---
sourceDocument: Australia Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/platform-security
Release :
- australia
ft:locale :
- en-US
ft:publication_title :
- Australia Platform security
ft:clusterId :
- psec
bundleId :
- psec
workflow :
- Platform
---
# Knowledge-based authentication
# Knowledge-based authentication (Security Questions) {#ariaid-title1}
Release version: Australia
Updated September 10, 2026
 2 minutes to read
Summarize
 Summarized using AI
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.
## Summary of Knowledge-based authentication (Security Questions)
Knowledge-based authentication (KBA) uses preconfigured security questions to identify and authenticate callers via conversational AI channels like AI voice agents.
It verifies caller identity by matching answers against data stored in ServiceNow AI Platform tables or external systems without importing external data into ServiceNow.
KBA supports both identification (locating the caller) and authentication (verifying the caller's claim), typically within the same interaction.
Show full answer Show less
## How KBA Works
* **Identification:** Matches caller answers (e.g., phone number) to a stored record once per session to establish identity before sensitive interactions.
* **Authentication:** Validates one or more answers to confirm the caller's identity against stored or external data.
* KBA questions can be configured for identification, authentication, or both.
* Step-up authentication is not supported with KBA factors.
## External Source Validation
When caller data is outside ServiceNow, administrators can configure custom scripts to validate answers against external systems such as CRM or order management platforms. Scripts process caller responses in real time and return matching results or true/false for authentication. Only **sncexternal** users are supported for external validations, and script execution is limited to 15 seconds by default.
## Context Persistence
Starting with AI voice version 5.0.3, caller answers from identification and authentication are stored in session context, making previously provided information available for subsequent questions during the session. This reduces repetitive prompts, but only scripted answers are persisted.
## Key Strengths
* No additional devices or internet connectivity required.
* Easy and familiar method for most users.
## Limitations
* Relies on knowledge that can be guessed or socially engineered.
* Not suitable as the sole verification for sensitive operations.
* Best suited for low-risk scenarios like general IT support or accessing public documentation.
## Next Steps for ServiceNow Customers
To implement and configure KBA in your environment, refer to ServiceNow documentation on creating KBA questions and answers, mapping questions to answers, and integrating KBA with AI voice agent services.
Knowledge-based authentication (KBA) is an identification and authentication method that verifies callers by prompting them to answer preconfigured questions across conversational AI channels, such as AI voice agents. KBA can be
used to identify a caller, authenticate a caller, or both within the same interaction.
KBA validates answers against records in ServiceNow AI Platform tables. For callers whose data resides outside ServiceNow, admins can configure scripts to validate answers against external systems in real-time. External data is never imported or stored in ServiceNow AI Platform.
## How KBA works {#knowledge-based-authentication__section_how_kba_works}
Identification locates the caller by matching their answer to a record in ServiceNow AI Platform or an external system. For example, a caller provides their business phone number, and the system finds a matching record. Identification runs once per session and establishes who the caller is before any
sensitive interaction begins.
Authentication verifies that the caller is who they claim to be. The caller answers one or more questions, and the system validates those answers against stored or externally sourced data.
KBA questions can be configured for identification, authentication, or both phases, depending on admin configuration.
Note:
KBA factor isn't supported for step-up authentication.
## External source validation {#knowledge-based-authentication__section_ymy_hbk_hhc}
When caller data is not stored in ServiceNow AI Platform, admins can configure a custom script on an answer record to validate the caller's response against an external system, such as a CRM or order management platform. The script receives the caller's answer as
input and returns a match result.
* For identification, the script returns the matched record.
* For authentication, the script returns a true or false result.
Note:
Only snc_external users can be authenticated using external source.
Script execution is limited to 15 seconds by default. To learn more configuration properties, see [System Properties](https://www.servicenow.com/docs/IhD4NGeQ8Nd_UGp7PeYVTQ#create-knowledge-based-answers__system-properties).
## Context persistence {#knowledge-based-authentication__section_zcv_3bk_hhc}
Starting `"nowassist-aia-voice", version: "5.0.3"` release, answers collected during identification and authentication are persisted as session context and are available to subsequent authentication questions. This
means a caller does not have to repeat information they already provided. For example, if a caller provides a booking reference during identification, that value is accessible to authentication scripts without prompting the caller
again.
Only the caller's own answers are kept, for the current session.
Note:
Context persistence is available only for scripted answers, it doesn't capture non-scripted answer responses.
## Key strengths {#knowledge-based-authentication__section_key_strengths}
* No additional device or internet connectivity is required.
* Familiar to most users.
{#knowledge-based-authentication__ul_tkf_z1j_kjc}
## Limitations {#knowledge-based-authentication__section_limitations}
* KBA relies on information the caller knows, which can be guessed, obtained from public records, or exposed through social engineering.
* KBA is not recommended as the sole verification method for sensitive operations.
* KBA is best suited for low-risk scenarios, such as general IT support or public documentation access.
For detailed configuration instructions, see:
* [Create KBA questions](https://www.servicenow.com/docs/ulXOJIoK0W5eRmghXPsmKw "Create knowledge-based questions to use for caller identification and authentication in AI voice agent interactions.")
* [Create KBA answers](https://www.servicenow.com/docs/IhD4NGeQ8Nd_UGp7PeYVTQ "Create knowledge-based answers for the preconfigured security questions to confirm the user's identity.")
* [Map KBA questions to answers](https://www.servicenow.com/docs/DfU~QjejndTNpZVXg2baRA "Map knowledge-based questions to their answers so the answers can be used to confirm a caller's identity.")
* [AI voice agent service mapping with KBA](https://www.servicenow.com/docs/arVLB2ELGU_xFySww1X4uw "Specify the questions used for caller identification and authentication with a specific AI voice agent service.")
{#knowledge-based-authentication__ul_dcc_psy_3hc}