Combined Operational Technology Vulnerability Response release notes for upgrades from Yokohama to Zurich

  • Release version: Zurich
  • Updated August 11, 2026
  • 7 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of Combined Operational Technology Vulnerability Response release notes for upgrades from Yokohama to Zurich

    This consolidated release notes document provides ServiceNow customers with essential information for upgrading the Operational Technology Vulnerability Response (OTVR) product from the Yokohama release to the Zurich release. It outlines new features, changes, deprecations, and upgrade considerations to help you prepare and understand the key improvements and modifications in Zurich.

    Show full answer Show less

    Key Features

    • Unified Security Exposure Management (USEM) Workspace Integration: From version 30.0.x onwards, OTVR configuration tasks are performed via the USEM Workspace, with the Vulnerability Response plugin consolidated under USEM to streamline management.
    • Operational Technology Risk Calculator: The Risk Calculator plugin can now be accessed and used directly without the need to load demo data during installation, simplifying setup and evaluation.
    • Enhanced Hardware Vulnerability Assessment: New capabilities include:
      • Assessments without normalization, enabling evaluation of discovery models lacking normalization content.
      • Introduction of confidence scores to improve assessment accuracy.
      • Support for version range information from the National Vulnerability Database (NVD) to create assessments without explicit Common Platform Enumeration (CPE) entries.
      • Partial assessments for discovery models missing firmware version data based on publisher and model matching.
      • Automated expiration and regeneration of assessments when firmware versions on configuration items (CIs) are updated.
    • Industrial Workspace Enhancements:
      • A dedicated Hardware Vulnerability Assessment menu enables automatic and periodic firmware vulnerability assessments of OT device inventories.
      • Vulnerability risk scores for OT devices can be viewed at multiple equipment model levels via the OT Risk Management dashboard.
      • The enhanced OTVR (PA) dashboard aggregates OT vulnerability data and visualizations in one centralized location accessible from the Dashboard Library.

    Changes

    • Data previously available on the OT Vulnerabilities tab of the OT Manager dashboard (such as total OT vulnerable items and risk ratings) has been moved to the enhanced OTVR (PA) dashboard to consolidate vulnerability information.

    Deprecations

    • The OT Vulnerabilities tab is no longer available on the OT Manager dashboard in the Industrial Workspace starting with Yokohama.
    • Vulnerability Response integration with Microsoft Defender for IoT (On-premises Management Console) is being prepared for future deprecation; it is hidden and not activated on new instances but remains supported.

    Upgrade Considerations

    • Review and complete all pre- and post-upgrade tasks before upgrading to Zurich to ensure a smooth transition.
    • Activation of OTVR continues via requests through the ServiceNow Store as in previous releases.
    • There are no additional browser or localization requirements introduced in Zurich.
    • Coral is now the default theme for new portals and experiences, providing a refreshed, brand-neutral look with dark mode options for web and mobile.

    Practical Outcomes for ServiceNow Customers

    • Improved configuration management through USEM Workspace integration.
    • More efficient and accurate vulnerability assessments of OT devices, even for models lacking full normalization data.
    • Centralized dashboards enhance visibility and management of OT vulnerabilities and remediation efforts.
    • Simplified plugin installation and risk calculation without dependency on demo data.
    • Awareness of deprecated features helps plan for future changes in integrations and dashboard availability.

    Consolidated page of all release notes for Operational Technology Vulnerability Response from Yokohama to Zurich.

    How to use this page

    To help you prepare for your upgrade, we have combined the cross-family Operational Technology Vulnerability Response release notes onto one page. Read this summary of the new features, changes, and updated information for your product from Yokohama to Zurich.

    Tip:
    If there were no updates for a release notes section in a certain family release, we included a short note for your reference. For example, if a product did not have any updates in Tokyo, the row says "No updates for this release."

    Important information for upgrading Operational Technology Vulnerability Response to Zurich

    Before you upgrade to Zurich, review these pre- and post-upgrade tasks and complete the tasks as needed.

    Release Release notes

    Yokohama

    		 No updates for this release.

    Zurich

    		 No updates for this release.

    New features

    Between your current release family and Zurich, new features were introduced for Operational Technology Vulnerability Response.

    Release Release notes

    Yokohama
    Configuring Operational Technology Vulnerability Response from the SEM Workspace
    Starting from Operational Technology Vulnerability Response version 30.0.x, users may be redirected to the Unified Security Exposure Management (USEM) Workspace to perform some configuration tasks. The Vulnerability Response plugin is consolidated under USEM from version 30.0.x.
    Demo data not required for Operational Technology Risk Calculator plugin
    You can directly access and use the Operational Technology Vulnerability Response Risk Calculator without loading the demo data while installing the plugin. In previous releases, the risk calculation was included as part of the demo data.
    Enhanced features for Hardware Vulnerability Assessment for OT devices
    The following enhancements are available in Hardware Vulnerability Assessment:
    • Assessments without Normalization: Ability to assess discovery models without content available for normalization.
    • Confidence Scores: New scoring mechanism for all types of assessments.
    • Version Range Support: The range information provided by the National Vulnerability Database (NVD) is used to create assessments without explicitly creating Common Platform Enumeration (CPEs) in the NVD.
    • Partial assessment for partially normalized discovery model: Creates partial assessments for discovery models without firmware version. The partial assessments are done if the other versions of the discovery model have the same publisher and model.
    • Expiring of assessments: If you update the firmware version of a CI, the corresponding normalized discovery model also updates. The assessment records based on the older firmware version expires while new assessments are generated for new firmware version.
    Hardware Vulnerability Assessment menu in the Industrial Workspace
    Automatically and periodically assess the OT device firmware vulnerabilities that are in your inventory and create vulnerable items against the impacted assets (CI).
    Vulnerability risk scores on the OT Risk Management dashboard
    View a table of vulnerability risk scores for your OT devices at each level of the equipment model with the OT Risk Management dashboard.
    Enhanced OTVR (PA) dashboard experience
    View and manage all of your OT vulnerability data and data visualizations in a centralized location with the enhanced OTVR (PA) dashboard, which is accessible on the Dashboard Library page.

    Zurich
    Configuring Operational Technology Vulnerability Response from the SEM Workspace
    Starting from Operational Technology Vulnerability Response version 30.0.x, users may be redirected to the Unified Security Exposure Management (USEM) Workspace to perform some configuration tasks. The Vulnerability Response plugin is consolidated under USEM from version 30.0.x.
    Demo data not required for Operational Technology Risk Calculator plugin
    You can directly access and use the Operational Technology Vulnerability Response Risk Calculator without loading the demo data while installing the plugin. In previous releases, the risk calculation was included as part of the demo data.
    Enhanced features for Hardware Vulnerability Assessment for OT devices
    The following enhancements are available in Hardware Vulnerability Assessment:
    • Assessments without Normalization: Ability to assess discovery models without content available for normalization.
    • Confidence Scores: New scoring mechanism for all types of assessments.
    • Version Range Support: The range information provided by the National Vulnerability Database (NVD) is used to create assessments without explicitly creating Common Platform Enumeration (CPEs) in the NVD.
    • Partial assessment for partially normalized discovery model: Creates partial assessments for discovery models without firmware version. The partial assessments are done if the other versions of the discovery model have the same publisher and model.
    • Expiring of assessments: If you update the firmware version of a CI, the corresponding normalized discovery model also updates. The assessment records based on the older firmware version expires while new assessments are generated for new firmware version.
    Vulnerability risk scores on the OT Risk Management dashboard
    View a table of vulnerability risk scores for your OT devices at each level of the equipment model with the OT Risk Management dashboard.

    Changes

    Between your current release family and Zurich, some changes were made to existing Operational Technology Vulnerability Response features.

    Release Release notes

    Yokohama
    OT Vulnerabilities tab data
    The following data that was available in the OT Vulnerabilities tab of the OT Manager dashboard has been moved to the OTVR (PA) dashboard:
    • Total OT Vulnerable Items
    • New OT Vulnerable Items
    • OT Unassigned Vulnerable Items
    • OT Vulnerable Items by State
    • OT Vulnerable Items by Risk Rating

    Zurich

    		 No updates for this release.

    Removed

    Between your current release family and Zurich, some Operational Technology Vulnerability Response features or functionality were removed.

    Release Release notes

    Yokohama

    		 No updates for this release.

    Zurich

    		 No updates for this release.

    Deprecations

    Between your current release family and Zurich, some Operational Technology Vulnerability Response features or functionality were deprecated.

    Release Release notes

    Yokohama
    • The OT Vulnerabilities tab is no longer available on the OT Manager dashboard in the Industrial Workspace.
    • Starting with the Yokohama release, Vulnerability Response Integration with Microsoft Defender for IoT (On-premises Management Console) integration is being prepared for future deprecation. It will be hidden and no longer activated on new instances but will continue to be supported.

    Zurich

    		 No updates for this release.

    Activation information

    Review information on how to activate Operational Technology Vulnerability Response.

    Release Release notes

    Yokohama

    Install Operational Technology Vulnerability Response by requesting it from the ServiceNow Store. Visit the ServiceNow Store website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the ServiceNow Store version history release notes.

    Zurich

    Install Operational Technology Vulnerability Response by requesting it from the ServiceNow Store. Visit the ServiceNow Store website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the ServiceNow Store version history release notes.

    Additional requirements

    If any additional requirements were introduced or changed for Operational Technology Vulnerability Response we have noted them here.

    Release Release notes

    Yokohama

    		 No updates for this release.

    Zurich

    		 No updates for this release.

    Browser requirements

    If any specific browser requirements were introduced or changed for Operational Technology Vulnerability Response we have noted them here.

    Release Release notes

    Yokohama

    		 No updates for this release.

    Zurich

    		 No updates for this release.

    Accessibility information

    Review details on accessibility information for Operational Technology Vulnerability Response, such as specific requirements or compliance levels.

    Release Release notes

    Yokohama

    		 No updates for this release.

    Zurich
    Coral theme
    Coral is now the default theme for new portal, web, and mobile experiences with Next Experience or Core UI enabled. This theme provides a fresh look and feel, featuring brand-neutral illustrations to enhance your user experience. A dark theme option is available for web and mobile experiences.

    Localization information

    If there are specific localization considerations for Operational Technology Vulnerability Response we have noted them here.

    Release Release notes

    Yokohama

    		 No updates for this release.

    Zurich

    		 No updates for this release.

    Highlight information

    If there are specific highlight considerations for Operational Technology Vulnerability Response we have noted them here.

    Release Release notes

    Yokohama
    • Configure Operational Technology Vulnerability Response from the Security Exposure Management Workspace (SEM Workspace).
    • Access the Operational Technology Vulnerability Response Risk Calculator plugin directly without loading the demo data.
    • View all vulnerable items that have been created from the OT Vulnerable Items list in the Industrial Workspace.
    • View all remediation tasks that have been created from the OT Remediation Tasks list in the Industrial Workspace.
    • View all vulnerability exceptions that have been created from the OT Vulnerability Exception Approvals list in the Industrial Workspace.
    • Hardware Vulnerability Assessment is available for firmware discovery models without normalized data.
    • Assess the vulnerabilities for the firmware of the OT assets with Hardware Vulnerability Assessment.
    • View solutions or details of a vulnerable item (VIT) with enhanced UI options.
    • Manage your vulnerable items and Operational Technology Vulnerability Response data with the enhanced OTVR (PA) dashboard in the Industrial Workspace.
    • View the risk score of your OT devices at each level of the equipment model with the OT Vulnerability Risk Rollup dashboard.

    See Operational Technology Vulnerability Response for more information.

    Zurich
    • Configure Operational Technology Vulnerability Response from the Security Exposure Management Workspace (SEM Workspace).
    • Access the Operational Technology Vulnerability Response Risk Calculator plugin directly without loading the demo data.
    • View all vulnerable items that have been created from the OT Vulnerable Items list in the Industrial Workspace.
    • View all remediation tasks that have been created from the OT Remediation Tasks list in the Industrial Workspace.
    • View all vulnerability exceptions that have been created from the OT Vulnerability Exception Approvals list in the Industrial Workspace.
    • Hardware Vulnerability Assessment is available for firmware discovery models without normalized data.
    See