A FORRESTER TOTAL ECONOMIC IMPACT™ STUDY COMMISSIONED BY SERVICENOW The Total Economic Impact™ Of ServiceNow Security Operations Cost Savings And Business Benefits Enabled By Security Incident Response And Vulnerability Response October 2020 THE TOTAL ECONOMIC IMPACT™ OF SERVICENOW SECURITY OPERATIONS Table Of Contents Executive Summary ................................................. 1 The ServiceNow Security Operations Customer Journey ..................................................................... 6 Key Challenges ...................................................... 6 Solution Requirements/Investment Objectives ...... 6 Composite Organization ......................................... 7 Analysis Of Benefits ................................................ 8 Increased Efficiency Of Security Incident Response Process................................................................... 8 Improved Vulnerability Management And Response Times .................................................. 10 Opex Savings From Discontinuation Of Legacy Tools ..................................................................... 11 Real-Time Visualization — Cost Savings For Reporting .............................................................. 12 Unquantified Benefits ........................................... 13 Flexibilty................................................................ 13 Analysis Of Costs .................................................. 14 ServiceNow Security Operations Deployment, License, And Professional Services Costs........... 14 Due Diligence And Ongoing Management Costs….. ............................................................... 15 Financial Summary ................................................ 17 Appendix A: Total Economic Impact ................... 18 Consulting Team: Sri Prakash Gupta Henry Huang ABOUT FORRESTER CONSULTING Forrester Consulting provides independent and objective research-based consulting to help leaders succeed in their organizations. For more information, visit forrester.com/consulting. © 2020, Forrester Research, Inc. All rights reserved. Unauthorized reproduction is strictly prohibited. Information is based on the best available resources. Opinions reflect judgment at the time and are subject to change. Forrester®, Technographics®, Forrester Wave, RoleView, TechRadar, and Total Economic Impact are trademarks of Forrester Research, Inc. All other trademarks are the property of their respective companies. THE TOTAL ECONOMIC IMPACT™ OF SERVICENOW SECURITY OPERATIONS 1 Executive Summary With the ever-growing complexity and volume of cyberattacks, organizations will become even more vulnerable to security threats. All companies — big or small — have critical assets to protect, including customer data that will cause business damage or market setback if violated. Therefore, organizations need security orchestration tools that can connect security and IT teams to respond faster and more efficiently to security incidents and vulnerabilities and to get a definitive view of their security posture. ServiceNow commissioned Forrester Consulting to conduct a Total Economic Impact™ (TEI) study and examine the potential return on investment (ROI) enterprises may realize by deploying ServiceNow’s Security Operations. The purpose of this study is to provide readers with a framework to evaluate the potential financial impact of investing in ServiceNow to improve security incident and vulnerability response processes for their organizations. To better understand the benefits, costs, and risks associated with this investment, Forrester interviewed three customers with experience of using Security Operations (consisting of Security Incident Response and Vulnerability Response). For the purposes of this study, Forrester aggregated the experiences of the interviewed customers and combined the results into a single composite organization. The interviewees said that prior to investing in Service Now, their organizations spent several person-hours gathering security event and incident data from multiple sources for each incident, prioritizing and grouping them by criticality, identifying the locations of vulnerable infrastructure assets, and working across cross-functional teams to remediate issues. However, prior attempts yielded limited success, leaving customers exposed to bigger security risks and vulnerabilities, and unable to scale as the workloads continued to grow. ServiceNow Security Operations helped these customers: • Automate manually intensive security incident and vulnerability response workflows. • Consolidate and prioritize alerts from multiple security tools onto a single platform. • Quickly map security incidents and vulnerabilities to IT infrastructure for better impact analysis and accurate assignment. • Prioritize and resolve the most critical security incidents and vulnerabilities first. Return on investment (ROI) 238% Net present value (NPV) $4.4 million KEY STATISTICS PAYBACK 6 months THE TOTAL ECONOMIC IMPACT™ OF SERVICENOW SECURITY OPERATIONS 2 EXECUTIVE SUMMARY KEY FINDINGS Quantified benefits. The composite organization experiences the following risk-adjusted present value (PV) quantified benefits over three years: • Increased efficiency of prioritization and resolution of security incidents, resulting in $4.9 million in benefits. The composite organization sees a 40% improvement in the efficiency with which frontline security analysts handle tier 1 security incidents. It also realizes a 60% efficiency increase related to managing tier 2 and higher security incidents that require coordination across multiple IT and security resources. These efficiencies are gained by automating workflows that span security and IT, prioritizing security incidents based on business criticality, and tracking incidents and assigning tasks using a single platform • Improved vulnerability management and response times, resulting in $488,311 in benefits. The interviewed customers now conduct routine weekly scans to identify, classify, and prioritize vulnerabilities in their environments. On average, they identify 30,000 vulnerabilities each week. Previously, they resorted to manually intensive processes to categorize vulnerabilities and have them analyzed by their security teams. ServiceNow Security Operations allows these customers to automatically pull all the data from a vulnerability scan into the solution and then apply rules and logic to identify critical vulnerabilities that need immediate action (for instance, map vulnerabilities and prioritize based on risk score, eliminate manual tasks / disjointed processes with automated workflows). It also links these vulnerabilities to existing assets to determine business relevance and impact. The composite organization sees a 70% improvement in the way in which it identifies and prioritizes vulnerabilities and assesses the impact on existing assets. In addition, it realizes a 30% improvement in vulnerability response times by speeding the application of patches and other remediation efforts with automated workflows. • Realized opex savings by eliminating legacy security tools, resulting in $283,997 in benefits. The composite organization is able to discontinue software licenses and support contracts for legacy tools it used to manage security incident response processes. Forrester estimates these tools cost the organization $200,000 each year and that it would be able to discontinue and realize these savings beginning in Year 2. • Improved security governance with real-time visibility and reporting, resulting in $430,862 in benefits. The composite organization realizes labor and time savings with unified dashboards, “We had multiple security tools. However, our inability to address vulnerabilities in a rapid fashion remained a huge concern for our organization. We wanted to get rid of manual process and automate the identification and remediation process. ServiceNow provides faster vulnerability response management, as well as additional context to fine tune the security posture.” Manager of cybersecurity, utilities “ServiceNow provided 24x7 visibility into our security environment, which was much needed for our global business operations. It helped us to reduce the security response time and significantly improve vulnerability management.” Chief information security officer, financial services THE TOTAL ECONOMIC IMPACT™ OF SERVICENOW SECURITY OPERATIONS 3 EXECUTIVE SUMMARY workflow automation, and easy reporting. It helps security and IT teams respond faster and more efficiently to incidents and vulnerabilities, and make use of time for improvements and innovation. The composite organization would have needed to have added 1.5 FTEs to produce real-time reports with the manually driven legacy environment and to match the reporting/visualization capabilities of ServiceNow. Unquantified benefits. Benefits that are not quantified for this study include: • Improved IT productivity. Previously, the composite organization’s IT resources assisted the security team by pulling data from multiple sources to identify security incidents and vulnerabilities. ServiceNow Security Operations provides the organization with a single platform to consolidate and integrate data across its environment and to route tasks to the right IT and security teams using automated workflows. • Better visibility into security posture. Intuitive real-time dashboards allow security teams and executives to understand the composite organization’s current security posture. These dashboards make it easy to track in-progress tasks, critical metrics, and KPIs to make business decisions and mobilize resources around the highest-priority security incidents. • Increased collaboration. ServiceNow Security Operations lets both IT and security resources assign tasks and collaborate in real time using a common system. Better collaboration improves security incident and vulnerability response times and accuracy.