--- sourceDocument: brazil Combined Product Files sourceDocumentLink: https://www.servicenow.com/docs/r/delta-australia-brazil Release : - brazil ft:locale : - en-US ft:publication_title : - brazil Combined Product Files ft:clusterId : - delta3ba bundleId : - delta3ba --- # Combined Application Vulnerability Response release notes for upgrades from Australia to Brazil # Combined Application Vulnerability Response release notes for upgrades from Australia to Brazil {#ariaid-title1} Release version: Brazil Updated October 8, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 7 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Combined Application Vulnerability Response Release Notes for Upgrades from Australia to Brazil This consolidated release notes page provides ServiceNow customers with essential information for upgrading Application Vulnerability Response (AVR) from the Australia release family to the Brazil release family. It includes upgrade preparation tasks, new features, changes, deprecations, and activation details relevant to the AVR application. The notes also clarify integration enhancements with third-party scanners and highlight compatibility considerations. Show full answer Show less ## Important Upgrade Information * If you are using Application Vulnerability Response without plans to upgrade to Unified Security Exposure Management (USEM), install a version below v30.x for supported third-party integrations. * Now Assist for Vulnerability Response is being deprecated and replaced by the ServiceNow Otto brand for USEM, with entitlements unchanged. * Review pre- and post-upgrade tasks before migrating to Brazil to ensure a smooth transition. ## New Features and Enhancements (Australia Release) * **Invicti Vulnerability Integration:** Introduced Invicti Platform Integration with three new jobs to import applications, scans, and vulnerability findings directly into ServiceNow AI Platform®. * **Application Lifecycle Management:** Automatic deactivation of discovered applications and closure of associated application vulnerable items (AVITs) when applications are deleted or decommissioned in Invicti Platform. * **Configuration Lookup Rules:** Added "Applies to" field for distinguishing between AVR and Vulnerability Response (VR) lookup rules to avoid conflicts during background job execution. * **Wiz Integration:** Asset integration is now deactivated by default and is optional. Users can selectively import only needed resources, simplifying configuration by making Resource Type optional. * **GitHub Secret Scanning:** Supports import of generic secrets with configurable options to manage generic secret ingestion and mapping to AVITs. * **Improved Vulnerability Assessment Workflows:** Enables CI filtering via condition builder, inclusion of Business Application data on AVITs from SBOM assessments, and automatic priority roll-down from assessments to related vulnerability items. * **Compensatory Controls:** New vulnerable items linked to tasks with approved compensating controls automatically inherit reduced risk ratings. **Note:** No updates or changes were introduced in the Brazil release for Application Vulnerability Response. ## Changes, Removals, and Deprecations No changes, removals, or deprecations were made to Application Vulnerability Response features between Australia and Brazil releases. ## Activation and Additional Information * Application Vulnerability Response is available via the ServiceNow Store. Customers should request installation through the store and consult the store's version history for cumulative release notes. * No new browser, accessibility, localization, or additional requirements were introduced in the Brazil release. ## Practical Benefits for ServiceNow Customers * Enhanced integration with Invicti and Wiz improves accuracy and automation in vulnerability import and lifecycle management. * Improved configuration options prevent conflicts in lookup rules and simplify integration setups. * Support for generic secrets in GitHub scanning expands security coverage. * Better vulnerability assessment workflows with filtering, business context, and priority consistency streamline remediation prioritization. * Automatic inheritance of compensatory control risk reductions reduces manual effort in risk management. * Clear upgrade guidance and consistent entitlements help maintain operational continuity during migration. Consolidated page of all release notes for Application Vulnerability Response from Australia to Brazil. ## How to use this page To help you prepare for your upgrade, we have combined the cross-family Application Vulnerability Response release notes onto one page. Read this summary of the new features, changes, and updated information for your product from Australia to Brazil. Tip: If there were no updates for a release notes section in a certain family release, we included a short note for your reference. For example, if a product did not have any updates in Tokyo, the row says "No updates for this release." ## Important information for upgrading Application Vulnerability Response to Brazil Before you upgrade to Brazil, review these pre- and post-upgrade tasks and complete the tasks as needed. {#dfrn3-applicationvulnerabilityresponse-summary__entry__2} | Release | Release notes | |-|-| | Australia | Upgrade information : * If you are currently using Application Vulnerability Response, and you do not intend to upgrade to Unified Security Exposure Management (USEM), install a version below v30.x of Application Vulnerability Response and for upgrades to supported third-party integration applications. * For information about the new features of Vulnerability Response, see the [Vulnerability Response release notes](https://www.servicenow.com/docs/access?context=secops-vuln-resp-rn&family=australia&ft:locale=en-US). * For more information about the released versions of the Application Vulnerability Response application as well as the third-party and ServiceNow applications that are compatible with the Australia release, see the [Vulnerability Response Compatibility Matrix and Release Schema Changes \[KB0856498\]](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0856498) article in the Now Support Knowledge Base. Starting with Australia Patch 5, Now Assist for Vulnerability Response is being prepared for future deprecation. It will be hidden and no longer installed on new instances but will continue to be supported. For details, see the [Deprecation Process \[KB0867184\]](https://support.servicenow.com/kb_view.do?sysparm_article=KB0867184) article in the Now Support Knowledge Base. ServiceNow Otto® is the new AI experience brand. This change is reflected in the name of ServiceNow products, including the Now Assist for Vulnerability Response product name, which will be replaced with ServiceNow Otto for Unified Security Exposure Management. Your product entitlements remain unchanged. Check your entitlements to determine your access to specific features. | | Brazil | No updates for this release. | [ ] ## New features Between your current release family and Brazil, new features were introduced for Application Vulnerability Response. {#dfrn3-applicationvulnerabilityresponse-summary__entry__8} | Release | Release notes | |-|-| | Australia | [Enhancements to the Invicti Vulnerability Integration](https://www.servicenow.com/docs/access?context=invicti-vuln-integration&family=australia&ft:locale=en-US) : Added the Invicti Platform Integration. Support for the Invicti Platform APIs introduces three new integration jobs that connect directly to the Invicti Platform cloud service: * Application Integration --- Imports the list of applications being scanned in Invicti Platform into your ServiceNow AI Platform® instance as discovered applications. * Scan Integration --- Pulls scan records from Invicti Platform, providing scan metadata to correlate with vulnerability findings. * Vulnerability Integration --- Imports application vulnerability findings from Invicti Platform and creates or updates application vulnerable items in Vulnerability Response in your ServiceNow AI Platform®. Enhancements to Application life-cycle management: When an application is deleted or decommissioned in Invicti Platform, your ServiceNow AI Platform® automatically deactivates the corresponding discovered application and closes all associated application vulnerable items (AVITs), keeping your vulnerability inventory accurate without manual cleanup. [Configuring lookup rules](https://www.servicenow.com/docs/access?context=sem-configure-lookup-rules&family=australia&ft:locale=en-US) : The Applies to field is added to the Rules page for Configuration (CI) lookup rule records. For third-party and ServiceNow® integrations that support both Application Vulnerability Response (AVR) and Vulnerability Response (VR) lookup rules, like the Vulnerability Response Integration with Wiz, for example, select one for a rule: * Discovered Application for Application Vulnerability Response lookup rules. * Discovered Item for Vulnerability Response lookup rules. Note: The field is left empty by default. If you leave this field empty for lookup rules that support both VR and AVR integrations, background jobs for both applications apply changes on the same set of lookup rules. This state might cause a conflict and set the reapply flag incorrectly. With this distinction set, after the respective background jobs for AVR and VR are completed, the system resets the flag only for the lookup rules for the background job that was run. [Activate the Wiz Asset Integration and identify resource types for import](https://www.servicenow.com/docs/access?context=wiz-assets-resources-tab&family=australia&ft:locale=en-US) : Enhancements to the Wiz integration include: * Starting with version 32.1 (USEM) and version 4.1 (non-USEM), the Asset integration is deactivated by default and is not a mandatory prerequisite for the other Wiz integration imports. If you choose to activate it, the Asset integration will retrieve assets for all resource types if you don't specify the ones you want on the Asset Integration Configuration tab. To avoid importing vulnerability data you don't need, identify only the resources (assets) that you want to import with this integration. * Resource Type is no longer a mandatory field for configuring the Vulnerability Response Integration with Wiz. You can now save Wiz configurations for the integrations without specifying a Resource Type, simplifying setup for use cases where specifying a Resource Type isn't appropriate. [Wiz Vulnerability Response Integration](https://www.servicenow.com/docs/access?context=wiz-exploring-avr-sca-secrets&family=australia&ft:locale=en-US) : Import application, Software Composition Analysis (SCA), findings, Secrets (passwords, tokens and keys) data with the following Wiz Vulnerability integrations: * Application List Integration * SCA Findings Integration * Secret Findings Integration You can configure these integrations on the Wiz Vulnerability Integration configuration page along with the other Wiz Vulnerability integrations. View imported application list data such as Product Model and Source application ID from Wiz on the Discovered Applications \[sn_vul_app_release\] table records, and SCA and Secrets data on the Application Vulnerable Items \[sn_vul_app_vulnerable_item\] table records. [GitHub Application Vulnerability Integration -- Generic secrets support](https://www.servicenow.com/docs/access?context=configure-github-vulnerability&family=australia&ft:locale=en-US) : The GitHub Secret Scanning Integration supports imports of generic secrets in addition to standard secrets from your GitHub repositories. An enhanced Manage generic secrets in ServiceNow configuration option lets you control whether generic secrets are ingested. Imported secrets are mapped to Application Vulnerable Items (AVITs) with the scan type, Secret, while generic secrets are mapped with the scan type, Generic Secret. [Improved vulnerability assessment workflows](https://www.servicenow.com/docs/access?context=vr-ws-vuln-assessment&family=australia&ft:locale=en-US) : * CI filtering for vulnerability assessments: You can now filter which configuration items are included in a vulnerability assessment using a condition builder. * Business Application population on AVITs: AVITs created from SBOM assessment results now include Business Application information, helping you understand application impact and prioritize remediation. * Priority roll‑down from vulnerability assessments: Updates to the priority of a vulnerability assessment now automatically roll down to associated VITs and AVITs, ensuring consistent prioritization based on the highest severity. [Enhanced Compensatory controls](https://www.servicenow.com/docs/access?context=requesting-approving-risk-reduction&family=australia&ft:locale=en-US) : When new vulnerable items are ingested and associated with a remediation task that already has an approved compensating control, the reduced risk rating is now automatically inherited by those new vulnerable items. | | Brazil | No updates for this release. | [ ] ## Changes Between your current release family and Brazil, some changes were made to existing Application Vulnerability Response features. {#dfrn3-applicationvulnerabilityresponse-summary__entry__14} | Release | Release notes | |-|-| | Australia | No updates for this release. | | Brazil | No updates for this release. | [ ] ## Removed Between your current release family and Brazil, some Application Vulnerability Response features or functionality were removed. {#dfrn3-applicationvulnerabilityresponse-summary__entry__20} | Release | Release notes | |-|-| | Australia | No updates for this release. | | Brazil | No updates for this release. | [ ] ## Deprecations Between your current release family and Brazil, some Application Vulnerability Response features or functionality were deprecated. {#dfrn3-applicationvulnerabilityresponse-summary__entry__26} | Release | Release notes | |-|-| | Australia | No updates for this release. | | Brazil | No updates for this release. | [ ] ## Activation information Review information on how to activate Application Vulnerability Response. {#dfrn3-applicationvulnerabilityresponse-summary__entry__32} | Release | Release notes | |-|-| | Australia | Activation information : Install Application Vulnerability Response by requesting it from the ServiceNow Store. Visit the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home) to view all the available apps, and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the [ServiceNow Store version history release notes](https://www.servicenow.com/docs/access?context=sn-store-release-notes&family=australia&ft:locale=en-US). Important: Application Vulnerability Response is available in the ServiceNow Store. For details, see the "Activation information" section of these release notes. | | Brazil | No updates for this release. | [ ] ## Additional requirements If any additional requirements were introduced or changed for Application Vulnerability Response we have noted them here. {#dfrn3-applicationvulnerabilityresponse-summary__entry__38} | Release | Release notes | |-|-| | Australia | No updates for this release. | | Brazil | No updates for this release. | [ ] ## Browser requirements If any specific browser requirements were introduced or changed for Application Vulnerability Response we have noted them here. {#dfrn3-applicationvulnerabilityresponse-summary__entry__44} | Release | Release notes | |-|-| | Australia | No updates for this release. | | Brazil | No updates for this release. | [ ] ## Accessibility information Review details on accessibility information for Application Vulnerability Response, such as specific requirements or compliance levels. {#dfrn3-applicationvulnerabilityresponse-summary__entry__50} | Release | Release notes | |-|-| | Australia | No updates for this release. | | Brazil | No updates for this release. | [ ] ## Localization information If there are specific localization considerations for Application Vulnerability Response we have noted them here. {#dfrn3-applicationvulnerabilityresponse-summary__entry__56} | Release | Release notes | |-|-| | Australia | No updates for this release. | | Brazil | No updates for this release. | [ ] ## Highlight information If there are specific highlight considerations for Application Vulnerability Response we have noted them here. {#dfrn3-applicationvulnerabilityresponse-summary__entry__62} | Release | Release notes | |-|-| | Australia | * Import application vulnerability response data that includes application, Software Composition Analysis (SCA) and secrets data with the Wiz Application Vulnerability Response Integration. * If you're currently using Application Vulnerability Response and you want to upgrade to Unified Security Exposure Management (USEM), see [Unified Security Exposure Management (USEM) release notes](https://www.servicenow.com/docs/access?context=secops-sem-rn&family=australia&ft:locale=en-US) for more information about USEM and the Unified Security Exposure Management migration. * Integrate with supported third-party scanners to import vulnerability data and use automated workflows to prioritize, remediate, and manage findings (application vulnerable items (AVITs)). Each application vulnerability represents a vulnerability entry in the Common Weakness Enumeration (CWE) or third-party libraries. * Monitor your penetration test requests and findings, as well as your team's overall progress in the Penetration Test Workspace. * Reevaluate the risk score, assignments, remediation target date, exceptions, and remediation task for a specific set of application vulnerable items in the Vulnerability Manager Workspace. * Compare application vulnerability-related data and determine if application vulnerabilities are found in an application. See [Application Vulnerability Response](https://www.servicenow.com/docs/access?context=app-vuln-mgmt&family=australia&ft:locale=en-US) for more information. | | Brazil | No updates for this release. | [ ]