--- sourceDocument: Brazil Security Management sourceDocumentLink: https://www.servicenow.com/docs/r/security-management Release : - brazil ft:locale : - en-US ft:publication_title : - Brazil Security Management ft:clusterId : - security bundleId : - security workflow : - Technology --- # Early Warning for Security Exposure Management # Early Warning for Security Exposure Management {#ariaid-title1} Release version: Brazil Updated September 10, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 6 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Early Warning for Security Exposure Management Early Warning for Security Exposure Management, powered by Armis, enhances the Central Vulnerability Database (CVDB) within Unified Security Exposure Management (USEM) by providing timely intelligence on vulnerabilities that threat actors are actively exploiting or planning to exploit. This capability enables security teams to prioritize and remediate vulnerabilities proactively before they are weaponized, reducing noise from less urgent vulnerabilities and improving the efficiency of patch management workflows. Show full answer Show less By integrating signals from honeypots, open-source research, and operational threat analysis, Early Warning flags vulnerabilities that pose immediate risks. This proactive approach is particularly valuable for organizations with complex environments, costly downtime, or regulatory requirements, such as healthcare, manufacturing, financial services, and multi-region enterprises. ## How It Works * **Detection:** Identifies vulnerabilities under active or imminent exploitation. * **Integration:** Automatically ingests threat intelligence into USEM, elevating the priority of flagged CVEs. * **Prioritization:** Enables teams to focus on vulnerabilities with active exploitation signals, even if severity scores are moderate. * **Response:** Supports coordinated patch deployment during planned maintenance windows to avoid emergency remediation. The integration is accessible in the Security Exposure Management workspace alongside other enrichment sources, with monitoring available for ingestion health and processing status. ## Key Benefits * **Earlier Risk Prioritization:** Flags provide actionable context beyond CVSS scores, focusing remediation on real-world threats. * **Seamless Workflow Integration:** Triggers existing Vulnerability Change Management processes automatically, requiring no additional setup. * **Improved Asset Risk Visibility:** Facilitates filtering and identification of assets at elevated risk based on Early Warning status. * **Built-In Asset Correlation:** Rolls up Early Warning signals from CVEs to third-party entries, enhancing risk assessment without extra CMDB mapping. ## Data and Configuration Upon integration, two new data columns appear in vulnerability records: * **Armis Early Warning Flag:** Indicates CVEs with active exploitation signals. * **Armis Early Warning CVD Attributes:** Provides detailed intelligence including CVE ID, affected products, intelligence dates, honeypot detection, research dates, and the Admiralty score. The **Admiralty score** is a confidence rating from A1 (highest reliability) to F6 (lowest), allowing teams to tailor risk rules to prioritize vulnerabilities based on the trustworthiness of the intelligence. Early Warning flags and Admiralty scores can be incorporated into USEM's risk calculators, enabling customized risk weighting and refined prioritization beyond traditional CVSS-based scoring. ## Key Components and Requirements * **Integration plugin (snvulew):** Ingests Early Warning data via the Vulnerability Integration Framework. * **CVD Attributes table (snvulewcvdattributes):** Stores detailed threat intelligence data. * **Flag rollup business rules:** Consolidate Early Warning flags for comprehensive risk assessment. * **Risk calculator field (vulnerability.ewexists):** Boolean field to include Early Warning in custom risk rules. **Prerequisites:** USEM with Vulnerability Response v30.x, Vulnerability Integration Framework plugin, and access to the Armis intelligence feed with valid credentials. ## Practical Impact for ServiceNow Customers Integrating Early Warning for Security Exposure Management equips security teams to: * Shift from reactive to proactive vulnerability management by focusing on vulnerabilities actively targeted by attackers. * Reduce remediation noise and optimize patching schedules, minimizing operational disruption. * Demonstrate compliance and a prevention-first security posture to auditors. * Leverage enriched intelligence to better protect critical and high-value assets across diverse and complex environments. Early Warning for Security Exposure Management, powered by Armis, enriches the Central Vulnerability Database (CVDB) in Unified Security Exposure Management (USEM) with vulnerability intelligence of imminent exploit. This enables your security team to prioritize and patch vulnerabilities before threat actors weaponize them. Early Warning assesses vulnerability intelligence through honeypot activity, open-source research, and operational threat analysis, flagging which vulnerabilities pose immediate risk to your environment. This enrichment helps your team reduce noise and prioritize what truly matters, while accelerating remediation and coordinate patching efforts within your existing vulnerability management workflows. ## When Early Warning matters {#armis-early-warning-integration__section_ktg_nj2_vjc} Early Warning shifts vulnerability management from reactive crisis to proactive defense, providing strategic advantage by detecting which vulnerabilities threat actors are actively trying to exploit. Without early warning: When security teams rely primarily on severity, all critical and high-severity vulnerabilities may appear to require immediate attention. This can create noise, stretch remediation teams, and make it difficult to determine which vulnerabilities pose the most urgent risk to the organization. With early warning: Early Warning enriches Common Vulnerabilities and Exposures (CVE) records with vulnerability intelligence derived from signals such as honeypot activity, OSINT, and operational research. When the Early Warning flag is set to true, teams can focus first on critical vulnerabilities with evidence of active exploitation or heightened attacker interest, rather than treating every critical or high-severity vulnerability the same. This additional context helps teams reduce noise, prioritize what matters most, validate fixes, coordinate patching across teams and regions, and deploy updates through planned maintenance windows instead of relying only on reactive emergency remediation. When Early Warning Is critical: Early Warning is most valuable for organizations where patching takes time or downtime is costly: * Legacy systems and industrial controls (ICS/SCADA): Systems that can't be rebooted quickly or easily patched. Early warning provides time for safe, planned updates instead of emergency changes that risk production downtime. * Healthcare systems: Patient care equipment and Electronic Health Record (EHR) systems require validation before patching. Early warning allows time to coordinate updates during low-patient-census windows without disrupting care. * Manufacturing and operations: Downtime costs millions per hour. Early warning allows time to plan patches during scheduled maintenance windows instead of emergency shutdowns. * Financial services and payment systems: Patch windows are scheduled in advance. Early warning ensures patches are tested and ready to deploy when the window arrives, instead of scrambling on the deployment day. * Multi-region enterprises: Complex environments with factories, offices, or data centers across regions take time to coordinate. Early warning provides the runway to test and deploy across all sites safely. * Regulated industries: Compliance auditors want to see proactive vulnerability management, not reactive patch-and-pray. Early warning demonstrates a prevention-first security posture. * High-value targets: Organizations subject to nation-state or sophisticated cyber attacks. Early warning closes the window where you're undefended before threat actors act. {#armis-early-warning-integration__ul_hmk_pj2_vjc} Detecting exploitation signals from honeypots, OSINT, and operational research before broader industry recognition or CISA KEV inclusion enables proactive patching and reduces the need for high-risk emergency updates. ## How it works {#armis-early-warning-integration__section_how_it_works} Early Warning for Security Exposure Management performs the following operations when integrated with USEM: * Detection: Identifies a vulnerability that threat actors are planning to exploit. * Integration: Ingests early warning signal automatically ingested into USEM and elevates the priority of that CVE in your vulnerability inventory. * Prioritization: Enables your security team to prioritize patching these vulnerabilities ahead of others, even if Common Vulnerability Scoring System (CVSS) scores don't reflect the real-world threat. * Response: Enables your team to coordinate proactive patch deployment during planned maintenance windows and focus on vulnerabilities threat actors are actively targeting - not just those with the highest CVSS scores. The integration appears in the Security Exposure Management workspace alongside other enrichment integrations such as the CISA Known Exploited Vulnerabilities integration. You can monitor integration run history, ingestion health, and processing health from the integration overview page. ## Key benefits {#armis-early-warning-integration__section_key_benefits} Early Warning for Security Exposure Management provides the following benefits: * Earlier risk prioritization: Early warning flags surface alongside your vulnerability risk scores, so remediation teams focus on the threats that matter most. Instead of patching by CVSS score alone, you patch based on real-world threat actor behavior. * Faster remediation without extra setup: Early warning CVEs trigger existing Vulnerability Change Management workflows automatically, with no custom integration required. * Faster identification of at-risk assets: Filter findings by early warning status to surface which assets carry elevated risk. * Built-in asset correlation: Early Warning signals roll up from CVE records to third-party entries (TPEs) automatically, extending risk visibility to the assets already tracked in USEM with no additional CMDB mapping required. {#armis-early-warning-integration__ul_y1d_wgj_tjc} ## Data available in USEM {#armis-early-warning-integration__section_xwq_2lg_vjc} When you integrate Early Warning for Security Exposure Management, two new columns appear in your vulnerability records: * **Armis Early Warning:** A flag indicating that threat actors are planning to exploit this CVE. * **Armis Early Warning CVD Attributes:** Detailed vulnerability intelligence including: * CVE ID and affected product * Intelligence date (when Armis detected the threat actor activity) * Admiralty score (confidence rating of the vulnerability intelligence) * Honeypot detection date * Research date {#armis-early-warning-integration__ul_abz_glg_vjc} {#armis-early-warning-integration__ul_z1z_glg_vjc} You can use these columns to filter, sort, and prioritize your vulnerability remediation workflow. The integration appears in the Security Exposure Management workspace alongside other enrichment integrations, such as CISA Known Exploited Vulnerabilities. From the integration overview page, you can monitor run history, ingestion health, and processing status. For more information, see [Security Exposure Management Workspace List view](https://www.servicenow.com/docs/P_duhRHscSqVlvo_glLAhQ "The List view in the Security Exposure Management Workspace enables vulnerability and security managers and analysts to view remediation progress on records, drill down into records, and view the status of their approval requests and exceptions.") ## Admiralty score {#armis-early-warning-integration__section_admiralty-score} Each CVE in the Armis feed includes an Admiralty score - a confidence rating based on the NATO Admiralty grading system. Scores range from A1--A6, B1--B6, C1--C6, D1--D6, E1--E6, and F1--F6, where A1 represents information from a completely reliable source that has been independently corroborated. A lower confidence rating does not prevent a CVE from being identified as an early warning signal. CVEs with lower Admiralty scores may still be surfaced when other factors indicate potential relevance or risk. You can use the Admiralty score as an additional condition in a risk rule to refine prioritization. For example, you can configure the rule to apply a weight only to CVEs whose admiralty score meets a defined reliability threshold. ## Configuring risk rules {#armis-early-warning-integration__section_downstream-risk-scoring} The early warning flag and Admiralty score are available as criteria in your risk rules, allowing you to configure how early warnings influence your vulnerability scores. In the default risk calculator, you can: * Adjust the weight applied to early warning CVEs * Add Admiralty score as an additional condition for refinement * Create custom rules that combine early warning signals with other risk criteria {#armis-early-warning-integration__ul_rlw_ypg_vjc} In the default risk calculator, you can adjust the weight or add the admiralty score as an additional condition to refine prioritization. Early Warning extends risk coverage to CVEs which may not yet be identified by intelligence sources such as CISA KEV or EPSS. ## Key components {#armis-early-warning-integration__section_key_components} Early Warning for Security Exposure Management consists of the following components: Integration plugin : Early Warning for Security Exposure Management (`sn_vul_ew`): Handles data ingestion via the Vulnerability Integration Framework CVD attributes table : `sn_vul_ew_cvd_attributes`: Stores early warning-specific threat signals (admiralty score, honeypot date, intelligence date, research date, CWE) Flag rollup : Business rules propagate `ew_exists` flag from NVD entries to third-party entries for consolidated risk assessment Risk calculator field : `vulnerability.ew_exists`: Boolean risk criteria available for custom risk rule weighting ## Dependencies and prerequisites {#armis-early-warning-integration__section_dependencies} The Early Warning for Security Exposure Management integration requires the following: * Unified Security Exposure Management (Vulnerability Response v30.x) * Vulnerability Integration Framework plugin * Access to Armis vulnerability intelligence feed and valid authentication credentials {#armis-early-warning-integration__ul_abd_wgj_tjc} **Related concepts** * [Integrations for Central Vulnerability Database](https://www.servicenow.com/docs/X_IZPsbyylNKBZL3gf9HhQ "The Central Vulnerability Database supports integration with trusted global vulnerability data sources, including the National Vulnerability Database, European Union Vulnerability Database (EUVD), and Japanese Vulnerability Notes (JVN), to enrich and normalize vulnerability records.") * [Security Exposure Management Workspace List view](https://www.servicenow.com/docs/P_duhRHscSqVlvo_glLAhQ "The List view in the Security Exposure Management Workspace enables vulnerability and security managers and analysts to view remediation progress on records, drill down into records, and view the status of their approval requests and exceptions.") **Related tasks** * [Define fields and weights for the risk rule for Unified Security Exposure Management risk calculators](https://www.servicenow.com/docs/FQ9lPQ_DAoupU3qZA71pdg "Customize risk rule parameters and weights to generate risk scores that reflect your organization's specific finding and asset data. By selecting relevant fields for the risk rule, you can create an effective risk scoring framework that meets your organization's unique needs.")