---
sourceDocument: Australia Enable AI
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/intelligent-experiences

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Enable AI

ft:clusterId :

    - platai

bundleId :

    - platai

workflow :

    - Platform


---

# Reference

# Managing AI asset security reference {#ariaid-title1}

Release version: Australia  
Updated May 2, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 10 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Managing AI asset security reference

This reference guide provides ServiceNow customers with detailed information about monitoring and managing the security posture of AI assets using the AI Control Tower dashboard.
It explains various metrics and calculations that help assess AI agent access, vulnerabilities, configuration issues, runtime behavior, and post-runtime security events to proactively mitigate risks.
Show full answer Show less  

## Overview Metrics

* **Access Issues:** Identifies AI agents with potential access problems that may block workflow completion.
* **Agent Map:** Visualizes relationships between AI providers, agents, workflows, and tools for comprehensive asset review.
* **AI Asset Security Score:** Measures AI asset health based on access, privilege levels, dormant status, output deviations, and PII detection. Customers can customize the score and mute assets to exclude them.
* **Contained, Dormant, and Privileged AI Agents:** Tracks deactivated agents, inactive agents over 90 days, and agents with elevated permissions, aiding risk management.
* **Security Events and Recommendations:** Displays detected security events by severity and actionable recommendations for threat mitigation.

## Design-time Metrics

These metrics help identify configuration issues and vulnerabilities before deployment:

* **AI Security Posture:** Tracks critical findings, remediation status, and severity of configuration issues across platforms, including mapping to OWASP LLM Top 10 and MITRE ATLAS techniques.
* **AI Vulnerabilities:** Monitors real-time model-level vulnerabilities, remediation deadlines, and risk levels, with data sourced from Unified Security Exposure Management (USEM) and third-party tools.
* **AI Validation:** Assesses model validation results, potential surface issues, successful attacks, and threat categories to ensure models comply with security and trust requirements.

## Runtime Metrics

These track AI system behavior during operation to detect sensitive data exposure and guardrail violations:

* **Sensitive Data Input and Anonymization:** Identifies sensitive information in user inputs and tracks anonymization efforts.
* **Offensive Content and Prompt Injection:** Uses AI Guardian to detect and block harmful content and malicious prompt injections in real time.

## Post-runtime Metrics

Post-runtime analytics highlight potential security threats after AI system interactions:

* **AI Asset Security Event Heat Map:** Categorizes top security events by OWASP threat types such as Agentic Goal Deviation, Data Poisoning, Prompt Injection, and Sensitive Information Disclosure.
* **Threat Types:** Details specific detected issues like Access Denial, Toxicity, System Prompt Leakage, and correctness of model responses.

## System Properties

ServiceNow provides configurable system properties to integrate Veza access intelligence and manage data retention periods for AI security evaluations. This optimizes performance by avoiding stale data processing.

## Practical Benefits for ServiceNow Customers

* Obtain a comprehensive, customizable view of AI asset security posture across access, configuration, runtime, and post-runtime phases.
* Identify and remediate critical vulnerabilities and configuration issues proactively using integrated USEM insights.
* Monitor and control privileged AI agents, dormant agents, and contain compromised agents to reduce risk.
* Leverage detailed threat categorizations and actionable recommendations to strengthen AI governance and compliance.
* Use runtime and post-runtime metrics to detect sensitive data exposure, malicious prompt injections, and other guardrail violations in real time.  
Reference topics provide additional details about the charts and metrics that you use to assess your AI asset security posture in AI Control Tower.

## Overview metrics and calculations {#gov-sec-reference__overview_tab}

Overview metrics show recent AI asset security event recommendations, your AI asset security score, a map of your agent network, potential AI agent access issues, and more.
{#gov-sec-reference__table_gov_sec_overview__entry__3}

| Metric | Availability | Description |
|-|-|-|
| Access issues | Base system | Shows the proportion of AI agents that may be experiencing access-related issues. AI agents with access issues may be unable to complete their workflows due to the access issue. |
| Agent map | Base system | Shows a holistic view of the relationships between your AI providers, managed AI agents, agentic workflows, and tools. You can use the map to review these relationships and get details about the AI assets in your enterprise. To configure Veza access intelligence, see [Configure Veza access intelligence in the agent map](https://www.servicenow.com/docs/mYdf7E_QnDkk1J1uF7JQ6g "Integrate Veza with ServiceNow to display agent risk scores and severity levels in the agent map. Complete this configuration for each hyperscaler that has AI assets you want to monitor."). |
| AI asset security score | Base system | Indicates a measure of the health of your AI assets in terms of access issues, privileged AI agents, dormant AI systems, output deviation, PII detection, and other criteria. Users should actively manage and review their agent assets and not rely solely on this AI asset security score. You can customize the security categories that comprise the score. For more information, see [Configure the AI asset security score](https://www.servicenow.com/docs/Q_SvC0cLHma9bu2Go~vOxw "Customize the AI asset security score to align with your enterprise's security practices. You can omit large language model (LLM) guardrail categories from the score or change the weights of categories."). To omit an AI asset from the score, you mute it. Under AI asset security score details, hover over the end of the row of the asset you want to mute. After More actions appears, select Mute. |
| Contained AI Agents | Base system | Indicates the number of AI agents that were deactivated (contained) for the last 30 days. Select the arrow to open the agent containment list. For more information, see [Review the agent containment list](https://www.servicenow.com/docs/YCNdUWXffiWloDGcWNvGbw "The agent containment list shows agents that were deactivated and reinstated for the instance manually with kill switch protocol or automatically by policy enforcement. You can view audit log information for each AI agent which can help you stay compliant with regulatory guidance and your business rules."). |
| Dormant AI agents | Base system | Shows AI agents that haven't been active for over 90 days. Review dormant AI agent permissions to reduce security risk. |
| Privileged AI agents | Available with generative AI skill | Measures AI agents with elevated permissions such as an agent with admin or security admin permissions that can perform critical actions. Some workflows require that AI agents have elevated permissions to complete. You can filter on a particular AI agent provider. For example, to show AWS agent metrics, filter the metrics by selecting **AWS Bedrock** in the provider drop-down list on the metric details page. For more details on configuring integrations to show external AI agent provider metrics, see [Configure overview security metrics](https://www.servicenow.com/docs/xoy2r3CWbgIrUZ1r9RqB2Q "If you have external AI agent data you want reflected in the Privileged AI agents metric, set up a Traceloop connection to the external AI server and perform other setup to make sure agent data appears in the metric. Or, set up a static connection for Amazon Web Services (AWS) or Azure.") and [Configuring integrations](https://www.servicenow.com/docs/fFe4YoswCzZT0wsV1vqRvg "Connect AI Control Tower to external AI platforms so you can discover AI assets, collect trace data for monitoring, and synchronize governance across multiple ServiceNow instances."). |
| Security events detected | Base system | Shown in domain-separated instances in place of Your top recommendations. Shows the number of AI asset security events detected, grouped by severity: Critical, High, Medium, and Low. |
| Your top recommendations | Base system | Action items and recommendations based on analysis of AI asset security event trace data to identify potential threats and guardrail violations. Not shown in domain-separated instances. |
[Table 1. Overview metrics]

{#gov-sec-reference__table_gov_sec_overview}

## Design-time metrics and calculations {#gov-sec-reference__design_time}

AI security posture

Review AI security posture metrics to identify potential configuration issues in AI agents, tools, MCP servers, and system prompts that could lead to security risk.
{#gov-sec-reference__table_gov_sec_design_time_posture__entry__3}

| Metric | Availability | Description |
|-|-|-|
| Critical findings approaching remediation target | Available with plugin | Configuration issues nearing the deadline your vulnerability management team set for remediation. Only shown if the AI Security Exposure Management plugin (`com.sn_sec_ai`) is installed. |
| Critical findings with remediation overdue | Available with plugin | Configuration issues that have passed their remediation deadline. Only shown if the AI Security Exposure Management plugin (`com.sn_sec_ai`) is installed. |
| Number of findings deferred | Available with plugin | Configuration issues deferred to a later date under an approved exception request. Only shown if the AI Security Exposure Management plugin (`com.sn_sec_ai`) is installed. |
| Findings by risk rating | Available with plugin | Risk rating for configuration issues, calculated in Unified Security Exposure Management (USEM) based on factors you specify. Only shown if the AI Security Exposure Management plugin (`com.sn_sec_ai`) is installed. |
| Critical findings by platform | Base system | Critical configuration issues by platform (for example, Microsoft Copilot Studio, ServiceNow, or GitHub). |
| Findings by severity | Base system | Configuration issues by severity, as reported by the AI security platform. |
| Findings by OWASP LLM Top 10 | Base system | Configuration issues by OWASP LLM Top 10 threat type. |
| Findings by MITRE ATLAS techniques | Base system | Configuration issues mapped to MITRE ATLAS techniques. |
| Agents with critical findings | Base system | Number of AI agents with critical configuration issues, out of all agents evaluated. |
| MCP Servers with critical findings | Base system | Number of MCP servers with critical configuration issues. |
| Tools with critical findings | Base system | Number of tools with critical configuration issues. |
| System Prompts with critical findings | Base system | Number of system prompts with critical configuration issues. |
[Table 2. AI security posture metrics]

{#gov-sec-reference__table_gov_sec_design_time_posture}

AI vulnerabilities

Review model vulnerabilities metrics to understand model-level security exposure in real time. These metrics reflect the vulnerability response settings and rules defined in [Unified Security Exposure Management (USEM)](https://www.servicenow.com/docs/access?context=unified-security-exposure-management-landing-page&version=australia&pubname=australia-security-management&ft:locale=en-US).

To activate these metrics, see [Activate design-time security metrics](https://www.servicenow.com/docs/ZLphDx4U1xZvADRSUTLxkA "Set up AI Service Graph Connectors for the AI security tools you currently use to import AI model vulnerability and AI validation (automated red teaming) data and show it in design-time metrics. To see additional metrics, including details for each metric, install the AI Security Exposure Management plugin (com.sn_sec_ai).").
{#gov-sec-reference__table_gov_sec_design_time__entry__3}

| Metric | Availability | Description |
|-|-|-|
| Approaching remediation target | Available with plugin | Number of potential vulnerability issues approaching the deadline for remediation. This is a rule defined in Unified Security Exposure Management (USEM). Only shown if the AI Security Exposure Management plugin (`com.sn_sec_ai`) is installed. |
| Models with vulnerabilities | Base system | Number of external models with potential vulnerabilities. This metric doesn't apply to ServiceNow models. |
| Remediation overdue | Available with plugin | Number of potential vulnerability issues past the deadline for remediation. This is a rule defined in Unified Security Exposure Management (USEM). Only shown if the AI Security Exposure Management plugin (`com.sn_sec_ai`) is installed. |
| Vulnerabilities by MITRE ATLAS techniques | Base system | Each potential vulnerability is mapped to a MITRE ATLAS technique. For example, Initial Access is mapped to AI Supply Chain Compromise. For more information, see [MITRE ATLAS Techniques](https://atlas.mitre.org/techniques). |
| Vulnerabilities by risk | Available with plugin | Risk is a combination of severity and other factors defined in Unified Security Exposure Management (USEM). Only shown if the AI Security Exposure Management plugin (`com.sn_sec_ai`) is installed. |
| Vulnerabilities by severity | Base system | Severity data is gathered from third-party AI security tools (for example, Cisco and HiddenLayer). Not shown if the AI Security Exposure Management plugin (`com.sn_sec_ai`) is installed. |
| Vulnerabilities deferred | Available with plugin | Number of potential vulnerability issues deferred by their owners. Only shown if the AI Security Exposure Management plugin (`com.sn_sec_ai`) is installed. |
[Table 3. AI vulnerabilities metrics]

{#gov-sec-reference__table_gov_sec_design_time}

AI validation

Review model validation metrics to understand if any models have potential surface issues or may be operating outside of security and trust boundaries. These metrics reflect the validation settings and rules defined in [Unified Security Exposure Management (USEM)](https://www.servicenow.com/docs/access?context=unified-security-exposure-management-landing-page&version=australia&pubname=australia-security-management&ft:locale=en-US).
{#gov-sec-reference__table_gov_sec_design_time_validation__entry__3}

| Metric | Availability | Description |
|-|-|-|
| Approaching remediation target | Available with plugin | Number of potential validation issues approaching the deadline for remediation. This is a rule defined in USEM. Only shown if the AI Security Exposure Management plugin (`com.sn_sec_ai`) is installed. |
| Findings by risk rating | Base system | Risk is a combination of severity and other factors defined in USEM. |
| Findings deferred | Available with plugin | Number of potential findings deferred by their owners. Only shown if the AI Security Exposure Management plugin (`com.sn_sec_ai`) is installed. |
| Models validated | Base system | Number of models that third-party AI security tools validated. The model endpoints and any AI application endpoint (URL) that is internally using an AI model to serve application traffic are validated. |
| Remediation overdue | Available with plugin | Number of potential validation issues past the deadline for remediation. This is a rule defined in USEM. Only shown if the AI Security Exposure Management plugin (`com.sn_sec_ai`) is installed. |
| Successful attacks | Base system | How many attacks were successful across all models, including third-party models. A higher number indicates a risk. Each data model is tested against a series of attacks. For example, an attack can be one or more prompts sent to the model. |
| Top 5 threat categories | Base system | Each attack is mapped to a vendor-specific category. For example, potential malicious code generation, harassment, privacy, or data leakage. The green badge contains the number of occurrences. Select the chart to view details in AI Validation Findings. |
| Validations | Base system | The y-axis shows the name of the model followed by a hyphen and the validation type. For example, `LLM02 - Sensitive Information Disclosure`. You can view validations by OWASP top 10 categories or MITRE ATLAS techniques. |
[Table 4. AI validation metrics]

{#gov-sec-reference__table_gov_sec_design_time_validation}

## Runtime metrics and calculations {#gov-sec-reference__runtime}

Runtime metrics show potential violations of LLM guardrails and anonymization of sensitive data in real time. You can filter the metrics by internal (ServiceNow) or external agents. External AI system metrics are derived from
Traceloop guardrails. For more information, see [Configure runtime security metrics](https://www.servicenow.com/docs/x7mYebDO~vAO2hLIzY3IsA "Set up a Traceloop connection and API key for prompt injection, offensive content, sensitive data input, and sensitive data anonymized trace data from external AI servers. Review data privacy for sensitive data patterns to detect in LLM input and output.").
{#gov-sec-reference__table_gov_sec_pi_ref__entry__3}

| Metric | Availability | Description |
|-|-|-|
| Sensitive data input | Base system | Shows sensitive data that was identified in user responses to LLM prompts. Sensitive data is content that potentially matches a known sensitive data pattern. Exposure of sensitive data is limited to the LLM in your instance. External AI system metrics are derived from Traceloop guardrails which are set up in [Configure runtime security metrics](https://www.servicenow.com/docs/x7mYebDO~vAO2hLIzY3IsA "Set up a Traceloop connection and API key for prompt injection, offensive content, sensitive data input, and sensitive data anonymized trace data from external AI servers. Review data privacy for sensitive data patterns to detect in LLM input and output."). Not shown for internal ServiceNow AI systems in a domain-separated instance. |
| Sensitive data anonymized | Base system | Shows LLM prompt data that met configured data patterns. This data was anonymized based on the configuration for the pattern in Configuration Data Patterns in Data Privacy. External AI system metrics are derived from Traceloop guardrails which are set up in [Configure runtime security metrics](https://www.servicenow.com/docs/x7mYebDO~vAO2hLIzY3IsA "Set up a Traceloop connection and API key for prompt injection, offensive content, sensitive data input, and sensitive data anonymized trace data from external AI servers. Review data privacy for sensitive data patterns to detect in LLM input and output."). Not shown for internal ServiceNow AI systems in a domain-separated instance. |
| Total offensive content detected and blocked | Available with AI Guardian | Shows offensive content data provided by AI Guardian. To see data, enable AI Guardian for your instance. For more details, see [AI Guardian analytics](https://www.servicenow.com/docs/L3eS4MWnqpHXmbe3__2dtA "Monitor the performance of guardrails enabled through AI Guardian."). External AI system metrics are derived from Traceloop guardrails which are set up in [Configure runtime security metrics](https://www.servicenow.com/docs/x7mYebDO~vAO2hLIzY3IsA "Set up a Traceloop connection and API key for prompt injection, offensive content, sensitive data input, and sensitive data anonymized trace data from external AI servers. Review data privacy for sensitive data patterns to detect in LLM input and output."). |
| Total prompt injection detected and blocked | Available withAI Guardian | Shows prompt injection data provided by AI Guardian. To see data, enable AI Guardian for your instance. For more details, see [AI Guardian analytics](https://www.servicenow.com/docs/L3eS4MWnqpHXmbe3__2dtA "Monitor the performance of guardrails enabled through AI Guardian."). External AI system metrics are derived from Traceloop guardrails which are set up in [Configure runtime security metrics](https://www.servicenow.com/docs/x7mYebDO~vAO2hLIzY3IsA "Set up a Traceloop connection and API key for prompt injection, offensive content, sensitive data input, and sensitive data anonymized trace data from external AI servers. Review data privacy for sensitive data patterns to detect in LLM input and output."). |
[Table 5. Runtime metrics]

{#gov-sec-reference__table_gov_sec_pi_ref}

## Post-runtime metrics and calculations {#gov-sec-reference__post_runtime}

Post-runtime metrics show potential threats in AI system input and output. Top AI asset security events are organized into a heat map by top Open Worldwide Application Security Project (OWASP) categories, which are used to
identify and mitigate common threats in AI systems. For more information, see [OWASP Top 10 Risk \& Mitigations for LLMs and Gen AI Apps](https://genai.owasp.org/llm-top-10/).

Each cell in the Top AI asset security events heat map contains the number of AI asset security events belonging to that category (row) and the timeframe (column).

To configure these metrics, see [Configure post-runtime security metrics](https://www.servicenow.com/docs/mfBAugqXgve0ri4Iea30kw "Customize security and content moderation policies, sampling rate, skill call usage limit, LLMs to use, and other settings for the Top AI asset security events metric and others.").

<br />

{#gov-sec-reference__table_gov_sec_topaisecurityevents_ref__entry__2}

| Category | Description |
|-|-|
| Agentic Goal Deviation | Detects when AI agents may have been manipulated to potentially deviate from their authorized role or potentially have their decision-making process compromised. |
| Data and Model Poisoning | Detects when LLM input potentially contains corrupt or dangerous content that the LLM uses to train on. |
| Excessive Agency | Detects when LLMs are provided too much access, leading to potential unauthorized or excessive actions by the LLM. |
| Improper Output Handling | Detects when LLM output is potentially invalid or untrustworthy. |
| Prompt Injection | Detects when malicious instructions may be embedded in AI agent inputs to potentially manipulate the agent's behavior or override or deviate from its original directives. |
| Sensitive Information Disclosure | Detects when AI agent interactions potentially contain personally identifiable information (PII) in inputs or outputs. |
| System Prompt Leakage | Detects when AI agents potentially disclose their system prompts or internal instructions. |
[Table 6. AI asset security event categories]

{#gov-sec-reference__table_gov_sec_topaisecurityevents_ref} {#gov-sec-reference__table_gov_sec_topaisecurityevents_threat_ref__entry__2}

| Type | Description |
|-|-|
| Access Denial | Detects when AI agents were denied access to AI assets or data. |
| Agent Goal Deviation | Detects when AI agents may have been manipulated to potentially deviate from their authorized role or potentially have their decision-making process compromised. |
| Correctness Detection | Measures whether the information provided in the model's response is factually accurate and logically valid given the prompt and context. |
| Data Integrity Incident Detection | Designed to help show potential violations of certain LLM guardrail policies in LLM responses. |
| Input Screening | Monitors user input to detect and anonymize sensitive or personally identifiable information (PII) before it reaches the AI model. |
| Output Screening | Monitors AI-generated responses for sensitive or personally identifiable information (PII) before they're delivered to users |
| PII Detection | Detects when AI agent interactions potentially contain personally identifiable information (PII) in inputs or outputs. |
| Prompt Injection | Detects when malicious instructions may be embedded in AI agent inputs to potentially manipulate the agent's behavior or override or deviate from its original directives. |
| System Prompt Leakage | Detects when AI agents potentially disclose their system prompts or internal instructions. |
| Toxicity | Detects when AI agent interactions potentially contain harmful, offensive, or toxic content in inputs or outputs. |
[Table 7. AI asset security event threat types]

{#gov-sec-reference__table_gov_sec_topaisecurityevents_threat_ref}

AI judge model classifications are probabilistic in nature and may be incomplete or incorrect. They don't constitute professional advice and shouldn't be relied on as the sole basis for assessing risk.
* **[System properties for AI asset security](https://www.servicenow.com/docs/MbsdTkBwtV_hAJYh3Tuv1g)**   
  System properties that connect Veza access intelligence and limit the age of records evaluated for AI asset security metrics are available. Limiting records can prevent analyzing stale data and reduce unnecessary processing overhead.