Combined Now Assist for Security Incident Response (SIR) release notes for upgrades from Yokohama to Zurich

  • Release version: Zurich
  • Updated August 11, 2026
  • 6 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of Combined Now Assist for Security Incident Response (SIR) Release Notes: Upgrades from Yokohama to Zurich

    This consolidated guide provides ServiceNow customers with essential information about upgrading Now Assist for Security Incident Response (SIR) from the Yokohama release family to Zurich. It highlights new features, configuration requirements, enhancements, and important pre- and post-upgrade tasks to ensure a smooth transition and optimal use of the Zurich capabilities.

    Show full answer Show less

    Important Upgrade Information

    • When upgrading to Zurich, all dependent applications for Now Assist for SIR are automatically updated.
    • The AI Search application must be enabled for the recommended actions skill to function correctly. Verify AI Search status in your instance and contact ServiceNow support if it is not enabled.
    • Additional role configuration is required for agentic workflows and AI agents included in the Now Assist applications. Users must be assigned the specified roles to execute these workflows and agents.

    New Features and Enhancements

    • Agentic Workflows and AI Agents Security Configuration: Zurich Patch 4 introduces mandatory role assignments to secure agentic workflows and AI agents, ensuring only authorized users can invoke these features.
    • Security Incident Quality Assessment: Use generative AI to generate detailed, rule-based quality assessment reports for security incidents, providing both summary and in-depth evaluation.
    • Shift Handover Report Generation: Introduced in Zurich Patch 1, the AI agent assists analysts by automatically populating shift handover reports with relevant security incident details and refines content based on analyst feedback.
    • Agentic Workflow for Security Operations Metrics: Available in Zurich Early Availability, this workflow helps security managers analyze team performance metrics such as case volume, mean time to assign (MTTA), and mean time to resolve (MTTR), and recommends improvements.
    • Enhanced Correlation Insights: Now Assist in Security Incident Response Workspace can generate correlation insights based on any configuration item or affected user, across multiple items simultaneously, improving incident analysis.
    • Security Incident Resolution Workflow: Analysts can interact with AI agents via natural language chat to generate resolution plans based on incident data, runbooks, knowledge articles, and past incidents, improving incident closure efficiency.

    Changes, Removals, and Deprecations

    No features or functionality were removed or deprecated between Yokohama and Zurich releases for Now Assist for Security Incident Response.

    Activation and Installation

    Install Now Assist for Security Incident Response by requesting it from the ServiceNow Store. This is the central place to view available applications and submit installation requests.

    Additional Requirements and Considerations

    • No new browser, localization, or accessibility requirements were introduced in Zurich for Now Assist for Security Incident Response.
    • Some Now Assist skills are enabled by default in Zurich Patch 4 to streamline user experience.
    • Usage measurement changes for Now Assist were introduced in Zurich Patch 5.

    Practical Benefits for ServiceNow Customers

    • Improved security incident management through AI-driven quality assessments and shift handover reporting.
    • Enhanced analyst productivity and incident resolution speed via AI-assisted workflows and natural language interaction.
    • Better oversight and optimization of security operations performance metrics.
    • Stronger security controls by configuring roles for agentic workflows and AI agents, ensuring compliance and controlled access.

    Consolidated page of all release notes for Now Assist for Security Incident Response (SIR) from Yokohama to Zurich.

    How to use this page

    To help you prepare for your upgrade, we have combined the cross-family Now Assist for Security Incident Response (SIR) release notes onto one page. Read this summary of the new features, changes, and updated information for your product from Yokohama to Zurich.

    Tip:
    If there were no updates for a release notes section in a certain family release, we included a short note for your reference. For example, if a product did not have any updates in Tokyo, the row says "No updates for this release."

    Important information for upgrading Now Assist for Security Incident Response (SIR) to Zurich

    Before you upgrade to Zurich, review these pre- and post-upgrade tasks and complete the tasks as needed.

    Release Release notes

    Yokohama

    		 No updates for this release.

    Zurich

    When you update the Now Assist for Security Incident Response (SIR) application, the dependency applications are automatically updated.

    For more information about required applications for Now Assist for Security Incident Response, see Supporting information.

    The AI Search application must be enabled so that the recommended actions skill works for security incidents with Now Assist for Security Incident Response. To verify that AI Search is enabled on your instance, navigate to All > AI Search > AI Search Status. Contact support if the page indicates that AI Search isn’t enabled.

    New features

    Between your current release family and Zurich, new features were introduced for Now Assist for Security Incident Response (SIR).

    Release Release notes

    Yokohama

    		 No updates for this release.

    Zurich
    Zurich Patch 4
    Role configuration required for agentic workflows and AI agents
    Agentic workflows and AI agents included with Now Assist applications require additional security configuration. If you select Users with selected roles for your user access security controls for an agentic workflow or AI agent, you must add the installed roles, or they won't execute. Data access settings must also include these roles. See the documentation for the agentic workflow or AI agent for the specific roles you must add. After the roles are configured, users must have the specified role to invoke the agentic workflow or AI agent.
    Explore Security Incident Quality Assessment
    Use generative AI to create a quality assessment report of a security incident. The reports are generated using a predefined, natural language rule set. The report provides an overall assessment summary followed by the detailed assessment for all the rules.
    Zurich Patch 1
    Generate SIR Shift Handover Report
    The AI agent helps add security incident details to a shift handover report. The agent populates the different sections of the shift handover with appropriate content by identifying the relevant details from the security incident. The AI agent can fetch details of the security incident and identify if the analyst has access to the shift handover record. The AI agent can generate content for each section of the shift handover record and asks for analysts feedback on the content. The AI agent refines the content based on the feedback and saves the content to the records on approval.
    Zurich Early Availability
    Use agentic workflows
    The analyze security operations metrics agentic workflow helps security managers to analyze their teams' performance.
    • Generate metrics for Security Incident Response (SIR) records for case volume, mean time to assign (MTTA), and mean time to resolve (MTTR) for a date range of your choosing.
    • Request suggestions for how to improve MTTR, MTTA, and volume based on your metrics.
    Enhancements to correlation insights in Now Assist for Security Incident Response
    You can generate and view results for correlation insights in the Security Incident Response Workspace.
    • Correlation insights aren’t limited to the primary configuration item (CI) or affected users associated with a security incident. You can base your correlation insights on any CI or affected user for a security incident.
    • You can generate correlation insights from the Investigation tab for a security incident in any state in the Security Incident Response Workspace.
    • You can generate insights for multiple items simultaneously for Associated Observables, Configuration items, and Affected Users.
    • Results are displayed in a modeless dialog that you can size and move.
    Using the security incident resolution agentic workflow
    Use the security incident resolution agentic workflow to close your security incidents. Analysts can chat with AI agents in natural language to resolve the security incidents. The AI agent analyzes the incident details, existing runbooks, Knowledge articles, and past similar security incidents as inputs, and provides a resolution plan. The AI agent also assists the analysts to resolve the security incident.

    Changes

    Between your current release family and Zurich, some changes were made to existing Now Assist for Security Incident Response (SIR) features.

    Release Release notes

    Yokohama

    		 No updates for this release.

    Zurich

    Removed

    Between your current release family and Zurich, some Now Assist for Security Incident Response (SIR) features or functionality were removed.

    Release Release notes

    Yokohama

    		 No updates for this release.

    Zurich

    		 No updates for this release.

    Deprecations

    Between your current release family and Zurich, some Now Assist for Security Incident Response (SIR) features or functionality were deprecated.

    Release Release notes

    Yokohama

    		 No updates for this release.

    Zurich

    		 No updates for this release.

    Activation information

    Review information on how to activate Now Assist for Security Incident Response (SIR).

    Release Release notes

    Yokohama

    		 No updates for this release.

    Zurich

    Install Now Assist for Security Incident Response by requesting it from the ServiceNow Store. Visit the ServiceNow Store website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the ServiceNow Store version history release notes.

    Additional requirements

    If any additional requirements were introduced or changed for Now Assist for Security Incident Response (SIR) we have noted them here.

    Release Release notes

    Yokohama

    		 No updates for this release.

    Zurich

    		 No updates for this release.

    Browser requirements

    If any specific browser requirements were introduced or changed for Now Assist for Security Incident Response (SIR) we have noted them here.

    Release Release notes

    Yokohama

    		 No updates for this release.

    Zurich

    		 No updates for this release.

    Accessibility information

    Review details on accessibility information for Now Assist for Security Incident Response (SIR), such as specific requirements or compliance levels.

    Release Release notes

    Yokohama

    		 No updates for this release.

    Zurich

    		 No updates for this release.

    Localization information

    If there are specific localization considerations for Now Assist for Security Incident Response (SIR) we have noted them here.

    Release Release notes

    Yokohama

    		 No updates for this release.

    Zurich

    		 No updates for this release.

    Highlight information

    If there are specific highlight considerations for Now Assist for Security Incident Response (SIR) we have noted them here.

    Release Release notes

    Yokohama

    		 No updates for this release.

    Zurich
    Zurich Patch 5
    • Review changes to Now Assist usage measurement.
    Zurich Patch 4
    • Some Now Assist skills are now turned on by default.
    • Use generative AI to create a quality assessment report of a security incident.
    • Additional role configuration is required for agentic workflows and AI agents included with Now Assist applications.
    Zurich Patch 1
    • Help analysts to add security incidents details to the Shift Handover report by chatting with AI agents in the Now Assist panel.
    Zurich Early Availability
    • Help your analysts to gain insight into security incident record metrics with an agentic workflow. Chat with AI agents in natural language from the Now Assist panel.
    • Help your analysts to resolve security incidents by chatting with AI agents in the Now Assist panel where the AI agent can assist in providing a resolution plan.