--- sourceDocument: Australia Security Management sourceDocumentLink: https://www.servicenow.com/docs/r/australia/security-management Release : - australia ft:locale : - en-US ft:publication_title : - Australia Security Management ft:clusterId : - security bundleId : - security workflow : - Technology --- # Fortify Vulnerability Integration # Fortify Vulnerability Integration {#ariaid-title1} Release version: Australia Updated March 12, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Fortify Vulnerability Integration The Fortify Vulnerability Integration enables ServiceNow customers to import and utilize vulnerability data from the Fortify product. This integration helps determine the impact and priority of code flaws by enriching your existing vulnerability data within the ServiceNow Application Vulnerability Response feature. It automates synchronization between ServiceNow and Fortify, supporting effective vulnerability management and remediation. Show full answer Show less ## Key Features * **Automated Data Import:** Scheduled jobs run daily to import scanner data, scan summaries, and scan results from Fortify, maintaining up-to-date vulnerability information. * **Chained Scheduled Jobs:** Integrations are executed in sequence through chained scheduled jobs, with options to run individual jobs manually for flexibility. * **Preconfigured Run-As User:** Uses a designated run-as user (default is VR.System) to maintain secure and consistent integration operations---this value should not be changed. * **Integration Components:** * *Fortify on Demand Application List Integration:* Retrieves application scanner data daily and enriches third-party application information (active by default). * *Fortify on Demand Scan Summary Integration:* Retrieves scan records; runs after the Application List Integration (inactive by default). * *Fortify on Demand Application Vulnerable Item Integration:* Retrieves detailed scan results, inserts Application Vulnerable Item Tables (AVITs), and updates existing AVITs if scanner records are not closed (inactive by default). * **Performance Monitoring:** Starting with version 2.3, detailed metrics such as processing times and integration run reports are available for the Application Vulnerable Item integration. * **Version Compatibility:** Choose integration versions according to your upgrade plans---versions 30.x and above are compatible with Unified Security Exposure Management (USEM), while versions below 30.x are for environments not migrating to USEM. ## Practical Benefits * Maintains synchronization of vulnerability data between Fortify and ServiceNow, ensuring accurate and current vulnerability insights. * Improves vulnerability prioritization and response workflows by enriching third-party vulnerability data with Fortify scanner results. * Automates data imports and reduces manual effort in tracking and managing application vulnerabilities. * Supports seamless integration configuration and operation through scheduled jobs and a secure run-as user setup. The Fortify Vulnerability Integration uses data imported from the Fortify product to help you determine the impact and priority of flaws in your code. ## Fortify Vulnerability Integration {#fortify-vuln-integration__section_l13_1kz_thb} The Fortify product collects scanner data and makes that data available to the ServiceNow AI Platform®. It easily integrates with the ServiceNow® Application Vulnerability Response feature of Vulnerability Response to map third-party vulnerabilities enriching the data in your instance. There is a configured run-as user for each integration record. The default value for this user is VR.System. Do not change this value. Every day, scheduled jobs invoke the integrations automatically. Once all the integrations are activated, they are chained to run in sequence. You can also execute individual scheduled jobs manually. Scheduled jobs simplify the vulnerability remediation life cycle by keeping the instance synchronized with other vulnerability management systems. ## Available versions {#fortify-vuln-integration__section_gkd_vpw_zhb} {#fortify-vuln-integration__table_tqh_wpw_zht__entry__2} | Release version | Release Notes | |-|-| | If you intend to upgrade to a version that is compatible with Unified Security Exposure Management (USEM), please select a version starting with 30.x when installing or upgrading. | [https://www.servicenow.com/docs/access?context=secops-app-vuln-resp-rn\&version=australia\&pubname=australia-release-notes\&ft:locale=en-US](https://www.servicenow.com/docs/access?context=secops-app-vuln-resp-rn&version=australia&pubname=australia-release-notes&ft:locale=en-US) For compatibility information, see [KB0856498 Vulnerability Response Compatibility Matrix and Release Schema Changes](https://support.servicenow.com/kb_view.do?sysparm_article=KB0856498) | | If you do not intend to upgrade to a version that is compatible with Unified Security Exposure Management (USEM), please select a version below 30.x when installing or upgrading. | | [ ] {#fortify-vuln-integration__table_tqh_wpw_zht} ## Fortify Vulnerability Integration {#fortify-vuln-integration__section_ift_yxh_x1b} To view the Fortify Vulnerability Integration, navigate to Fortify Vulnerability IntegrationIntegrations. The following integrations are included in the base system. These integrations are not all active by default. After the initial run, every day, scheduled jobs are chained to run the integrations automatically in order. You can also execute individual scheduled jobs manually. Scheduled jobs simplify the vulnerability remediation life cycle by keeping the instance synchronized with other vulnerability management systems. {#fortify-vuln-integration__table_sbn_qlp_dt__entry__2} | Integration | Description | |-|-| | Fortify on Demand Application List Integration | Retrieves Fortify application scanner data (vulnerabilities, metadata) and enriches your third-party application data. This integration is set to run daily at 00:00:00. It is active by default. | | Fortify on Demand Scan Summary Integration | Retrieves scan records from Fortify. This integration is chained to run following the Fortify on Demand Application List Integration when activated. It is inactive, by default. | | Fortify on Demand Application Vulnerable Item Integration | Retrieves scan results from Fortify, inserts AVITs, and enriches your third-party vulnerability data. If the scanner record is in the Closed state, AVITs are not created. Existing AVITs are still updated. Starting with v2.3, view details such as total processing times, average times for pre- and post-integration run processes, and reports on the integration run records for the Application Vulnerable Item integration. This integration is chained to run following the Fortify on Demand Scan Summary Integration when activated. It is inactive, by default. | [Table 1. Fortify Vulnerability Integrations] {#fortify-vuln-integration__table_sbn_qlp_dt} For integration run statuses see, [View the Fortify Vulnerability Integration import run status](https://www.servicenow.com/docs/Lp4p2YWSiTQSte3Gq1kOGg "Use the Vulnerability Integration Runs related list to verify the success of your integration runs, locate any issues, and inform your remediation decisions."). To view data in third-party vulnerabilities, see [View vulnerability libraries](https://www.servicenow.com/docs/IZq57UW~KW0S4rDI9HTfsQ "You can view vulnerability data imported from the National Vulnerability Database (NVD), Common Weakness Enumeration (CWE), or third-parties to decide whether to escalate a remediation task."). *[\>]: and then