--- sourceDocument: Australia Security Management sourceDocumentLink: https://www.servicenow.com/docs/r/australia/security-management Release : - australia ft:locale : - en-US ft:publication_title : - Australia Security Management ft:clusterId : - security bundleId : - security workflow : - Technology --- # Exploring exposure assessment # Exploring exposure assessment {#ariaid-title1} Release version: Australia Updated March 12, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 5 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Exploring exposure assessment Exposure assessment in ServiceNow uses the Common Platform Enumeration (CPE) framework, part of the CVE system, to evaluate how your assets might be vulnerable to software security issues. This process relies on a software discovery model and a matching algorithm that links CPEs to discovered software to identify potential exposures. It helps detect vulnerabilities that traditional scanners might miss, including zero-day vulnerabilities, providing early warnings to improve your vulnerability management program. Show full answer Show less ## Prerequisites * Vulnerability Crisis Management plugin (v1.0) and Vulnerability Response (v20.0 or higher) * Vulnerability Response integrations with NVD (v1.3) and CISA (v1.2) * Software Asset Management Basic or Professional plugins * Software Discovery data must be present on your instance to reference assets for assessment ## Use Cases * **Assess by CVE:** Understand exposure by CVE using Software Asset Management and Discovery data to identify affected systems and assign remediation tasks. * **Assess by Software:** Evaluate risk based on software installations when CVEs are not yet published, enabling proactive handling of zero-day or critical vulnerabilities. * **Assess by Publisher:** Analyze vulnerabilities related to a software vendor to gauge vendor risk and prioritize remediation. ## Compatibility and System Requirements The Exposure Assessment module requires the Vulnerability Response application and the ITSM Software Asset Management application (SAM Foundation version included). It supports Basic and Professional SAM plugins. Ensure the SAM Foundation application is installed and that software discovery and installation data are available in the system. ## Matching Algorithm and Software Discovery Models The assessment uses specific fields from software discovery models, including vendor, product, version, and publisher information, to normalize and reconcile software data accurately. This normalization enables precise matching of discovered software to vulnerabilities. Note that the SAM Professional plugin is a separate subscription and not included in the core Vulnerability Response product. ## Configuration and Scheduled Jobs * Enable automatic processing of CISA-exploited vulnerabilities by setting the system property `snvulanalyst.enableexposureforcisa` to true (default is false). * Scheduled jobs run every 12 hours to update exposure calculations based on new CVEs, software, and installations. * Additional on-demand jobs allow manual triggering of exposure assessments for CVEs and software. ## Key Terms and Features * **Confidence Score:** Indicates reliability of recommendations; higher scores reflect more dependable results. * **Software Installation Count:** Total number of software assets impacted; can be filtered to exclude inactive installations. * A system property `snvul.filterinactiveswinstalls` (enabled by default) controls whether inactive software installations are included in exposure counts. * To reflect changes in filtering inactive software, scheduled jobs must be run to update exposure data accordingly. Exposure assessment uses the Common Platform Enumeration (CPE) framework, which is a part of the Common Vulnerabilities and Exposures (CVEs) system, to evaluate the vulnerability exposure of your assets to vulnerability software. This assessment is performed using a software discovery model. By employing a matching algorithm, the relevant CPEs are associated and mapped to the software discovery model, enabling the identification of potential exposures. You can use the exposure assessment by CVE or software to identify exposure to potential vulnerabilities for the following scenarios: * Vulnerabilities that may not be identified by traditional scanners * Zero-day vulnerabilities before the scanner provide the signature for vulnerability detection {#vr-ws-exposure-assessment__ul_vlw_1tc_cyb}Exposure assessment provides an early warning to remediate these vulnerabilities, and improve the maturity of the vulnerability management program. Prerequisites for exposure assessment{#vr-ws-exposure-assessment__table_qqv_drb_2yb__entry__2} | Application | Version | |-|-| | Vulnerability Crisis Management plugin | 1.0 | | Vulnerability Response | 20.0 | | Vulnerability Response with NVD | 1.3 | | Vulnerability Response Integration with CISA | 1.2 | | Vulnerability Response Integration with NVD Note: For more information, see [National Vulnerability Database (NVD) integration](https://www.servicenow.com/docs/eFiXOlP4oTeyfPz4Q0roQA "The NVD integrations use data from the NIST National Vulnerability Database to help you determine the impact and priority of flaws in your code. Run this integration as part of your initial setup of Vulnerability Response and before importing vulnerability data into your instance with a third-party scanner product."). | 1.3 | | Software Asset Management | Basic Software Asset Management or Software Asset Management Professional plugin | [Table 1. Available versions] {#vr-ws-exposure-assessment__table_qqv_drb_2yb} ## Use cases {#vr-ws-exposure-assessment__section_gk1_msm_hpb} For examples of how Vulnerability Analysts organization would use the Vulnerability Exposure Assessment workspace, see these use cases.{#vr-ws-exposure-assessment__table_hk1_msm_hpb__entry__2} | Assessment type | Use | |-|-| | Assess by CVE | Assess vulnerabilities by CVE to gain a full understanding of the impact and exposure of the affected systems using Software Asset Management (SAM) and Discovery data. Take prompt remediation actions by creating manual VITs and assigning them to remediation owners. Assessing by CVEs is beneficial because scanners may not detect all the affected systems, whereas Discovery typically identifies most of the software on the attack surface. | | Assess by Software | Assess the impact by software when CVE is unavailable to identify the number of CIs where the software is installed. By assessing by software, you can proactively act on zero-day or critical vulnerabilities by creating a manual VIT and assigning it to the remediation owner before they're officially published or before scanners identify them. | | Assess by Publisher | Assess vulnerabilities by a software vendor to understand the impact and exposure of affected systems for the CVEs published by the vendor within a time frame. Assessing by publisher helps you evaluate the vendor risk and critical vulnerabilities, enabling proactive remediation. | [ ] {#vr-ws-exposure-assessment__table_hk1_msm_hpb} ## Compatibility and system requirements {#vr-ws-exposure-assessment__section_compatibility_system_req} The Vulnerability Response application is available on the ServiceNow Store. The ITSM Software Asset Management application (com.snc.asset_management) is required for the Exposure Assessment module. This application manages all your assets and software licenses, and the SAM Foundation version of this application is part of the Vulnerability Response application that you download from the ServiceNow Store. Important: The Exposure Assessment application works with the following plugins: * Basic Software Asset Management (com.snc.sams) * Software Asset Management Professional (com.snc.pa.samp) * Software Asset Management plugin (com.snc.software_asset_management) {#vr-ws-exposure-assessment__ul_e1r_xjz_21c} To verify the SAM Foundation application is installed on your instance, navigate to System ApplicationsAll Available ApplicationsAll and search for com.snc.asset_management. If the application isn't installed, select Install. As the Vulnerability Exposure Assessment application requires access to the asset data on your ServiceNow AI Platform® instance, the asset management applications must have data to reference. The Software Discovery Models table (cmdb_sam_sw_discovery_model) and the Software installations (cmdb_sam_sw_install) require data. ## Matching algorithm fields for software discovery models {#vr-ws-exposure-assessment__section_ddd_gzf_hzb} The Software Asset Management Professional application enables you to edit a software discovery model to manually normalize discovered software that hasn't been fully normalized (partially normalized, publisher normalized, or match not found) on the Software Discovery Models form so that it can be reconciled. Starting with version 20.0 of Vulnerability Response supports normalized discovery model that comes from Software Asset Management Professional. The following fields are used for the matching algorithm for software discovery models.{#vr-ws-exposure-assessment__table_wzd_3zf_hzb__entry__3} | CPE (Software model) | SAM Foundations | SAM Professional | |-|-|-| | Vendor | Primary Key | Primary Key | | Product | Display Name | Display Name | | Version | Discovered Publisher | Discovered Publisher | | Edition | Discovered Product | Discovered Product | | | Discovered Version | Discovered Version | | | | Normalized Publisher | | | | Normalized Product | | | | Normalized Version | [ ] {#vr-ws-exposure-assessment__table_wzd_3zf_hzb} Note: The SAM Professional application isn't part of the core Vulnerability Response product from the ServiceNow Store and requires a separate subscription. ## System property {#vr-ws-exposure-assessment__section_q4l_bpr_2yb} To process the CISA-exploited vulnerabilities automatically for exposure assessment, set the system property sn_vul_analyst.enable_exposure_for_cisa to true. The default value is false. ## Scheduled jobs {#vr-ws-exposure-assessment__section_znp_1pr_2yb} Following are the scheduled jobs. {#vr-ws-exposure-assessment__table_nyp_1kk_cyb__entry__2} | Scheduled job name | Description | |-|-| | Check potential vulnerability exposure | Processes the delta CVEs, software, and installations to get the exposure. Note: This scheduled job runs every 12 hours. It runs for a longer period than the other scheduled jobs. | | Insert CISA exploited CVE to exposure config | On-demand. Inserts the CISA CVEs into the Exposure Configuration table to calculate the exposure. | | Run exposure assessment for configured CVEs | On-demand. Calculates the exposure for all the CVE records in the Exposure Configuration table. | | Run software exposure | On-demand. Calculates the exposure for all the software records in the Exposure Configuration table. | [ ] {#vr-ws-exposure-assessment__table_nyp_1kk_cyb} ## Key terms {#vr-ws-exposure-assessment__section_tlz_dpr_2yb} * Confidence score: A confidence score is a measurement of the reliability in providing a recommendation for a field. The higher the score, the more reliable the recommendation. For sample calculations, see [Confidence score calculation example](https://www.servicenow.com/docs/DcjdpOMVF1jxLPGECoBC5Q "Example of calculating the confidence for a zero-day vulnerability based on its Common Vulnerabilities and Exposures (CVE) information."). * Software installation count: Number of software assets impacted by the vulnerability. * Software model: Software model associated with the product. Drill-down on the software model to see the software model result. For more information, see [Basic Software Asset Management discovery models and software installations](https://www.servicenow.com/docs/access?context=c_DiscoveryModelsSAMF&version=australia&pubname=australia-it-service-management&ft:locale=en-US). {#vr-ws-exposure-assessment__ul_dr4_w5l_cyb} The Software installation count field provides the total number of software installs, regardless of their active or inactive status on the discovery model. Starting with v22.0 of Vulnerability Response, a new system property, sn_vul.filter_inactive_sw_installs, has been introduced to determine whether inactive software installations should be filtered out for exposure assessment. By default, the property is enabled in the base system. When the filter is enabled, only active installations are displayed. The Discovery model field specifically shows the count of active software installations, as the inactive ones are filtered out based on the default active=true filter on the Software Discovery Model table. The count in this field should match the filtered count displayed in the Software installation count field. The count in the Software installation field persists even if you update the system property. To obtain the updated count, you must run the scheduled jobs Run exposure assessment for configured CVEs and Run software exposure that updates the count. *[\>]: and then