---
sourceDocument: Australia Enable AI
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/intelligent-experiences

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Enable AI

ft:clusterId :

    - platai

bundleId :

    - platai

workflow :

    - Platform


---

# AICT security analyzer AI agent

# AICT security analyzer AI agent {#ariaid-title1}

Release version: Australia  
Updated June 1, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of AICT Security Analyzer AI Agent

The AICT Security Analyzer AI Agent is designed to enhance security event management by generating comprehensive context for detected AI security events.
It aggregates data from assets, prompts, cross-threat indicators, and correlation sources to compute a confidence score assessing detection strength, event risk, and authorization signals.
This agent automates the finalization of security threats by creating incidents, saving triage records, and triggering AI insights for broader platform visibility.
Show full answer Show less  

## Workflow

* Retrieves the detected AI security event and gathers full context including related assets and threat indicators.
* If errors are detected in the event context, finalizes the analysis immediately with error details.
* Calculates a confidence score based on detection strength, risk level, authorization signals, and overrides.
* Determines severity and creates a security incident if no duplicate is open for critical findings.
* Saves a triage record capturing the analysis rationale.
* Triggers an AI insight to provide platform-wide visibility after triage record commitment.
* Handles finalization failures by presenting error details to the user.

## Configuration and Access

* **Third-party Access:** Disabled by default; can be enabled to allow third-party AI agents to use this agent.
* **AI Specialist Access:** Disabled by default; enabling grants AI specialists enhanced configuration options to map inputs and responses.
* **Long-term Memory:** Disabled by default; enabling allows the agent to use all previous user interactions as context for large language model (LLM) processing.
* **User Roles:** Access is restricted to users with the `snaigovernance.aisteward` role.
* **Data Access Roles:** Also require `snaigovernance.aisteward` to determine accessible data and permitted actions.
* **Triggers:** None defined by default; administrators can configure triggers as needed.
* **Channels:** Can be integrated with Virtual Agent or ServiceNow Otto panel via Assistant Designer.

## Practical Benefits for ServiceNow Customers

* Automates comprehensive security event analysis and incident creation, reducing manual effort and improving response times.
* Provides detailed triage records and AI-driven insights to support informed decision-making and platform-wide awareness.
* Configurable access controls ensure secure and appropriate use by authorized personnel and AI specialists.
* Supports integration with existing ServiceNow conversational interfaces for streamlined workflows.  
This AI agent generates context for a detected AI security event by aggregating asset, prompt, cross-threat, and correlation data. It then computes a confidence score from detection strength, event risk, and authorization
signals.

## Workflow {#plat-ai-aict-security-analyzer-agent-ai-agent__zsmdlwierhjt}

For all threats, the agent deterministically executes outcomes in a single finalization step: creating a security incident for critical severity findings with no open duplicate, saving a triage record capturing the full verdict and rationale, and triggering an AI insight for platform-wide visibility after the triage record is committed.

1. Retrieve the detected AI security event record and gather its full context, including the related asset, prompt, cross-threat indicators, and recent threat correlation.
2. If the event context indicates an error, finalize the analysis immediately with the error details and stop.
3. Calculate a confidence score using detection strength, event type risk, prompt authorization signals, and any cross-threat or correlation overrides.
4. Finalize the analysis by determining severity and creating a security incident with no open duplicate. Save a triage record with the full rationale, and trigger an AI insight for platform-wide visibility.
5. If finalization fails, present the error and its details to the user.
{#plat-ai-aict-security-analyzer-agent-ai-agent__ol_hcp_qwx_njc}  
{#plat-ai-aict-security-analyzer-agent-ai-agent__zsmdlwierhjt__entry__2}

| Field | Description |
|-|-|
| Allow third party to access this AI agent | When enabled, third-party AI agents can use this agent. This value is off (false) by default. This setting is defined in the AI Agent configs \[sn_aia_agent_config\] table on the External discoverable field. |
| Allow AI specialists to access this AI agent | When enabled, AI specialists can use this agent. This value is off (false) by default. When set to true, more configuration options for tools become available so that an AI specialist can map inputs and response templates to tool outputs. This setting is defined in the AI Agent configs \[sn_aia_agent_config\] table on the Specialist enabled field. |
| Manage long-term memory | When enabled, all previous user interactions are used as context for the LLM. This value is off (false) by default. This setting is defined by the sn_aia.ltm.enable_long_term_memory system property. For more information, see [ServiceNow Otto AI agents reference](https://www.servicenow.com/docs/MUqSU8rHp3ao~q3QEWgHkA "Find more information about user roles, tables, and the different properties that are installed in ServiceNow Otto AI agents."). |
| Tools | Scripts :   Assess Threat :   Finalize Analysis |
| Allowed user roles The specific user roles that can access this AI agent. | sn_ai_governance.ai_steward |
| Data access roles The specific user identity roles that determine which data the AI agent can access and what actions it can take. | sn_ai_governance.ai_steward |
| Triggers | Optional. None defined by default. An admin can specify triggers if desired. For more information, see [Add a trigger to an AI agent](https://www.servicenow.com/docs/NXqRJBQV_Vw00FEzklcAJw "In the guided setup for an AI agent, add triggers to run the AI agent automatically when certain conditions are met."). |
| Channels | Configure an assistant for Virtual Agent or ServiceNow Otto panel using [Assistant Designer](https://www.servicenow.com/docs/access?context=configure-now-assist-va&version=australia&pubname=australia-conversational-interfaces&ft:locale=en-US). |
| Used in agentic workflows | Not applicable. |
[Table 1. Configuration]