--- sourceDocument: zurich Combined Product Files sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/delta-xanadu-zurich Release : - zurich ft:locale : - en-US ft:publication_title : - zurich Combined Product Files ft:clusterId : - delta3zx bundleId : - delta3zx --- # Combined ServiceNow Otto for Security Incident Response (SIR) release notes for upgrades from Xanadu to Zurich # Combined ServiceNow Otto for Security Incident Response (SIR) release notes for upgrades from Xanadu to Zurich {#ariaid-title1} Release version: Zurich Updated October 8, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 5 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Combined ServiceNow Otto for Security Incident Response (SIR) Release Notes for Upgrades from Xanadu to Zurich This consolidated release notes document covers all key updates, changes, and upgrade guidance for ServiceNow Otto for Security Incident Response (SIR) from the Xanadu through to the Zurich release. It is intended to assist ServiceNow customers in preparing and executing upgrades while understanding new capabilities and important considerations. Show full answer Show less ## Upgrade Preparation and Important Information * Before upgrading to Zurich, review and complete the specified pre- and post-upgrade tasks to ensure a smooth transition. * Upgrading to version 2.0.1 renames the application from Now Assist for Security Operations to ServiceNow Otto for Security Incident Response (SIR). * This upgrade activates default Now Assist skills if they were previously unconfigured, but skills manually deactivated or customized remain inactive, maintaining customer control. * To utilize key features like generating resolution notes and correlation insights from the Now Assist panel, the AI Search application must be enabled in your instance. ## New Features and Changes No new features, changes, removals, or deprecations were introduced specifically in the Zurich release for ServiceNow Otto for Security Incident Response (SIR). Prior releases such as Yokohama introduced notable enhancements including: * Use of generative AI for resolution note generation, quality assessment reports, and post-incident analysis. * Chat interactions with AI agents to assist in incident resolution, handover reports, and metric insights. * Support for multiple AI model providers (Google Gemini, Anthropic Claude, Now LLM Service, Azure OpenAI) for Now Assist skills and agents. * Agentic workflows and additional role-based configurations to enhance AI-driven security operations. * Enhanced triage capabilities by summarizing long incident activity streams and correlating incidents through affected users, configuration items, and observables. ## Activation and Additional Requirements * ServiceNow Otto for Security Incident Response (SIR) is available for installation via the ServiceNow Store. * Activation details and cumulative release notes are accessible through the ServiceNow Store version history. * No additional browser, localization, or accessibility changes were introduced between Xanadu and Zurich. ## Practical Impact for ServiceNow Customers Customers upgrading from Xanadu to Zurich can expect a streamlined upgrade process without major changes or disruptions to existing features in Zurich. However, enabling AI Search and upgrading to version 2.0.1 are critical to unlocking enhanced Now Assist functionalities that improve incident investigation efficiency and resolution quality through AI-driven insights and automation. Maintaining control over AI skill activation ensures flexibility in tailoring the system to organizational needs post-upgrade. Prior Yokohama enhancements deliver powerful AI-driven capabilities that improve security incident triage, analysis, and collaboration. Consolidated page of all release notes for ServiceNow Otto for Security Incident Response (SIR) from Xanadu to Zurich. ## How to use this page To help you prepare for your upgrade, we have combined the cross-family ServiceNow Otto for Security Incident Response (SIR) release notes onto one page. Read this summary of the new features, changes, and updated information for your product from Xanadu to Zurich. Tip: If there were no updates for a release notes section in a certain family release, we included a short note for your reference. For example, if a product did not have any updates in Tokyo, the row says "No updates for this release." ## Important information for upgrading ServiceNow Otto for Security Incident Response (SIR) to Zurich Before you upgrade to Zurich, review these pre- and post-upgrade tasks and complete the tasks as needed. {#dfrn3-servicenowottoforsecurityincidentresponsesir-summary__entry__2} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | Upgrade information : For more information about required applications for ServiceNow Otto for Security Incident Response (SIR), see [Supporting information](https://www.servicenow.com/docs/access?context=supporting-information-now-assist-security-incident&family=yokohama&ft:locale=en-US). Note: Upgrading the Now Assist plugins activate any designated skills that were previously untouched by the customer. * If you have the plugins installed but never touched the configuration (never activated the skill nor adjusted associated roles) of a skill, any Default On skill will be activated on a per skill basis upon upgrading. * If you have previously toggled a skill from active and then back to inactive or have updated any roles for that skill, that skill remains inactive upon upgrading. * You maintain full control over deactivating individual skills at any time after activation. Starting with version 2.0.1, the name of the Now Assist for Security Operations application in ServiceNow® Store and in your ServiceNow AI Platform® instance has changed to ServiceNow Otto for Security Incident Response (SIR). You must upgrade to version 2.0.1 to access the following features: * Generate resolution notes in the Now Assist context menu. * Generate correlation insights for a security incident investigation from the Now Assist panel. The AI Search application must be enabled so that the recommended actions skill works for security incidents. To verify that AI Search is enabled on your instance, navigate to AllAI SearchAI Search Status. Contact support if the page indicates that AI Search is not enabled. | | Zurich | No updates for this release. | [ ] ## New features Between your current release family and Zurich, new features were introduced for ServiceNow Otto for Security Incident Response (SIR). {#dfrn3-servicenowottoforsecurityincidentresponsesir-summary__entry__10} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## Changes Between your current release family and Zurich, some changes were made to existing ServiceNow Otto for Security Incident Response (SIR) features. {#dfrn3-servicenowottoforsecurityincidentresponsesir-summary__entry__18} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## Removed Between your current release family and Zurich, some ServiceNow Otto for Security Incident Response (SIR) features or functionality were removed. {#dfrn3-servicenowottoforsecurityincidentresponsesir-summary__entry__26} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## Deprecations Between your current release family and Zurich, some ServiceNow Otto for Security Incident Response (SIR) features or functionality were deprecated. {#dfrn3-servicenowottoforsecurityincidentresponsesir-summary__entry__34} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## Activation information Review information on how to activate ServiceNow Otto for Security Incident Response (SIR). {#dfrn3-servicenowottoforsecurityincidentresponsesir-summary__entry__42} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | Activation information : Install ServiceNow Otto for Security Incident Response (SIR) by requesting it from the ServiceNow Store. Visit the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home) website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the [ServiceNow Store version history release notes](https://www.servicenow.com/docs/access?context=sn-store-release-notes&family=yokohama&ft:locale=en-US). Important: ServiceNow Otto for Security Incident Response (SIR) is available in ServiceNow Store. For details, see the "Activation information" section of these release notes. | | Zurich | No updates for this release. | [ ] ## Additional requirements If any additional requirements were introduced or changed for ServiceNow Otto for Security Incident Response (SIR) we have noted them here. {#dfrn3-servicenowottoforsecurityincidentresponsesir-summary__entry__50} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## Browser requirements If any specific browser requirements were introduced or changed for ServiceNow Otto for Security Incident Response (SIR) we have noted them here. {#dfrn3-servicenowottoforsecurityincidentresponsesir-summary__entry__58} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## Accessibility information Review details on accessibility information for ServiceNow Otto for Security Incident Response (SIR), such as specific requirements or compliance levels. {#dfrn3-servicenowottoforsecurityincidentresponsesir-summary__entry__66} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## Localization information If there are specific localization considerations for ServiceNow Otto for Security Incident Response (SIR) we have noted them here. {#dfrn3-servicenowottoforsecurityincidentresponsesir-summary__entry__74} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## Highlight information If there are specific highlight considerations for ServiceNow Otto for Security Incident Response (SIR) we have noted them here. {#dfrn3-servicenowottoforsecurityincidentresponsesir-summary__entry__82} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | [Yokohama Patch 11](https://www.servicenow.com/docs/access?context=yokohama-patch-11&family=yokohama&ft:locale=en-US) * Review changes to Now Assist usage measurement. * Some Now Assist skills, agents, and agentic workflows are on by default. * Additional role configuration is required for agentic workflows and AI agents included with Now Assist applications. * Use generative AI to create a quality assessment report of a security incident. * Yokohama Patch 6Help analysts to add security incidents details to the Shift Handover report by chatting with AI agents in the Now Assist panel. * Use Google Gemini and Anthropic Claude on AWS as AI model providers for Now Assist skills and AI agents in addition to Now LLM Service and Azure OpenAI. * Yokohama Patch 3 Help your analysts to gain insight into security incident record metrics with an agentic workflow. Chat with AI agents in natural language from the Now Assist panel. Help your analysts to resolve security incidents by chatting with AI agents in the Now Assist panel where the AI agent provides a resolution plan. * Yokohama Patch 1Help your analysts to close security incidents more efficiently by chatting with AI agents in natural language from the Now Assist panel. * Yokohama early availability * Triage security incidents with long activity streams by reviewing work notes and contextual information quickly in a concise, easy-to-read format. * Automatically generate resolution notes for security incidents by using generative AI. * Generate recommended actions to resolve security incidents. * Generate a post-incident analysis. * Generate correlation insights to help you connect current incidents to past events. By identifying the affected users, configuration items (CIs), or observables (IP addresses and file hashes) from existing incidents, you can help to triage new security incidents. For more information, see [ServiceNow Otto for Security Incident Response (SIR)](https://www.servicenow.com/docs/access?context=now-assist-security-incident-landing&family=yokohama&ft:locale=en-US). | | Zurich | No updates for this release. | [ ] *[\>]: and then