--- sourceDocument: yokohama Combined Product Files sourceDocumentLink: https://www.servicenow.com/docs/r/yokohama/delta-xanadu-yokohama Release : - yokohama ft:locale : - en-US ft:publication_title : - yokohama Combined Product Files ft:clusterId : - delta3yx bundleId : - delta3yx --- # Combined ServiceNow Otto for Unified Security Exposure Management release notes for upgrades from Xanadu to Yokohama # Combined ServiceNow Otto for Unified Security Exposure Management release notes for upgrades from Xanadu to Yokohama {#ariaid-title1} Release version: Yokohama Updated October 8, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 8 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Combined ServiceNow Otto for Unified Security Exposure Management Release Notes for Upgrades from Xanadu to Yokohama This consolidated document covers all the key information about upgrading ServiceNow Otto for Unified Security Exposure Management from the Xanadu release to the Yokohama release. It includes important upgrade instructions, new features, changes, and activation details to help ServiceNow customers prepare and execute a smooth transition while leveraging new capabilities. Show full answer Show less ## Important Upgrade Information * Before upgrading to Yokohama, review and complete all pre- and post-upgrade tasks as specified. * Upgrading Now Assist plugins may automatically activate previously unconfigured default skills. Customers retain control to deactivate individual skills post-upgrade. * Additional role configurations are required to enable agentic workflows and AI agents included with Now Assist applications. Proper role assignments and data access settings must be configured for these features to function. ## New Features and Enhancements * **Now Assist Default Skills:** Several Now Assist skills are now enabled by default for new installations and unconfigured skills during upgrades, including vulnerability recommendation, duplicate detection, approval recommendation, security exposure insights, and Security Posture Control connector setup. * **Generative AI Capabilities:** Utilize AI to generate contextual risk prioritization insights, approval impact analysis recommendations, duplicate vulnerability identification, and suggested remediation solutions based on integrated third-party product data and configuration context. * **Expanded AI Model Support:** New AI model providers Google Gemini and AWS Claude are available alongside Now LLM Service and Azure OpenAI for Now Assist skills and AI agents. * **Agentic Workflows:** Vulnerability exposure and remediation status workflows enable identification of vulnerability risks, SLA compliance tracking, and remediation gap analysis. * **Granular Role Controls:** New fine-grained roles allow better management of read and write access to remediation compliance insights, improving security and operational control. * **Security Posture Control Integration:** Now Assist supports automatic completion of connector builder steps within the Security Posture Control workspace for creating custom service graph connectors. ## Changes * **Now Assist Usage Measurement:** Starting with Yokohama Patch 5, usage tracking switched to a 365-day burn-down model resetting at the contract anniversary, replacing the previous look-back model. * **Access Control List (ACL) Configuration:** ACLs must be configured to control discovery and triggering of AI agents and agentic workflows, including options for dynamic or AI user behavior and public versus authenticated user access. * Default activation behavior for some Now Assist skills changed as noted in the New Features section. ## Removed and Deprecated Features No features or functionality were removed or deprecated between Xanadu and Yokohama releases. ## Activation and Installation * ServiceNow Otto for Unified Security Exposure Management is available via the ServiceNow Store. * Customers can request installation through the ServiceNow Store and view cumulative release notes and version history there. ## Additional Notes * No new browser, accessibility, localization, or highlight considerations were introduced in the Yokohama release. * Patch-specific highlights include: * **Yokohama Patch 6:** Introduction of generative AI skills for duplicate detection and remediation solution suggestions, plus added AI model providers. * **Yokohama Patch 11:** Updates to Now Assist usage measurement and default skill activation behavior. ServiceNow customers upgrading to Yokohama can expect enhanced AI-driven vulnerability management, improved role-based security controls, and tighter integration with Security Posture Control to streamline risk prioritization and remediation. Consolidated page of all release notes for ServiceNow Otto for Unified Security Exposure Management from Xanadu to Yokohama. ## How to use this page To help you prepare for your upgrade, we have combined the cross-family ServiceNow Otto for Unified Security Exposure Management release notes onto one page. Read this summary of the new features, changes, and updated information for your product from Xanadu to Yokohama. Tip: If there were no updates for a release notes section in a certain family release, we included a short note for your reference. For example, if a product did not have any updates in Tokyo, the row says "No updates for this release." ## Important information for upgrading ServiceNow Otto for Unified Security Exposure Management to Yokohama Before you upgrade to Yokohama, review these pre- and post-upgrade tasks and complete the tasks as needed. {#dfrn3-servicenowottoforunifiedsecurityexposuremanagement-summary__entry__2} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | Upgrade information : For more information about required applications for ServiceNow Otto for Unified Security Exposure Management, see [Supporting information](https://www.servicenow.com/docs/access?context=supporting-information-now-assist-vr&family=yokohama&ft:locale=en-US). Note: Upgrading the Now Assist plugins activate any designated skills that were previously untouched by the customer. * If you have the plugins installed but never touched the configuration (never activated the skill nor adjusted associated roles) of a skill, any Default On skill will be activated on a per skill basis upon upgrading. * If you have previously toggled a skill from active and then back to inactive or have updated any roles for that skill, that skill remains inactive upon upgrading. * You maintain full control over deactivating individual skills at any time after activation. | [ ] ## New features Between your current release family and Yokohama, new features were introduced for ServiceNow Otto for Unified Security Exposure Management. {#dfrn3-servicenowottoforunifiedsecurityexposuremanagement-summary__entry__8} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | [Role configuration required for agentic workflows and AI agents](https://www.servicenow.com/docs/access?context=aia-role-masking&family=yokohama&ft:locale=en-US) : Agentic workflows and AI agents included with Now Assist applications require additional security configuration. If you select Users with selected roles for your user access security controls for an agentic workflow or AI agent, you must add the installed roles, or they will not execute. Data access settings must also include these roles. See the documentation for the agentic workflow or AI agent for the specific roles you must add. [Some Now Assist skills are turned on by default](https://www.servicenow.com/docs/access?context=now-assist-skills-on-by-default&family=yokohama&ft:locale=en-US) : The new default behavior works as follows: * New customers: When you install a Now Assist product, designated skills are turned on automatically. * Existing customers who are upgrading (starting with Yokohama Patch 11): Any previously unconfigured skill is turned on automatically (the skill was never configured and turned on, then turned off again). Previously configured skills that were turned on, then off, remain inactive. [Use Now Assist for Vulnerability Response in Security Posture Control](https://www.servicenow.com/docs/access?context=using-now-assist-api-connector&family=yokohama&ft:locale=en-US) : You have the option to use Now Assist to help you automatically complete some of the steps in the Connector builder in the Security Posture Control workspace. Use the Connector builder to create your own service graph connectors for Security Posture Control. [Generate insights to prioritize risks](https://www.servicenow.com/docs/access?context=sem-insights-skill&family=yokohama&ft:locale=en-US) : Use generative AI to provide contextual summaries, actionable recommendations, and quick links in the Security Exposure Management Workspace, helping you prioritize critical risks and accelerate remediation. [Generate recommendation for approval impact analysis](https://www.servicenow.com/docs/access?context=sem-approval-recommendation-skill&family=yokohama&ft:locale=en-US) : Use generative AI to provide on-demand recommendations to approve or reject a request directly from the Exception Change Approval record, enabling approvers to make fast, consistent decisions while reducing manual analysis effort. [Granular roles](https://www.servicenow.com/docs/access?context=now-assist-vr-acticvate-agentic-workflow&family=yokohama&ft:locale=en-US) : The sn_vul_ai.write_rem_insights and sn_vul_ai.read_rem_insights granular roles have been added and are inherited by the sn_vul.vulnerability_admin and sn_vul.vulnerability_analyst roles automatically. These roles provide you with more control over read and write access for the records on the Remediation Compliance Insights \[sn_vul_ai_remediation_insights\] caching table. The VR.System role also inherits these granular roles so background job execution for the workflow can occur. [Identify duplicate vulnerable items](https://www.servicenow.com/docs/access?context=dedupe-host-vi-now-assist-vulnerability-response&family=yokohama&ft:locale=en-US) : Use generative AI to identify duplicates for your active host vulnerable items that are imported by your vulnerability scanners. Use generative AI reasoning with Now Assist to help your analysts differentiate between primary vulnerability items (VITs) and those VITs that are duplicates. Close duplicate VITs and move their associated detections automatically to the primary VIT records. [Suggest vulnerability solutions](https://www.servicenow.com/docs/access?context=solutions-now-assist-vulnerability-response&family=yokohama&ft:locale=en-US) : Use generative AI to analyze available remediation options pulled from integrated third-party products like Red Hat, Tenable for Vulnerability Response, or internal solution management systems. Evaluate each option against the specific configuration item context, for example, the OS version or software version, and get recommendations for the most viable fix for implementation. [New third-party AI model provider options available for all Now Assist applications](https://www.servicenow.com/docs/access?context=exploring-large-language-models&family=yokohama&ft:locale=en-US) : Google Gemini and AWS Claude are available for Now Assist skills and AI agents in addition to Now LLM Service and Azure OpenAI. [Use agentic workflows](https://www.servicenow.com/docs/access?context=using-now-assist-ai-agents-vr&family=yokohama&ft:locale=en-US) : The Assess vulnerability exposure agentic workflow enables vulnerability managers to determine your exposure to vulnerabilities. * Determine your exposure to the most current Cybersecurity and Infrastructure Security Agency (CISA) known vulnerabilities in your environment and assess their potential impact to your configuration items (CIs) and business services. * Identify assets with Common Vulnerabilities and Exposures (CVEs). * Determine the number of active vulnerability items (VITs) that correspond to CVEs. Create watch topics for VIT remediation. The Analyze vulnerability remediation status agentic workflow enables vulnerability managers to monitor and assess remediation target compliance. * Track Service Level Agreement (SLA) compliance - Understand how effectively your organization is meeting remediation goals for vulnerabilities based on your SLAs. * Analyze missed SLAs by severity, assignment group, and configuration item (CI) class - Pinpoint gaps in remediation by categorizing overdue VITs based on severity, assignment groups, and CI classes to enable targeted interventions and smarter resource allocation. | [ ] ## Changes Between your current release family and Yokohama, some changes were made to existing ServiceNow Otto for Unified Security Exposure Management features. {#dfrn3-servicenowottoforunifiedsecurityexposuremanagement-summary__entry__14} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | [Changes to Now Assist usage measurement](https://www.servicenow.com/docs/access?context=monitoring-now-assist-usage&family=yokohama&ft:locale=en-US) : Starting with Yokohama Patch 5, Now Assist usage measurement is transitioning from a 365-day look-back model to a 365-day burn-down model, with usage resetting at the contract anniversary date. For more information, refer to [KB KB2704710: Now Assist Usage - Overview \& New Measurement Logic](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2704710). [Some Now Assist skills are now turned on by default](https://www.servicenow.com/docs/access?context=now-assist-skills-on-by-default&family=yokohama&ft:locale=en-US) : The following Now Assist skills for ServiceNow Otto for Unified Security Exposure Management are activated by default. * Recommend preferred solution for VIT (VR) * Vulnerable item de-duplication (VR) * Approval Recommendation (VR)(USEM) * Security Exposure Management (SEM) Insights (VR)(USEM) * SPC Setup Connector (Security Posture Control) The new default behavior works as follows: * New customers: When you install a Now Assist product, designated skills are turned on automatically. * Existing customers who are upgrading (starting with Yokohama Patch 11): Any previously unconfigured skill is turned on automatically (the skill was never configured and turned on, then turned off again). Previously configured skills that were turned on, then off, remain inactive. [Configure ACLs for AI agents and agentic workflows](https://www.servicenow.com/docs/access?context=aia-security-implementation&family=yokohama&ft:locale=en-US) : Configure the access control lists for who can discover and trigger AI agents and agentic workflows in their guided setups in AI Agent Studio. You can determine whether an AI agent or agentic workflow behaves as a dynamic user or as an AI user. You can also specify if an AI agent or agentic workflow can be available to all authenticated users or publicly available. | [ ] ## Removed Between your current release family and Yokohama, some ServiceNow Otto for Unified Security Exposure Management features or functionality were removed. {#dfrn3-servicenowottoforunifiedsecurityexposuremanagement-summary__entry__20} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | [ ] ## Deprecations Between your current release family and Yokohama, some ServiceNow Otto for Unified Security Exposure Management features or functionality were deprecated. {#dfrn3-servicenowottoforunifiedsecurityexposuremanagement-summary__entry__26} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | [ ] ## Activation information Review information on how to activate ServiceNow Otto for Unified Security Exposure Management. {#dfrn3-servicenowottoforunifiedsecurityexposuremanagement-summary__entry__32} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | Activation information : Install ServiceNow Otto for Unified Security Exposure Management by requesting it from the ServiceNow Store. Visit the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home) website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the [ServiceNow Store version history release notes](https://www.servicenow.com/docs/access?context=sn-store-release-notes&family=yokohama&ft:locale=en-US). Important: ServiceNow Otto for Unified Security Exposure Management is available in the ServiceNow Store. For details, see the "Activation information" section of these release notes. | [ ] ## Additional requirements If any additional requirements were introduced or changed for ServiceNow Otto for Unified Security Exposure Management we have noted them here. {#dfrn3-servicenowottoforunifiedsecurityexposuremanagement-summary__entry__38} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | [ ] ## Browser requirements If any specific browser requirements were introduced or changed for ServiceNow Otto for Unified Security Exposure Management we have noted them here. {#dfrn3-servicenowottoforunifiedsecurityexposuremanagement-summary__entry__44} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | [ ] ## Accessibility information Review details on accessibility information for ServiceNow Otto for Unified Security Exposure Management, such as specific requirements or compliance levels. {#dfrn3-servicenowottoforunifiedsecurityexposuremanagement-summary__entry__50} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | [ ] ## Localization information If there are specific localization considerations for ServiceNow Otto for Unified Security Exposure Management we have noted them here. {#dfrn3-servicenowottoforunifiedsecurityexposuremanagement-summary__entry__56} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | [ ] ## Highlight information If there are specific highlight considerations for ServiceNow Otto for Unified Security Exposure Management we have noted them here. {#dfrn3-servicenowottoforunifiedsecurityexposuremanagement-summary__entry__62} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | [Yokohama Patch 11](https://www.servicenow.com/docs/access?context=yokohama-patch-11&family=yokohama&ft:locale=en-US) * Review changes to Now Assist usage measurement. See the "Changed in this release" section below. * Some Now Assist skills, agents, and agentic workflows are on by default. * Additional role configuration is required for agentic workflows and AI agents included with Now Assist applications. * Use ServiceNow Otto for Unified Security Exposure Management with Security Posture Control to help you with [Creating an API connector in the Security Posture Control workspace](https://www.servicenow.com/docs/access?context=using-now-assist-api-connector&family=yokohama&ft:locale=en-US). * [Yokohama Patch 6](https://www.servicenow.com/docs/access?context=yokohama-patch-6&family=yokohama&ft:locale=en-US) Help your analysts identify duplicate host vulnerable items and analyze available remediation options with generative AI skills with ServiceNow Otto for Unified Security Exposure Management. * Use Google Gemini and Anthropic Claude on AWS as AI model providers for Now Assist skills and AI agents in addition to Now LLM Service and Azure OpenAI. See [ServiceNow Otto for Unified Security Exposure Management](https://www.servicenow.com/docs/access?context=now-assist-for-vulnerability-response-landing&family=yokohama&ft:locale=en-US) for more information. | [ ]