---
sourceDocument: Brazil Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/security-management

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Security asset

# Security asset {#ariaid-title1}

Release version: Brazil  
Updated October 16, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read  
A security asset record specifies the details, labels, and source data of an asset with the findings, remediation tasks, fixes, and vulnerabilities related to its configuration item.

The Findings, Remediation Tasks, Fixes, and Vulnerabilities tabs show only the records related to the configuration item (CI) that the asset is matched to.

## Record tabs {#sem-security-asset-record__section-asset-record-tabs}

{#sem-security-asset-record__table-asset-record-tabs__entry__2}

| Tab | Description |
|-|-|
| Overview | Summary of an asset. Displays counts of its open findings by severity (critical, high, medium, and low), associated configuration item, and labels. Note: * Before labels are updated for the asset, they're normalized and deduplicated, so a tag that several scanners report in different spellings or letter cases appears as one label. If a later scan no longer reports a label, the label stays on the asset. * For a code asset, the associated configuration item section is named Associated product model when the `sn_vul.use_product_model` system property is enabled. {#sem-security-asset-record__ul_odb_zks_ykc} |
| Details | All fields recorded for the asset. A specific set of fields are recorded for each asset type. For information about these fields, see [Security asset fields for asset types in unified exposure pipeline](https://www.servicenow.com/docs/2fb5u_41uVrDRzSOeQtuXw "Provides information about security asset fields added for various asset types in the unified exposure pipeline."). |
| Findings | The findings for the asset, grouped into application findings, container findings, infrastructure findings, and misconfigurations. Only the groups that have findings for the asset appear. From this tab, you can bulk edit, create remediation task, and re-evaluate on the findings in each group. |
| Remediation Tasks | Remediation tasks for the configuration item of the asset, grouped by finding type. If the asset isn't matched to a configuration item, the list is empty. |
| Fixes | Fixes that address the findings for the asset, across all finding types. Fixes are deduplicated across scanners and imported after findings, so a fix can appear on this tab some time after its findings. |
| Vulnerabilities | Vulnerabilities, such as CVEs, behind the host, application, and container findings for the asset. |
[Table 1. Security asset record tabs]

{#sem-security-asset-record__table-asset-record-tabs}  
Note:  
From the contextual side panel, selecting the Source information tab shows the asset data that each integration reported for the asset. If no integration has reported source information for the asset, the tab shows an empty state.

## Risk scores and ratings {#sem-security-asset-record__section-summary-values-calculation}

Each security asset shows a rolled-up risk score, a risk rating, and counts of its findings by severity. These values are calculated from the active findings that are matched to the asset's configuration item (CI).  
The risk score is calculated using the Security Assets dashboard rollup calculator for an asset based on the following factors:

* Highest risk score amongst the asset's active findings
* Average risk score of those findings
* Number of active findings  
  Note:  
  An asset with more active findings gets a higher risk score.
{#sem-security-asset-record__ul_vyr_ncs_ykc}

The risk rating is set from the risk score. The critical, high, medium, and low counts show the number of the asset's active findings at each severity.  
Important:  
For an asset, these risk values are frequently recalculated, but updated only when a value has changed.