comprehensive and proactive view of their vulnerability exposure using both CVE and software-centric approaches. This capability supports early identification of risks, including zero-day vulnerabilities, improves remediation prioritization, and enhances the maturity of your vulnerability management program by integrating asset and vulnerability data effectively. Exposure assessment uses the Common Platform Enumeration (CPE) framework, which is a part of the Common Vulnerabilities and Exposures (CVEs) system, to evaluate the vulnerability exposure of your assets to vulnerability software. This assessment is performed using a software discovery model. By employing a matching algorithm, the relevant CPEs are associated and mapped to the software discovery model, enabling the identification of potential exposures. You can use the exposure assessment by CVE or software to identify exposure to potential vulnerabilities for the following scenarios: * Vulnerabilities that may not be identified by traditional scanners * Zero-day vulnerabilities before the scanner provide the signature for vulnerability detection {#vr-ws-exposure-assessment__ul_vlw_1tc_cyb}Exposure assessment provides an early warning to remediate these vulnerabilities, and improve the maturity of the vulnerability management program. Prerequisites for exposure assessment{#vr-ws-exposure-assessment__table_qqv_drb_2yb__entry__2} | Application | Version | |-|-| | Vulnerability Crisis Management plugin | 1.0 | | Vulnerability Response | 20.0 | | Vulnerability Response with NVD | 1.3 | | Vulnerability Response Integration with CISA | 1.2 | | Vulnerability Response Integration with NVD Note: For more information, see [National Vulnerability Database (NVD) integration](https://www.servicenow.com/docs/aWcThKlRyB8jEdpXCWtYoA "The NVD integrations use data from the NIST National Vulnerability Database to help you determine the impact and priority of flaws in your code. Run this integration as part of your initial setup of Vulnerability Response and before importing vulnerability data into your instance with a third-party scanner product."). | 1.3 | | Software Asset Management | Basic Software Asset Management or Software Asset Management Professional plugin | [Table 1. Available versions] {#vr-ws-exposure-assessment__table_qqv_drb_2yb} ## Use cases {#vr-ws-exposure-assessment__section_gk1_msm_hpb} For examples of how Vulnerability Analysts organization would use the Vulnerability Exposure Assessment workspace, see these use cases.{#vr-ws-exposure-assessment__table_hk1_msm_hpb__entry__2} | Assessment type | Use | |-|-| | Assess by CVE | Assess vulnerabilities by CVE to gain a full understanding of the impact and exposure of the affected systems using Software Asset Management (SAM) and Discovery data. Take prompt remediation actions by creating manual VITs and assigning them to remediation owners. Assessing by CVEs is beneficial because scanners may not detect all the affected systems, whereas Discovery typically identifies most of the software on the attack surface. | | Assess by Software | Assess the impact by software when CVE is unavailable to identify the number of CIs where the software is installed. By assessing by software, you can proactively act on zero-day or critical vulnerabilities by creating a manual VIT and assigning it to the remediation owner before they're officially published or before scanners identify them. | | Assess by Publisher | Assess vulnerabilities by a software vendor to understand the impact and exposure of affected systems for the CVEs published by the vendor within a time frame. Assessing by publisher helps you evaluate the vendor risk and critical vulnerabilities, enabling proactive remediation. | [ ] {#vr-ws-exposure-assessment__table_hk1_msm_hpb} ## Compatibility and system requirements {#vr-ws-exposure-assessment__section_compatibility_system_req} The Vulnerability Response application is available on the ServiceNow Store. The ITSM Software Asset Management application (com.snc.asset_management) is required for the Exposure Assessment module. This application manages all your assets and software licenses, and the SAM Foundation version of this application is part of the Vulnerability Response application that you download from the ServiceNow Store. Important: The Exposure Assessment application works with the following plugins: * Basic Software Asset Management (com.snc.sams) * Software Asset Management Professional (com.snc.pa.samp) * Software Asset Management plugin (com.snc.software_asset_management) {#vr-ws-exposure-assessment__ul_e1r_xjz_21c} To verify the SAM Foundation application is installed on your instance, navigate to System ApplicationsAll Available ApplicationsAll and search for com.snc.asset_management. If the application isn't installed, select Install. As the Vulnerability Exposure Assessment application requires access to the asset data on your ServiceNow AI Platform® instance, the asset management applications must have data to reference. The Software Discovery Models table (cmdb_sam_sw_discovery_model) and the Software installations (cmdb_sam_sw_install) require data. ## Matching algorithm fields for software discovery models {#vr-ws-exposure-assessment__section_ddd_gzf_hzb} The Software Asset Management Professional application enables you to edit a software discovery model to manually normalize discovered software that hasn't been fully normalized (partially normalized, publisher normalized, or match not found) on the Software Discovery Models form so that it can be reconciled. Starting with version 20.0 of Vulnerability Response supports normalized discovery model that comes from Software Asset Management Professional. The following fields are used for the matching algorithm for software discovery models.{#vr-ws-exposure-assessment__table_wzd_3zf_hzb__entry__3} | CPE (Software model) | SAM Foundations | SAM Professional | |-|-|-| | Vendor | Primary Key | Primary Key | | Product | Display Name | Display Name | | Version | Discovered Publisher | Discovered Publisher | | Edition | Discovered Product | Discovered Product | | | Discovered Version | Discovered Version | | | | Normalized Publisher | | | | Normalized Product | | | | Normalized Version | [ ] {#vr-ws-exposure-assessment__table_wzd_3zf_hzb} Note: The SAM Professional application isn't part of the core Vulnerability Response product from the ServiceNow Store and requires a separate subscription. ## System property {#vr-ws-exposure-assessment__section_q4l_bpr_2yb} To process the CISA-exploited vulnerabilities automatically for exposure assessment, set the system property sn_vul_analyst.enable_exposure_for_cisa to true. The default value is false. ## Scheduled jobs {#vr-ws-exposure-assessment__section_znp_1pr_2yb} Following are the scheduled jobs. {#vr-ws-exposure-assessment__table_nyp_1kk_cyb__entry__2} | Scheduled job name | Description | |-|-| | Check potential vulnerability exposure | Processes the delta CVEs, software, and installations to get the exposure. Note: This scheduled job runs every 12 hours. It runs for a longer period than the other scheduled jobs. | | Insert CISA exploited CVE to exposure config | On-demand. Inserts the CISA CVEs into the Exposure Configuration table to calculate the exposure. | | Run exposure assessment for configured CVEs | On-demand. Calculates the exposure for all the CVE records in the Exposure Configuration table. | | Run software exposure | On-demand. Calculates the exposure for all the software records in the Exposure Configuration table. | [ ] {#vr-ws-exposure-assessment__table_nyp_1kk_cyb} ## Key terms {#vr-ws-exposure-assessment__section_tlz_dpr_2yb} * Confidence score: A confidence score is a measurement of the reliability in providing a recommendation for a field. The higher the score, the more reliable the recommendation. For sample calculations, see [Confidence score calculation example](https://www.servicenow.com/docs/hfEG2FVrBmy6loRHUFVhBw "Example of calculating the confidence for a zero-day vulnerability based on its Common Vulnerabilities and Exposures (CVE) information."). * Software installation count: Number of software assets impacted by the vulnerability. * Software model: Software model associated with the product. Drill-down on the software model to see the software model result. For more information, see [Basic Software Asset Management discovery models and software installations](https://www.servicenow.com/docs/access?context=c_DiscoveryModelsSAMF&version=zurich&pubname=zurich-it-service-management&ft:locale=en-US). {#vr-ws-exposure-assessment__ul_dr4_w5l_cyb} The Software installation count field provides the total number of software installs, regardless of their active or inactive status on the discovery model. Starting with v22.0 of Vulnerability Response, a new system property, sn_vul.filter_inactive_sw_installs, has been introduced to determine whether inactive software installations should be filtered out for exposure assessment. By default, the property is enabled in the base system. When the filter is enabled, only active installations are displayed. The Discovery model field specifically shows the count of active software installations, as the inactive ones are filtered out based on the default active=true filter on the Software Discovery Model table. The count in this field should match the filtered count displayed in the Software installation count field. The count in the Software installation field persists even if you update the system property. To obtain the updated count, you must run the scheduled jobs Run exposure assessment for configured CVEs and Run software exposure that updates the count. *[\>]: and then