---
sourceDocument: brazil Combined Product Files
sourceDocumentLink: https://www.servicenow.com/docs/r/delta-yokohama-brazil

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - brazil Combined Product Files

ft:clusterId :

    - delta3by

bundleId :

    - delta3by


---

# Combined Application Vulnerability Response release notes for upgrades from Yokohama to Brazil

# Combined Application Vulnerability Response release notes for upgrades from Yokohama to Brazil {#ariaid-title1}

Release version: Brazil  
Updated October 8, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 21 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Combined Application Vulnerability Response Release Notes for Upgrades from Yokohama to Brazil

This consolidated release note summary guides ServiceNow customers upgrading the Application Vulnerability Response (AVR) application from Yokohama through Brazil releases.
It highlights key new features, enhancements, changes, and important upgrade considerations to help you effectively manage application vulnerabilities and streamline remediation workflows within your ServiceNow environment.
Show full answer Show less  

## Key Features and Enhancements

* **Unassign Workflow Support:** Streamline assignment management for Application Vulnerable Items (AVITs) and remediation tasks (AVULs) with the ability to unassign and optionally send unassign requests for approval, improving triage accuracy.
* **SBOM Document Upload via GitHub Action:** Automate upload of valid Software Bill of Materials (SBOM) documents to the ServiceNow platform through GitHub Actions, simplifying SBOM management.
* **Manual Creation of Application Remediation Tasks:** Roles with `snvul.appsecmanager` or `snvul.appsecuritychampion` can create remediation tasks from selected AVITs in Vulnerability Manager or IT Remediation Workspaces, grouped by configurable criteria.
* **Manual Vulnerability Ingestion:** Import AVITs from external sources (e.g., CSV, Excel) including penetration test findings, allowing centralized management of vulnerability data from diverse inputs.
* **Penetration Test Workspace:** Monitor penetration test requests, findings, and team progress with dashboard visualizations prioritizing critical requests and remediation status.
* **Expanded Penetration Test Assessment Types:** Support for Emergency Release, Bug Bounty Program, Release Approvals, One-off Reviews, and Executive Interest assessment types enhances flexibility in penetration testing workflows.
* **Change Request Integration:** Users with appropriate roles can create change requests directly from remediation tasks for vulnerabilities associated with configuration items (CIs), accelerating investigation and remediation.
* **Enhanced Software Bill of Materials (SBOM) Workspace:** Bulk deletion of BOM entity records and automatic closure of associated AVITs improve SBOM data management efficiency.
* **Risk Score Tracking:** Optionally view detailed risk score changes in AVIT work notes to improve auditability of vulnerability risk evolution.
* **Third-Party Integrations:**
  * **Tenable Web Application Scanning:** Supports on-demand import of applications and vulnerabilities, enabling timely ingestion and visibility.
  * **Wiz Integration Enhancements:** Flexible asset import configuration, support for application, Software Composition Analysis (SCA), and secret findings, and ability to map imported data accurately.
  * **Invicti Platform Integration:** Automates import of applications, scans, and vulnerabilities, with lifecycle management that deactivates or closes AVITs when applications are decommissioned.
  * **GitHub Secret Scanning:** Supports import of both standard and generic secrets, providing improved vulnerability coverage for secrets management.
* **Improved Vulnerability Assessment Workflows:** Features include CI filtering via condition builder, automatic population of business application data on AVITs, and priority roll-down from assessments ensuring consistent prioritization.
* **Enhanced Compensatory Controls:** New vulnerable items linked to remediation tasks with approved compensating controls automatically inherit reduced risk ratings, streamlining risk management.

## Important Upgrade Considerations

* Review pre- and post-upgrade tasks specific to each release family (Yokohama, Zurich, Australia) before upgrading to Brazil.
* For customers not upgrading to Unified Security Exposure Management (USEM), certain versions below v30.x are recommended for Application Vulnerability Response and compatible third-party integrations.
* ServiceNow Otto® branding replaces Now Assist for Vulnerability Response; entitlements remain unchanged.
* Change requests require discovered applications to be associated with configuration items; ensure the `Use Product Model` system property is set accordingly.
* Australia Patch 5 initiates deprecation of Now Assist for Vulnerability Response, moving towards ServiceNow Otto for USEM.

## Changes and Updates

* Coral theme introduced as default UI theme for portals and mobile, with dark mode option, enhancing user experience.
* Configurable maximum rows in related lists improve readability and performance.
* Refined state management between remediation tasks and vulnerable items improves automation, clarity, and reduces manual intervention.
* Configuration enhancements allow distinguishing lookup rules for Application Vulnerability Response and Vulnerability Response to prevent conflicts.

## Activation and Compatibility

Application Vulnerability Response is available via the ServiceNow Store and typically installed as part of the Vulnerability Response application. Software Bill of Materials applications require separate subscription. Always verify compatibility matrices and release schema changes before upgrade.

## Customer Benefits

* Improved assignment and remediation task workflows reduce errors and improve vulnerability triage efficiency.
* Automated imports and integrations with  
Consolidated page of all release notes for Application Vulnerability Response from Yokohama to Brazil.

## How to use this page

To help you prepare for your upgrade, we have combined the cross-family Application Vulnerability Response release notes onto one page. Read this summary of the new features, changes, and updated information for your product from Yokohama to Brazil.  
Tip:  
If there were no updates for a release notes section in a certain family release, we included a short note for your reference. For example, if a product did not have any updates in Tokyo, the row says "No updates for this release."

## Important information for upgrading Application Vulnerability Response to Brazil

Before you upgrade to Brazil, review these pre- and post-upgrade tasks and complete the tasks as needed.  
{#dfrn3-applicationvulnerabilityresponse-summary__entry__2}

| Release | Release notes |
|-|-|
| Yokohama | Upgrade information : * For information about the new features of Vulnerability Response, see [Vulnerability Response release notes](https://www.servicenow.com/docs/access?context=secops-vuln-resp-rn&family=yokohama&ft:locale=en-US). * For more information about the released versions of the Application Vulnerability Response application as well as the third-party and ServiceNow applications that are compatible with the Xanadu release, see the [Vulnerability Response Compatibility Matrix and Release Schema Changes \[KB0856498\]](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0856498) article in the Now Support Knowledge Base. |
| Zurich | Upgrade information : * If you are currently using Application Vulnerability Response, and you do not intend to upgrade to Unified Security Exposure Management (USEM), install a version below v30.x of Application Vulnerability Response and for upgrades to supported third-party integration applications. * For information about the new features of Vulnerability Response, see the [Vulnerability Response release notes](https://www.servicenow.com/docs/access?context=secops-vuln-resp-rn&family=zurich&ft:locale=en-US). * For more information about the released versions of the Application Vulnerability Response application as well as the third-party and ServiceNow applications that are compatible with the Zurich release, see the [Vulnerability Response Compatibility Matrix and Release Schema Changes \[KB0856498\]](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0856498) article in the Now Support Knowledge Base. |
| Australia | Upgrade information : * If you are currently using Application Vulnerability Response, and you do not intend to upgrade to Unified Security Exposure Management (USEM), install a version below v30.x of Application Vulnerability Response and for upgrades to supported third-party integration applications. * For information about the new features of Vulnerability Response, see the [Vulnerability Response release notes](https://www.servicenow.com/docs/access?context=secops-vuln-resp-rn&family=australia&ft:locale=en-US). * For more information about the released versions of the Application Vulnerability Response application as well as the third-party and ServiceNow applications that are compatible with the Australia release, see the [Vulnerability Response Compatibility Matrix and Release Schema Changes \[KB0856498\]](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0856498) article in the Now Support Knowledge Base. Starting with Australia Patch 5, Now Assist for Vulnerability Response is being prepared for future deprecation. It will be hidden and no longer installed on new instances but will continue to be supported. For details, see the [Deprecation Process \[KB0867184\]](https://support.servicenow.com/kb_view.do?sysparm_article=KB0867184) article in the Now Support Knowledge Base. ServiceNow Otto® is the new AI experience brand. This change is reflected in the name of ServiceNow products, including the Now Assist for Vulnerability Response product name, which will be replaced with ServiceNow Otto for Unified Security Exposure Management. Your product entitlements remain unchanged. Check your entitlements to determine your access to specific features. |
| Brazil | No updates for this release. |
[ ]

## New features

Between your current release family and Brazil, new features were introduced for Application Vulnerability Response.  
{#dfrn3-applicationvulnerabilityresponse-summary__entry__12}

| Release | Release notes |
|-|-|
| Yokohama | [Enhancements to Application Vulnerability Response](https://www.servicenow.com/docs/access?context=Unassigning_vis&family=yokohama&ft:locale=en-US) :   The Unassign workflow is supported for application vulnerable items (AVITs) and remediation tasks (AVULs). * Streamline application vulnerability assignments with the Unassign UI action from the more actions menu on an AVIT. * Reassign incorrectly assigned AVITs, clarify ownership for reassessment, and maintain accurate triage records in workspace views. * You have the option to send unassign requests for approval prior to clearing the Assigned to and Assignment group fields on records. [SBOM document upload via Github Action](https://www.servicenow.com/docs/access?context=vr-sbom-supported-apps&family=yokohama&ft:locale=en-US) :   Upload valid Software Bill of Material (SBOM) documents to ServiceNow platform with the help of GitHub Action. [Create application remediation tasks manually in the Vulnerability Manager Workspace](https://www.servicenow.com/docs/access?context=vmws-create-remediation-task&family=yokohama&ft:locale=en-US) :   With the sn_vul.app_sec_manager role, you can create application remediation tasks manually by selecting some or all the records in the Application vulnerable items' lists in the Vulnerability Manager Workspace. These records are grouped into one or more remediation tasks according to the grouping criteria selected while creating application remediation tasks. [Create application remediation tasks manually in the IT Remediation Workspace](https://www.servicenow.com/docs/access?context=itr-ws-create-remediation-task&family=yokohama&ft:locale=en-US) :   With the sn_vul.app_security_champion role, you can create application remediation tasks manually by selecting desired records in the Application vulnerable items' lists in the IT Remediation Workspace. These records are grouped into one or more remediation tasks according to the grouping criteria selected while creating application remediation tasks. [Manual Ingestion of vulnerabilities for application vulnerability response](https://www.servicenow.com/docs/access?context=manual-ingestion-of-vulnerabilities-for-application-vulnerability-response&family=yokohama&ft:locale=en-US) :   Import AVITs from external sources via a standardised template (e.g., CSV, Excel) and manage Penetration test findings lifecycle. Now, you can ingest vulnerability data, including details such as affected application, vulnerability description, severity, remediation recommendations, including other necessary details. This enhancement allows you to simplifies the process of consolidating vulnerability data from diverse sources into a centralised Penetration test workspace. [Penetration Test Workspace](https://www.servicenow.com/docs/access?context=penetration-testing-dashboard&family=yokohama&ft:locale=en-US) :   Monitor your penetration test requests and findings as well as your team's overall progress in the Penetration Test Workspace. Prioritize tests that need your attention, track findings, and view assignments with the following data visualizations on the dashboard: * Important items. * Penetration test requests that are critical and by state. * Reported findings. * Overall remediation progress based on assignment. [Enhancements to Penetration Test Assessment Requests](https://www.servicenow.com/docs/access?context=pen_test_dashboard_components&family=yokohama&ft:locale=en-US) :   Along with Full Penetration, Focused, and Re-test, the following assessment types are included for Penetration Test Assessment Requests forms in the Penetration Test Workspace: * Emergency Release - Supports emergency releases that are required for rapid software updates to address critical issues like security vulnerabilities. * Bug Bounty Program - Rewards ethical hackers to find and report security vulnerabilities. * Release Approvals - Ensure that all necessary checks are completed before deploying new software. * One-off reviews - Assess specific projects outside regular development and release cycles to evaluate performance and implement improvements. * Executive Interest - Report on senior management's engagement and support for critical projects within the organization. Enhancements to the Release Approval and Release Notes fields help you ensure quality and security for your pen test findings. The following states have been added to the Release approval field: * Not Applicable (Default). * Approved. * Denied. You can add details to justify your release approvals in the Release notes field. [Associate CWEs for manual AVIT creation from Penetration Test Assessment Requests](https://www.servicenow.com/docs/access?context=penetration-testing-dashboard&family=yokohama&ft:locale=en-US) :   On the Penetration test findings tab on Penetration Test Assessment Requests, you have the option to associate Common Weakness Enumerations (CWE)s or Common Vulnerabilities and Exposures (CVE)s in the Vulnerability field for manually created AVITs. Create change requests in Application Vulnerability Response :   Users with the sn_vul.app_sec_manager and sn_vul.app_sec_champion roles as well as users with the sn_vul.app_developer role who have the ITIL role can create change requests from remediation tasks in the Application Vulnerability Response application. Create change requests to expedite your investigation for application vulnerabilities (AVIT)s that require manual intervention. * Create change requests with prepopulated information for scanned applications that are classified as configuration items (CI)s. * The change request workflow in Application Vulnerability Response is similar to the workflow supported in Vulnerability Response. For more information about the Vulnerability Response change request workflow, see [Change management for Vulnerability Response](https://www.servicenow.com/docs/access?context=vuln-change_mgmnt_ovrvw&family=yokohama&ft:locale=en-US). Note: Change requests are supported for Application Vulnerability Response only if the discovered application is associated with a configuration item (CI). You must set Product model to False in the Use Product Model \[sn_vul.use_product_model\] system property to associate a discovered application with a CI. [Enhancements to the Software Bill of Materials Workspace](https://www.servicenow.com/docs/access?context=sbom-landing&family=yokohama&ft:locale=en-US) : * You can delete multiple BOM entity records and their related components with bulk edit from the Software Bill of Materials SBOM SBOM Workspace. * Any Application Vulnerable Items (AVIT)s that are associated with deleted BOM entities automatically transition to Closed. [View risk score details of a vulnerable items in the Work notes section](https://www.servicenow.com/docs/access?context=avm-calculators-rules&family=yokohama&ft:locale=en-US) :   Starting with v25.0.3 of Application Vulnerability Response, the system property sn_sec_cmn.risk_score_changes_add_worknotes is inactive by default. If you enable it, only then you can see all the changes related to the risk score of an application vulnerable item in the Work notes section. Additionally, the work notes are updated only if there's a change in the risk score. |
| Zurich | [Enhanced Compensatory controls](https://www.servicenow.com/docs/access?context=requesting-approving-risk-reduction&family=zurich&ft:locale=en-US) :   When new vulnerable items are ingested and associated with a remediation task that already has an approved compensating control, the reduced risk rating is now automatically inherited by those new vulnerable items. [Improved vulnerability assessment workflows](https://www.servicenow.com/docs/access?context=vr-ws-vuln-assessment&family=zurich&ft:locale=en-US) : * CI filtering for vulnerability assessments: You can now filter which configuration items are included in a vulnerability assessment using a condition builder. * Business Application population on AVITs: AVITs created from SBOM assessment results now include Business Application information, helping you understand application impact and prioritize remediation. * Priority roll‑down from vulnerability assessments: Updates to the priority of a vulnerability assessment now automatically roll down to associated VITs and AVITs, ensuring consistent prioritization based on the highest severity. [Remediation task rule execution mode](https://www.servicenow.com/docs/access?context=sem-grouping-multiple-findings-remediation-tasks-processing&family=zurich&ft:locale=en-US) :   You can now choose how remediation task rules are evaluated during ingestion. The new Match First execution mode evaluates rules sequentially and applies only the first matching rule, assigning each finding to exactly one remediation task. The default Match All mode continues to evaluate all applicable rules. [GitHub Application Vulnerability Integration -- Generic secrets support](https://www.servicenow.com/docs/access?context=github-vuln-integration&family=zurich&ft:locale=en-US) :   The GitHub Secret Scanning Integration now imports generic secrets in addition to standard secrets from your GitHub repositories. A new Manage generic secrets in ServiceNow configuration option lets you control whether generic secrets are ingested. Imported secrets are mapped to Application Vulnerable Items (AVIs) with the scan type Secret, while generic secrets are mapped with the scan type Generic Secret. [Enhancements to Application Vulnerability Response](https://www.servicenow.com/docs/access?context=Unassigning_vis&family=zurich&ft:locale=en-US) :   The Unassign workflow is supported for application vulnerable items (AVITs) and remediation tasks (AVULs). * Streamline application vulnerability assignments with the Unassign UI action from the more actions menu on an AVIT. * Reassign incorrectly assigned AVITs, clarify ownership for reassessment, and maintain accurate triage records in workspace views. * You have the option to send unassign requests for approval prior to clearing the Assigned to and Assignment group fields on records. [SBOM document upload via Github Action](https://www.servicenow.com/docs/access?context=vr-sbom-supported-apps&family=zurich&ft:locale=en-US) :   Upload valid Software Bill of Material (SBOM) documents to ServiceNow platform with the help of GitHub Action. [Create application remediation tasks manually in the Vulnerability Manager Workspace](https://www.servicenow.com/docs/access?context=vmws-create-remediation-task&family=zurich&ft:locale=en-US) :   With the sn_vul.app_sec_manager role, you can create application remediation tasks manually by selecting some or all the records in the Application vulnerable items' lists in the Vulnerability Manager Workspace. These records are grouped into one or more remediation tasks according to the grouping criteria selected while creating application remediation tasks. [Create application remediation tasks manually in the IT Remediation Workspace](https://www.servicenow.com/docs/access?context=itr-ws-create-remediation-task&family=zurich&ft:locale=en-US) :   With the sn_vul.app_security_champion role, you can create application remediation tasks manually by selecting desired records in the Application vulnerable items' lists in the IT Remediation Workspace. These records are grouped into one or more remediation tasks according to the grouping criteria selected while creating application remediation tasks. [Tenable Web Application Scanning Vulnerability Response Integration](https://www.servicenow.com/docs/access?context=tenable-was-integration&family=zurich&ft:locale=en-US) :   The Tenable.was integration now supports on‑demand execution of both application and vulnerability imports, allowing you to quickly ingest web applications, findings, and scan metadata into ServiceNow. Imported data automatically populates Discovered Applications, Vulnerability Entries, Scan Summaries, and AVITs, with full visibility through integration run tracking. [Manual Ingestion of Vulnerabilities for Application Vulnerability Integration](https://www.servicenow.com/docs/access?context=manual-ingestion-of-vulnerabilities-for-application-vulnerability-response&family=zurich&ft:locale=en-US) :   Import AVITs from external sources via a standardised template (e.g., CSV, Excel) and manage Penetration test findings lifecycle. Now, you can ingest vulnerability data, including details such as affected application, vulnerability description, severity, remediation recommendations, including other necessary details. This enhancement allows you to simplifies the process of consolidating vulnerability data from diverse sources into a centralised Penetration test workspace. [Penetration Test Workspace](https://www.servicenow.com/docs/access?context=penetration-testing-dashboard&family=zurich&ft:locale=en-US) :   Monitor your penetration test requests and findings as well as your team's overall progress in the Penetration Test Workspace. Prioritize tests that need your attention, track findings, and view assignments with the following data visualizations on the dashboard: * Important items. * Penetration test requests that are critical and by state. * Reported findings. * Overall remediation progress based on assignment. [Enhancements to Penetration Test Assessment Requests](https://www.servicenow.com/docs/access?context=pen_test_dashboard_components&family=zurich&ft:locale=en-US) :   Along with Full Penetration, Focused, and Re-test, the following assessment types are included for Penetration Test Assessment Requests forms in the Penetration Test Workspace: * Emergency Release - Supports emergency releases that are required for rapid software updates to address critical issues like security vulnerabilities. * Bug Bounty Program - Rewards ethical hackers to find and report security vulnerabilities. * Release Approvals - Ensure that all necessary checks are completed before deploying new software. * One-off reviews - Assess specific projects outside regular development and release cycles to evaluate performance and implement improvements. * Executive Interest - Report on senior management's engagement and support for critical projects within the organization. Enhancements to the Release Approval and Release Notes fields help you ensure quality and security for your pen test findings. The following states have been added to the Release approval field: * Not Applicable (Default). * Approved. * Denied. You can add details to justify your release approvals in the Release notes field. [Associate CWEs for manual AVIT creation from Penetration Test Assessment Requests](https://www.servicenow.com/docs/access?context=penetration-testing-dashboard&family=zurich&ft:locale=en-US) :   On the Penetration test findings tab on Penetration Test Assessment Requests, you have the option to associate Common Weakness Enumerations (CWE)s or Common Vulnerabilities and Exposures (CVE)s in the Vulnerability field for manually created AVITs. Create change requests in Application Vulnerability Response :   Users with the sn_vul.app_sec_manager and sn_vul.app_sec_champion roles as well as users with the sn_vul.app_developer role who have the ITIL role can create change requests from remediation tasks in the Application Vulnerability Response application. Create change requests to expedite your investigation for application vulnerabilities (AVIT)s that require manual intervention. * Create change requests with prepopulated information for scanned applications that are classified as configuration items (CI)s. * The change request workflow in Application Vulnerability Response is similar to the workflow supported in Vulnerability Response. For more information about the Vulnerability Response change request workflow, see [Change management for Vulnerability Response](https://www.servicenow.com/docs/access?context=vuln-change_mgmnt_ovrvw&family=zurich&ft:locale=en-US). Note: Change requests are supported for Application Vulnerability Response only if the discovered application is associated with a configuration item (CI). You must set Product model to False in the Use Product Model \[sn_vul.use_product_model\] system property to associate a discovered application with a CI. [Enhancements to the Software Bill of Materials Workspace](https://www.servicenow.com/docs/access?context=sbom-landing&family=zurich&ft:locale=en-US) : * You can delete multiple BOM entity records and their related components with bulk edit from the Software Bill of Materials SBOM SBOM Workspace. * Any Application Vulnerable Items (AVIT)s that are associated with deleted BOM entities automatically transition to Closed. [View risk score details of a vulnerable items in the Work notes section](https://www.servicenow.com/docs/access?context=avm-calculators-rules&family=zurich&ft:locale=en-US) :   Starting with v25.0.3 of Application Vulnerability Response, the system property sn_sec_cmn.risk_score_changes_add_worknotes is inactive by default. If you enable it, only then you can see all the changes related to the risk score of an application vulnerable item in the Work notes section. Additionally, the work notes are updated only if there's a change in the risk score. |
| Australia | [Enhancements to the Invicti Vulnerability Integration](https://www.servicenow.com/docs/access?context=invicti-vuln-integration&family=australia&ft:locale=en-US) :   Added the Invicti Platform Integration. Support for the Invicti Platform APIs introduces three new integration jobs that connect directly to the Invicti Platform cloud service: * Application Integration --- Imports the list of applications being scanned in Invicti Platform into your ServiceNow AI Platform® instance as discovered applications. * Scan Integration --- Pulls scan records from Invicti Platform, providing scan metadata to correlate with vulnerability findings. * Vulnerability Integration --- Imports application vulnerability findings from Invicti Platform and creates or updates application vulnerable items in Vulnerability Response in your ServiceNow AI Platform®. Enhancements to Application life-cycle management: When an application is deleted or decommissioned in Invicti Platform, your ServiceNow AI Platform® automatically deactivates the corresponding discovered application and closes all associated application vulnerable items (AVITs), keeping your vulnerability inventory accurate without manual cleanup. [Configuring lookup rules](https://www.servicenow.com/docs/access?context=sem-configure-lookup-rules&family=australia&ft:locale=en-US) :   The Applies to field is added to the Rules page for Configuration (CI) lookup rule records. For third-party and ServiceNow® integrations that support both Application Vulnerability Response (AVR) and Vulnerability Response (VR) lookup rules, like the Vulnerability Response Integration with Wiz, for example, select one for a rule: * Discovered Application for Application Vulnerability Response lookup rules. * Discovered Item for Vulnerability Response lookup rules. Note: The field is left empty by default. If you leave this field empty for lookup rules that support both VR and AVR integrations, background jobs for both applications apply changes on the same set of lookup rules. This state might cause a conflict and set the reapply flag incorrectly. With this distinction set, after the respective background jobs for AVR and VR are completed, the system resets the flag only for the lookup rules for the background job that was run. [Activate the Wiz Asset Integration and identify resource types for import](https://www.servicenow.com/docs/access?context=wiz-assets-resources-tab&family=australia&ft:locale=en-US) :   Enhancements to the Wiz integration include: * Starting with version 32.1 (USEM) and version 4.1 (non-USEM), the Asset integration is deactivated by default and is not a mandatory prerequisite for the other Wiz integration imports. If you choose to activate it, the Asset integration will retrieve assets for all resource types if you don't specify the ones you want on the Asset Integration Configuration tab. To avoid importing vulnerability data you don't need, identify only the resources (assets) that you want to import with this integration. * Resource Type is no longer a mandatory field for configuring the Vulnerability Response Integration with Wiz. You can now save Wiz configurations for the integrations without specifying a Resource Type, simplifying setup for use cases where specifying a Resource Type isn't appropriate. [Wiz Vulnerability Response Integration](https://www.servicenow.com/docs/access?context=wiz-exploring-avr-sca-secrets&family=australia&ft:locale=en-US) :   Import application, Software Composition Analysis (SCA), findings, Secrets (passwords, tokens and keys) data with the following Wiz Vulnerability integrations: * Application List Integration * SCA Findings Integration * Secret Findings Integration You can configure these integrations on the Wiz Vulnerability Integration configuration page along with the other Wiz Vulnerability integrations. View imported application list data such as Product Model and Source application ID from Wiz on the Discovered Applications \[sn_vul_app_release\] table records, and SCA and Secrets data on the Application Vulnerable Items \[sn_vul_app_vulnerable_item\] table records. [GitHub Application Vulnerability Integration -- Generic secrets support](https://www.servicenow.com/docs/access?context=configure-github-vulnerability&family=australia&ft:locale=en-US) :   The GitHub Secret Scanning Integration supports imports of generic secrets in addition to standard secrets from your GitHub repositories. An enhanced Manage generic secrets in ServiceNow configuration option lets you control whether generic secrets are ingested. Imported secrets are mapped to Application Vulnerable Items (AVITs) with the scan type, Secret, while generic secrets are mapped with the scan type, Generic Secret. [Improved vulnerability assessment workflows](https://www.servicenow.com/docs/access?context=vr-ws-vuln-assessment&family=australia&ft:locale=en-US) : * CI filtering for vulnerability assessments: You can now filter which configuration items are included in a vulnerability assessment using a condition builder. * Business Application population on AVITs: AVITs created from SBOM assessment results now include Business Application information, helping you understand application impact and prioritize remediation. * Priority roll‑down from vulnerability assessments: Updates to the priority of a vulnerability assessment now automatically roll down to associated VITs and AVITs, ensuring consistent prioritization based on the highest severity. [Enhanced Compensatory controls](https://www.servicenow.com/docs/access?context=requesting-approving-risk-reduction&family=australia&ft:locale=en-US) :   When new vulnerable items are ingested and associated with a remediation task that already has an approved compensating control, the reduced risk rating is now automatically inherited by those new vulnerable items. |
| Brazil | No updates for this release. |
[ ]

## Changes

Between your current release family and Brazil, some changes were made to existing Application Vulnerability Response features.  
{#dfrn3-applicationvulnerabilityresponse-summary__entry__22}

| Release | Release notes |
|-|-|
| Yokohama | No updates for this release. |
| Zurich | Coral theme :   Coral is now the default theme for new portal, web, and mobile experiences with Next Experience or Core UI enabled. This theme provides a fresh look and feel, featuring brand-neutral illustrations to enhance your user experience. A dark theme option is available for web and mobile experiences. [Configure maximum rows in related lists](https://www.servicenow.com/docs/access?context=avm-configuring&family=zurich&ft:locale=en-US) :   To improve readability and performance, you can now limit the number of rows shown in related lists on forms by setting the system property sn_vul_cmn.related_list.set_max_row. [Improved state management for remediation tasks and vulnerable items](https://www.servicenow.com/docs/access?context=vr-rt-states&family=zurich&ft:locale=en-US) :   State management logic for roll down of state from remediation tasks (RTs) to findings and roll up of state from findings to RTs has been refined across all modules. Updates improve accuracy by handling mixed item states (a combination of Deferred and Closed), supporting closure of tasks in sub-states like In-Review, and reopening tasks based on the Assigned To field. The update also improves handling of False Positive state transitions based on scanner results as source of truth. These enhancements reduce manual effort, clarify task ownership, and streamline remediation workflows. |
| Australia | No updates for this release. |
| Brazil | No updates for this release. |
[ ]

## Removed

Between your current release family and Brazil, some Application Vulnerability Response features or functionality were removed.  
{#dfrn3-applicationvulnerabilityresponse-summary__entry__32}

| Release | Release notes |
|-|-|
| Yokohama | No updates for this release. |
| Zurich | No updates for this release. |
| Australia | No updates for this release. |
| Brazil | No updates for this release. |
[ ]

## Deprecations

Between your current release family and Brazil, some Application Vulnerability Response features or functionality were deprecated.  
{#dfrn3-applicationvulnerabilityresponse-summary__entry__42}

| Release | Release notes |
|-|-|
| Yokohama | No updates for this release. |
| Zurich | No updates for this release. |
| Australia | No updates for this release. |
| Brazil | No updates for this release. |
[ ]

## Activation information

Review information on how to activate Application Vulnerability Response.  
{#dfrn3-applicationvulnerabilityresponse-summary__entry__52}

| Release | Release notes |
|-|-|
| Yokohama | Activation information :   Install Application Vulnerability Response by requesting it from the ServiceNow Store. Application Vulnerability Response is included as a part of the Vulnerability Response application. The Software Bill of Materials applications require a separate subscription. Visit the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home) website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the [ServiceNow Store version history release notes](https://www.servicenow.com/docs/access?context=sn-store-release-notes&family=yokohama&ft:locale=en-US). Important: Application Vulnerability Response is available in the ServiceNow Store. For details, see the "Activation information" section of these release notes. |
| Zurich | Activation information :   Install Vulnerability Response and third-party integrations by requesting them from the ServiceNow Store. Visit the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home) website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the [ServiceNow Store version history release notes](https://www.servicenow.com/docs/access?context=sn-store-release-notes&family=zurich&ft:locale=en-US). Important: Application Vulnerability Response is available in the ServiceNow Store. For details, see the "Activation information" section of these release notes. |
| Australia | Activation information :   Install Application Vulnerability Response by requesting it from the ServiceNow Store. Visit the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home) to view all the available apps, and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the [ServiceNow Store version history release notes](https://www.servicenow.com/docs/access?context=sn-store-release-notes&family=australia&ft:locale=en-US). Important: Application Vulnerability Response is available in the ServiceNow Store. For details, see the "Activation information" section of these release notes. |
| Brazil | No updates for this release. |
[ ]

## Additional requirements

If any additional requirements were introduced or changed for Application Vulnerability Response we have noted them here.  
{#dfrn3-applicationvulnerabilityresponse-summary__entry__62}

| Release | Release notes |
|-|-|
| Yokohama | No updates for this release. |
| Zurich | No updates for this release. |
| Australia | No updates for this release. |
| Brazil | No updates for this release. |
[ ]

## Browser requirements

If any specific browser requirements were introduced or changed for Application Vulnerability Response we have noted them here.  
{#dfrn3-applicationvulnerabilityresponse-summary__entry__72}

| Release | Release notes |
|-|-|
| Yokohama | No updates for this release. |
| Zurich | No updates for this release. |
| Australia | No updates for this release. |
| Brazil | No updates for this release. |
[ ]

## Accessibility information

Review details on accessibility information for Application Vulnerability Response, such as specific requirements or compliance levels.  
{#dfrn3-applicationvulnerabilityresponse-summary__entry__82}

| Release | Release notes |
|-|-|
| Yokohama | No updates for this release. |
| Zurich | No updates for this release. |
| Australia | No updates for this release. |
| Brazil | No updates for this release. |
[ ]

## Localization information

If there are specific localization considerations for Application Vulnerability Response we have noted them here.  
{#dfrn3-applicationvulnerabilityresponse-summary__entry__92}

| Release | Release notes |
|-|-|
| Yokohama | No updates for this release. |
| Zurich | No updates for this release. |
| Australia | No updates for this release. |
| Brazil | No updates for this release. |
[ ]

## Highlight information

If there are specific highlight considerations for Application Vulnerability Response we have noted them here.  
{#dfrn3-applicationvulnerabilityresponse-summary__entry__102}

| Release | Release notes |
|-|-|
| Yokohama | * Monitor your penetration test requests and findings, as well as your team's overall progress in the Penetration Test Workspace. * Reevaluate the risk score, assignments, remediation target date, exceptions, and remediation task for a specific set of application vulnerable items in the Vulnerability Manager Workspace. * Integrate with supported third-party scanners to import vulnerability data. * Compare application vulnerability-related data and determine if application vulnerabilities are found in an application. * Prioritize, remediate, and manage application vulnerable items (AVIT)s. Each application vulnerability represents a vulnerability entry in the Common Weakness Enumeration (CWE) or third-party libraries. * With the sn_vul.app_sec_manager role, create application remediation tasks manually in the Vulnerability Manager Workspace. * With the sn_vul.app_security_champion role, create application remediation tasks manually in the IT Remediation Workspace. See [Application Vulnerability Response](https://www.servicenow.com/docs/access?context=avr-landing&family=yokohama&ft:locale=en-US) for more information. |
| Zurich | * If you are currently using Application Vulnerability Response and you want to upgrade to Unified Security Exposure Management (USEM), see [Unified Security Exposure Management release notes](https://www.servicenow.com/docs/access?context=secops-sem-rn&family=zurich&ft:locale=en-US) for more information about USEM and the Unified Security Exposure Management migration. * Monitor your penetration test requests and findings, as well as your team's overall progress in the Penetration Test Workspace. * Reevaluate the risk score, assignments, remediation target date, exceptions, and remediation task for a specific set of application vulnerable items in the Vulnerability Manager Workspace. * Integrate with supported third-party scanners to import vulnerability data. * Compare application vulnerability-related data and determine if application vulnerabilities are found in an application. * Prioritize, remediate, and manage application vulnerable items (AVIT)s. Each application vulnerability represents a vulnerability entry in the Common Weakness Enumeration (CWE) or third-party libraries. * With the sn_vul.app_sec_manager role, create application remediation tasks manually in the Vulnerability Manager Workspace. See [Application Vulnerability Response](https://www.servicenow.com/docs/access?context=avr-landing&family=zurich&ft:locale=en-US) for more information. |
| Australia | * Import application vulnerability response data that includes application, Software Composition Analysis (SCA) and secrets data with the Wiz Application Vulnerability Response Integration. * If you're currently using Application Vulnerability Response and you want to upgrade to Unified Security Exposure Management (USEM), see [Unified Security Exposure Management (USEM) release notes](https://www.servicenow.com/docs/access?context=secops-sem-rn&family=australia&ft:locale=en-US) for more information about USEM and the Unified Security Exposure Management migration. * Integrate with supported third-party scanners to import vulnerability data and use automated workflows to prioritize, remediate, and manage findings (application vulnerable items (AVITs)). Each application vulnerability represents a vulnerability entry in the Common Weakness Enumeration (CWE) or third-party libraries. * Monitor your penetration test requests and findings, as well as your team's overall progress in the Penetration Test Workspace. * Reevaluate the risk score, assignments, remediation target date, exceptions, and remediation task for a specific set of application vulnerable items in the Vulnerability Manager Workspace. * Compare application vulnerability-related data and determine if application vulnerabilities are found in an application. See [Application Vulnerability Response](https://www.servicenow.com/docs/access?context=app-vuln-mgmt&family=australia&ft:locale=en-US) for more information. |
| Brazil | No updates for this release. |
[ ]