Combined Now Assist for Security Incident Response release notes for upgrades from Yokohama to Zurich

  • Release version: Zurich
  • Updated August 11, 2026
  • 9 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of Combined Now Assist for Security Incident Response Release Notes for Upgrades from Yokohama to Zurich

    This consolidated guide covers the key updates, new features, configuration changes, and upgrade considerations for Now Assist for Security Incident Response as you move from the Yokohama to Zurich release. It aims to help ServiceNow customers prepare for and manage the upgrade by summarizing important information across multiple patch releases within the Yokohama family and noting the lack of new changes in Zurich.

    Show full answer Show less

    Important Upgrade Information

    • Upgrading to Zurich requires reviewing and completing specified pre- and post-upgrade tasks.
    • From version 2.0.1 onward, the product name changed from Now Assist for Security Operations to Now Assist for Security Incident Response.
    • Activating or upgrading Now Assist plugins may automatically enable default skills if they were previously unconfigured, while skills manually toggled off remain inactive.
    • Enabling the AI Search application is essential for recommended actions skill functionality in Security Incident Response.
    • Zurich release itself contains no new feature, change, or deprecation updates for this product.

    New Features Introduced Between Yokohama and Zurich

    • Agentic Workflows and AI Agents Role Configuration: Additional security role configurations are required to ensure proper execution of workflows and AI agents.
    • Default Activation of Some Skills: New installations automatically enable designated skills; existing customers see any unconfigured skills activated during upgrade.
    • Generative AI Quality Assessment Report: Automatically generate detailed natural language quality assessment reports for security incidents.
    • SIR Shift Handover Report: AI agents assist in populating shift handover reports by extracting relevant incident details and refining content based on analyst feedback.
    • Agentic Workflow for Security Operations Metrics: Analyze team performance metrics like case volume, MTTA, and MTTR with AI-driven suggestions for improvement.
    • Enhanced Correlation Insights: Generate insights based on multiple configuration items, affected users, or observables from any incident state to aid faster triage.
    • Security Incident Resolution Agentic Workflow: AI agents provide resolution plans and assist analysts in incident closure using natural language chat.
    • Improved Closure Experience: Generate resolution notes and post-incident analyses directly from the Now Assist panel or incident modal with options to shorten or elaborate content.
    • Support for Multiple AI Model Providers: Integration with Google Gemini, Anthropic Claude on AWS, in addition to Now LLM Service and Azure OpenAI, expands AI model options.

    Changes and Usage Considerations

    • Several Now Assist skills, including incident summarization, resolution notes generation, post-incident analysis, recommended actions, correlation insights, and quality assessment, are enabled by default for new installs or unconfigured existing setups.
    • Role and data access configurations are critical to ensure agentic workflows and AI agents function correctly.

    Removed and Deprecated Features

    No features were removed or deprecated in either Yokohama or Zurich releases.

    Activation and Additional Requirements

    • Now Assist for Security Incident Response must be requested and installed from the ServiceNow Store.
    • No new additional or browser-specific requirements have been introduced between Yokohama and Zurich.
    • Accessibility and localization considerations remain unchanged.

    Practical Benefits for ServiceNow Customers

    • Improved AI-driven assistance for security incident triage, analysis, resolution, and reporting reduces manual effort and accelerates response times.
    • Default activation of key AI skills ensures out-of-the-box productivity gains for new customers and streamlined upgrade paths for existing customers.
    • Enhanced role configuration control maintains security and governance while enabling advanced AI capabilities.
    • Expanded AI model provider support allows customers to leverage preferred AI technologies within their Security Incident Response workflows.

    Consolidated page of all release notes for Now Assist for Security Incident Response from Yokohama to Zurich.

    How to use this page

    To help you prepare for your upgrade, we have combined the cross-family Now Assist for Security Incident Response release notes onto one page. Read this summary of the new features, changes, and updated information for your product from Yokohama to Zurich.

    Tip:
    If there were no updates for a release notes section in a certain family release, we included a short note for your reference. For example, if a product did not have any updates in Tokyo, the row says "No updates for this release."

    Important information for upgrading Now Assist for Security Incident Response to Zurich

    Before you upgrade to Zurich, review these pre- and post-upgrade tasks and complete the tasks as needed.

    Release Release notes

    Yokohama

    For more information about required applications for Now Assist for Security Incident Response, see Supporting information.

    Note:

    Upgrading the Now Assist plugins activate any designated skills that were previously untouched by the customer.

    • If you have the plugins installed but never touched the configuration (never activated the skill nor adjusted associated roles) of a skill, any Default On skill will be activated on a per skill basis upon upgrading.
    • If you have previously toggled a skill from active and then back to inactive or have updated any roles for that skill, that skill remains inactive upon upgrading.
    • You maintain full control over deactivating individual skills at any time after activation.
    Starting with version 2.0.1, the name of the Now Assist for Security Operations application in ServiceNow® Store and in your ServiceNow AI Platform® instance has changed to Now Assist for Security Incident Response. You must upgrade to version 2.0.1 to access the following features:
    • Generate resolution notes in the Now Assist context menu.
    • Generate correlation insights for a security incident investigation from the Now Assist panel.

    The AI Search application must be enabled so that the recommended actions skill works for security incidents. To verify that AI Search is enabled on your instance, navigate to All > AI Search > AI Search Status. Contact support if the page indicates that AI Search is not enabled.

    Zurich

    		 No updates for this release.

    New features

    Between your current release family and Zurich, new features were introduced for Now Assist for Security Incident Response.

    Release Release notes

    Yokohama
    Yokohama Patch 11
    Role configuration required for agentic workflows and AI agents
    Agentic workflows and AI agents included with Now Assist applications require additional security configuration. If you select Users with selected roles for your user access security controls for an agentic workflow or AI agent, you must add the installed roles, or they will not execute. Data access settings must also include these roles. See the documentation for the agentic workflow or AI agent for the specific roles you must add.
    Some Now Assist skills are turned on by default
    The new default behavior works as follows:
    • New customers: When you install a Now Assist product, designated skills are turned on automatically.
    • Existing customers who are upgrading (starting with Yokohama Patch 11): Any previously unconfigured skill is turned on automatically (the skill was never configured and turned on, then turned off again). Previously configured skills that were turned on, then off, remain inactive.
    Generate a quality assessment report
    Use generative AI to create a quality assessment report of a security incident. The reports are generated using a predefined, natural language rule set. The report provides an overall assessment summary followed by the detailed assessment for all the rules.
    Yokohama Patch 6
    Generate SIR Shift Handover Report
    The AI Agent helps add security incident details to a shift handover report. The agent populates the different sections of the shift handover with appropriate content by identifying the relevant details from the security incident. The AI agent can fetch details of the security incident and identify if the analyst has access to the shift handover record. The AI agent can generate content for each section of the shift handover record and asks for analysts feedback on the content. The AI agent refines the content based on the feedback and saves the content to the records on approval.
    Yokohama Patch 3
    Use agentic workflows
    The Analyze security operations metrics agentic workflow enables security managers to analyze their teams' performance.
    • Generate metrics for Security Incident Response (SIR) records for case volume, mean time to assign (MTTA), and mean time to resolve (MTTR) for a date range of your choosing.
    • Request suggestions for how to improve MTTR, MTTA, and volume based on your metrics.
    Enhancements to correlation insights in Now Assist for Security Incident Response
    You can generate and view results for correlation insights in the Security Incident Response Workspace.
    • Correlation insights are not limited to the primary configuration item (CI) or affected users associated with a security incident. You can base your correlation insights on any CI or affected user for a security incident.
    • You can generate correlation insights from the Investigation tab for a security incident in any state in the Security Incident Response Workspace.
    • You can generate insights for multiple items simultaneously for Associated Observables, Configuration items, and Affected Users.
    • Results are displayed in a modeless dialog that you can size and move.
    Using Security incident resolution agentic workflow
    Use the Security incident resolution agentic workflow to close your security incidents. Analysts can chat with the AI agents in natural language to resolve the security incidents. The AI agent analyzes the incident details, existing runbooks, knowledge articles, and past similar security incidents as inputs, and provides a resolution plan. The AI agent also assists the analysts to resolve the security incident.
    Yokohama Patch 1
    Using Security Incident Response AI agents
    Yokohama Patch 1: Use the Close security incident use case to close your security incidents:
    • Analysts can chat with the AI agents in natural language to close the security incidents. The AI agent can cancel the associated response tasks, generate resolution notes, close code, or close notes and post incident analysis (PIA) during incident closure. Analysts can provide feedback on the content and the AI agent can refine the content​ based on the feedback.
    • Analysts can also close false positive security incidents with minimal user intervention.
    Yokohama Early Availability
    • Generate correlation insights

      Generate correlation insights to connect current security incidents to past events. You can identify the affected users, configuration items (CI)s, or observables (IP addresses and file hashes) from existing incidents and records to help you more quickly triage your new security incidents. Correlation insights are supported in Workspace, the Core UI, and from the Now Assist panel.

    • Enhancements to closure (resolution) notes and post incident analysis generation
      Generate resolution notes from the Close the security incident modal or the Now Assist context menu on a security incident record (SIR). You can also generate resolution notes from the Now Assist panel. If you choose the Now Assist context menu, you have the following options to help you refine the generated text:
      • Shorten: Select the text to remove details.
      • Elaborate: Generate more details about the context of a security incident.
      Note:
      Generating resolution notes is supported in Workspace and Core UI. Generating a post incident analysis is supported from the Close the security incident modal in Workspace.

    Zurich

    		 No updates for this release.

    Changes

    Between your current release family and Zurich, some changes were made to existing Now Assist for Security Incident Response features.

    Release Release notes

    Yokohama
    Yokohama Patch 11
    Changes to Now Assist usage measurement
    Some Now Assist skills are now turned on by default
    The following Now Assist skills for Now Assist for Security Incident Response and Now Assist for Vulnerability Response are activated by default.
    • Security incident summarization (SIR)
    • Resolution notes generation (SIR)
    • Post incident analysis (SIR)
    • Security incident recommended actions (SIR)
    • Correlation insights generation (SIR)
    • Security incident quality assessment (SIR)
    The new default behavior works as follows:
    • New customers: When you install a Now Assist product, designated skills are turned on automatically.
    • Existing customers who are upgrading (starting with Yokohama Patch 11): Any previously unconfigured skill is turned on automatically (the skill was never configured and turned on, then turned off again). Previously configured skills that were turned on, then off, remain inactive.

    Zurich

    		 No updates for this release.

    Removed

    Between your current release family and Zurich, some Now Assist for Security Incident Response features or functionality were removed.

    Release Release notes

    Yokohama

    		 No updates for this release.

    Zurich

    		 No updates for this release.

    Deprecations

    Between your current release family and Zurich, some Now Assist for Security Incident Response features or functionality were deprecated.

    Release Release notes

    Yokohama

    		 No updates for this release.

    Zurich

    		 No updates for this release.

    Activation information

    Review information on how to activate Now Assist for Security Incident Response.

    Release Release notes

    Yokohama

    Install Now Assist for Security Incident Response by requesting it from the ServiceNow Store.

    Zurich

    		 No updates for this release.

    Additional requirements

    If any additional requirements were introduced or changed for Now Assist for Security Incident Response we have noted them here.

    Release Release notes

    Yokohama

    		 No updates for this release.

    Zurich

    		 No updates for this release.

    Browser requirements

    If any specific browser requirements were introduced or changed for Now Assist for Security Incident Response we have noted them here.

    Release Release notes

    Yokohama

    		 No updates for this release.

    Zurich

    		 No updates for this release.

    Accessibility information

    Review details on accessibility information for Now Assist for Security Incident Response, such as specific requirements or compliance levels.

    Release Release notes

    Yokohama

    		 No updates for this release.

    Zurich

    		 No updates for this release.

    Localization information

    If there are specific localization considerations for Now Assist for Security Incident Response we have noted them here.

    Release Release notes

    Yokohama

    		 No updates for this release.

    Zurich

    		 No updates for this release.

    Highlight information

    If there are specific highlight considerations for Now Assist for Security Incident Response we have noted them here.

    Release Release notes

    Yokohama
    Yokohama Patch 11
    • Review changes to Now Assist usage measurement.
    • Some Now Assist skills, agents, and agentic workflows are on by default.
    • Additional role configuration is required for agentic workflows and AI agents included with Now Assist applications.
    • Use generative AI to create a quality assessment report of a security incident.
    • Yokohama Patch 6

      Help analysts to add security incidents details to the Shift Handover report by chatting with AI agents in the Now Assist panel.

      • Use Google Gemini and Anthropic Claude on AWS as AI model providers for Now Assist skills and AI agents in addition to Now LLM Service and Azure OpenAI.
    • Yokohama Patch 3

      Help your analysts to gain insight into security incident record metrics with an agentic workflow. Chat with AI agents in natural language from the Now Assist panel.

      Help your analysts to resolve security incidents by chatting with AI agents in the Now Assist panel where the AI agent provides a resolution plan.

    • Yokohama Patch 1

      Help your analysts to close security incidents more efficiently by chatting with AI agents in natural language from the Now Assist panel.

    • Yokohama early availability
      • Triage security incidents with long activity streams by reviewing work notes and contextual information quickly in a concise, easy-to-read format.
      • Automatically generate resolution notes for security incidents by using generative AI.
      • Generate recommended actions to resolve security incidents.
      • Generate a post-incident analysis.
      • Generate correlation insights to help you connect current incidents to past events. By identifying the affected users, configuration items (CIs), or observables (IP addresses and file hashes) from existing incidents, you can help to triage new security incidents.
      For more information, see Now Assist for Security Incident Response.

    Zurich

    		 No updates for this release.