A security incident doesn't wait for business hours, and neither should the response to one. Yet a 2021 study from the Information Systems Security Association and ESG found that 57 percent of organisations say they're impacted by a shortage of cybersecurity resources, and 44 percent say the problem has gotten worse, not better. Five years on, most SOC leaders will tell you that number hasn't moved much. What has changed is the shape of the problem: security teams are no longer just short-staffed against human attackers. They're now expected to govern a second workforce, made up of AI agents that hold their own credentials, touch multiple systems, and act faster than any analyst can review.
That's the environment ServiceNow Security Operations was built for, and it's also why so much has changed inside the product over the past year. What used to be a system of record for incidents and vulnerabilities, with some orchestration layered on top, now stretches to cover AI agents as identities in their own right, asset intelligence that updates itself in real time, and a set of AI specialists that can run parts of the investigation on their own.
The problem SecOps is supposed to fix
Here's the pattern that shows up in almost every post-incident review. A SIEM fires an alert. A security analyst opens a ticket in one tool. They need a server patched or a firewall rule changed, so they email or Slack the IT team, who is working from a completely different system with no visibility into why the request matters or how urgent it really is. The security team doesn't know if the change happened. The IT team doesn't know what's at stake if it doesn't. Somewhere in that handoff, hours or days disappear, and detection-to-response times that should be measured in minutes end up measured in months.
That gap between security and IT operations is the actual problem SecOps, as a discipline, was invented to close. It borrows the logic of DevOps: instead of two departments throwing work over a wall, security and operations share a workflow, a data model, and a set of priorities. ServiceNow turns that idea into a set of applications that run on the same platform, the same configuration data, and the same case record that IT already uses for everything else.
So what is Security Operations, exactly
Strip away the branding and Security Operations is, at its core, an attempt to answer one question faster: out of everything happening on the network right now, what actually matters to this business, and who needs to fix it? Answering that requires three things working together: a way to pull in signals from the tools already in place (SIEM, EDR, vulnerability scanners, threat feeds), a way to weigh those signals against what the business would actually lose if a given asset went down, and a way to route the resulting work to the right team with a paper trail attached.
The piece that makes the second part possible is the Configuration Management Database, or CMDB, which most organisations already maintain for IT service and asset management. Security Operations reads from that same CMDB rather than keeping its own separate map of the environment. A vulnerability on a test server and the identical vulnerability on a production payment system generate very different risk scores, because the CMDB already knows which one supports a revenue-critical service and which one doesn't. That single design choice is why response times drop: nobody has to research business impact from scratch every time something goes wrong.
The apps inside SecOps
ServiceNow groups the SecOps applications into a handful of packages that scale up as a security programme matures, and it's easier to understand them by what they're for rather than as a flat feature list.
For responding to active threats, Security Incident Response gives analysts a workspace, playbooks, and orchestration to investigate and contain incidents without leaving the platform, and Major Security Incident Management adds a dedicated workspace for coordinating the handful of incidents each year that are serious enough to need cross-functional command and control.
For staying ahead of exposure, Vulnerability Response (increasingly referred to as Unified Security Exposure Management as ServiceNow broadens it beyond patch-and-scan cycles) prioritises vulnerable assets using the same CMDB-driven risk scoring, while Security Posture Control extends that visibility into cloud environments and flags where security tool coverage has gaps. Configuration Compliance sits alongside both, importing scan results from security configuration assessment tools to catch misconfigurations before they become the way in.
For understanding what's actually happening, Threat Intelligence Security Center pulls in indicators of compromise from multiple feeds (including STIX and TAXII sources) and correlates them against live incidents, and Performance Analytics for Security Operations turns all of the above into dashboards built for three different audiences: a CISO who needs board-level trend lines, a SOC manager who needs today's queue, and an analyst who needs the detail behind a single case. Event Management and Data Loss Prevention Incident Response round out the suite, reducing alert noise and folding DLP findings into the same incident workflow.
None of these applications work in isolation from the others, and that's deliberate. A vulnerability found by Vulnerability Response, a misconfiguration flagged by Configuration Compliance, and an active incident opened by Security Incident Response all roll up into the same risk picture, scored against the same business context, visible on the same dashboard.
What happens when someone reports a phishing email
Here's what that looks like end to end, using one of the most common incident types a SOC handles.
An employee forwards a suspicious email to a monitored security mailbox. ServiceNow parses the attached message, checks it against pre-built matching rules, and if it looks like a phish, opens a security incident with the original email attached, no analyst involved yet. Any URLs, IP addresses, or file hashes in that email (its observables, in SOC terminology) get submitted automatically to whichever threat intelligence vendors the organisation has connected, whether that's CrowdStrike, Palo Alto Networks, Recorded Future, VirusTotal, Zscaler, or any of dozens of others available through the ServiceNow Store. Results come back within seconds and populate directly on the incident record.
At the same time, the incident is assigned to an analyst and a phishing playbook attaches itself automatically, breaking the work into phases: analysis, containment, eradication. In analysis, the analyst reviews what the threat intelligence lookups turned up and can pull related knowledge base articles without leaving the record. In containment, they can search the organisation's Exchange environment directly from the incident to see who else received the email and whether they opened it, then delete remaining copies from the server before more damage is done. If an endpoint needs isolating, that action can be triggered through an existing EDR integration rather than requiring the analyst to log into a separate console. Once eradication tasks are complete, the incident closes itself and ServiceNow generates a time-stamped post-incident review automatically, which becomes the reference document the next analyst pulls up when a similar incident lands six months later.
At no point did the analyst need to open a second tool, write a status update email, or manually piece together what happened after the incident closed. Removing that friction, more than any single feature, is what drives the response-time improvements SecOps customers report.
The CMDB connection
The CMDB is the part of Security Operations most likely to be underestimated during a rollout. A vulnerability scanner or SIEM can tell you what's wrong. It generally can't tell you whether the affected asset supports payroll, or a public-facing checkout page, or a decommissioned test environment nobody's touched in a year. Without that context, every finding looks roughly as urgent as every other finding, which is exactly how alert fatigue sets in.
ServiceNow's risk score calculator, used consistently across Vulnerability Response, Configuration Compliance, and Security Incident Response, pulls business criticality straight from the CMDB and combines it with severity and exploitability to produce a single 0 to 100 score. Teams can weight that calculator to reflect what actually matters to their business (a healthcare provider might weight patient-data systems more heavily than a retailer would), but the underlying mechanic is the same everywhere: prioritisation stops being a judgment call made under pressure and becomes something the platform calculates before a human ever looks at the queue. Machine learning can then group similar failures together and route them to the team that owns the affected asset, so a batch of misconfigurations on the same application cluster lands with one owner instead of scattering across a dozen tickets.
MITRE ATT&CK
Most security teams are good at answering "what just happened." Fewer are equipped to answer "what's likely to happen next," and that gap is where a lot of damage gets done during an active attack. ServiceNow addresses this by mapping incidents and observables to the MITRE ATT&CK framework, the industry-standard catalogue of adversary tactics and techniques, as they come in.
Practically, that means an analyst working a security incident can see immediately which stage of an attack chain they're looking at and pull up the ATT&CK Navigator to see which techniques tend to follow it, based on how real adversary groups have behaved historically. It's the difference between reacting to one alert in isolation and reading the whole sequence an attacker is likely running. Heat maps built on the same data let a SOC step back from individual incidents and ask a broader question: across every technique in the ATT&CK matrix, where do we actually have detection and blocking controls in place, and where are we blind? That's a harder question to answer with spreadsheets, and it's usually the one boards actually want answered.
Ransomware and the four phases
Ransomware remains the clearest illustration of why SecOps needs to connect to more than just the security stack. Cybersecurity Ventures put the total global cost of ransomware at more than 20 billion US dollars in 2021 alone, with projections reaching as high as 265 billion dollars annually by 2031. Defending against an attack at that scale isn't a SOC problem in isolation, it's an organisational resilience problem, and ServiceNow's own framing of it breaks into four phases worth knowing regardless of vendor.
Anticipate is discovery and planning: knowing every asset you have, on-premises or in the cloud, and its relationship to business services, which again comes back to a clean CMDB. Prepare is where Vulnerability Response, Configuration Compliance, and vendor risk assessments do their work, hardening the attack surface before anything happens. Respond is where Security Incident Response and the MITRE ATT&CK Navigator take over once an attack is underway, running the correct playbook while business continuity plans activate in parallel. Adapt is the phase most organisations skip: using Performance Analytics after the fact to find out where the response actually slowed down, so the same weakness doesn't get exploited twice. Read together, those four phases are a decent checklist for evaluating any security programme, ServiceNow-powered or not.
What's new in the Australia release
ServiceNow's Australia release, which shipped in Q2 2026, doesn't carry a dedicated Security Operations product overhaul the way, say, IT Service Management did with its Level 1 AI Specialist. What it does carry is a genuinely useful addition and a set of platform-level security upgrades that every SecOps customer inherits automatically.
The addition is the Security Incident Evaluation Project, a ready-to-use Process Mining project built specifically for Security Incident Response data. Point it at an existing instance and, without any install or configuration work, it surfaces where security incident response is actually slow, where mean-time-to-detect and mean-time-to-respond can be trimmed, and where there's a real case for adding automation or an AI agent rather than just hiring another analyst. For a SOC team trying to build a business case for further SecOps investment, this is the kind of evidence-based starting point that usually took a consultant a few weeks to assemble manually.
Underneath that, the release added a batch of platform security capabilities that apply across every application built on the Now Platform, SecOps included. ServiceNow Vault Console now guides admins through discovering sensitive fields in custom applications and applying encryption or anonymisation controls without a step-by-step manual process. Data Privacy enhancements can now block sensitive data from entering fields in real time and quarantine risky attachments automatically at upload, rather than catching the problem after the fact. Platform Encryption gained support for external key management, letting organisations control their own encryption keys and rotation schedules through their existing enterprise key management systems rather than trusting ServiceNow to hold them. Identity added more than 100 granular, task-based admin roles to replace broad catch-all Admin access, which matters directly to anyone running a SecOps instance, since least-privilege access to incident and vulnerability data is itself a security control. And a new Integration Provider Registry gives admins a single place to see exactly which external providers are connecting to their instance and what data they can reach, closing a blind spot that inbound integrations have quietly represented for years.
None of these will show up in a sales deck as a SecOps headline feature, but all of them reduce the attack surface of the platform that SecOps itself runs on, which is arguably more important.
The AI agent problem
In May, at its Knowledge 2026 event, ServiceNow closed its acquisitions of Armis and Veza and folded them into a new offering called Autonomous Security & Risk. Armis contributes continuous, agentless asset intelligence across IT, operational technology, IoT, and connected devices, feeding that data straight into the CMDB so it stops being a static inventory and starts reflecting the actual attack surface in real time. Veza contributes fine-grained visibility into who, and increasingly what, has access to which systems, covering human and non-human identities alike. Security and risk had already crossed 1 billion US dollars in annual contract value for ServiceNow the year before, making it one of the fastest-growing parts of the business, and this was the clearest signal yet of where that growth is being reinvested.
Then in early August 2026, ServiceNow expanded that portfolio again, organised around a problem that didn't really exist at scale until AI agents started operating inside enterprise systems: agents now hold their own credentials, can touch multiple applications, and can make decisions about what action to take, all without a human in the loop for every step. If one of those agents is compromised or simply over-permissioned, it becomes a route into systems that used to require a human login. The expanded portfolio addresses that across six areas. AI Agent Access Security and Non-Human Identity Remediation handle the access control and identity side, automating key rotation, deprovisioning, and permission revocation across IT, OT, IoT, and even medical device environments. Agentic Exposure Management consolidates vulnerability findings from multiple sources and adds business and threat context automatically, while a new Vulnerability Resolution AI Specialist can orchestrate triage and execute low-risk patches on its own. Agentic Incident Response introduces a Tier 2 SOC AI Specialist that can investigate incidents and carry out multi-stage response plans (enrichment, correlation, containment, blocking) escalating only the higher-risk decisions to a human analyst. Agentic AI for Cyber-Physical Security extends visibility into OT and medical networks without deploying traditional agents on those devices, and Agentic AI for Continuous Control Monitoring, paired with a new Cryptographic Asset Compliance capability, moves compliance checking from periodic audits to continuous evaluation, including flagging legacy cryptography that will need to migrate ahead of quantum-capable computing.
Most of that is available now. ServiceNow has said the Tier 2 SOC AI Specialist, the Vulnerability Resolution AI Specialist, Continuous Control Monitoring, and Cryptographic Asset Compliance specifically are scheduled to ship in December 2026. For anyone planning a 2026 or 2027 roadmap, this extends SecOps and the broader Security and Risk portfolio rather than replacing it, governing a workforce that now includes software alongside people.
Before any of this works
None of what's above is worth much without the groundwork most SecOps rollouts underdeliver on, which is a clean, well-maintained CMDB. Every risk score, every automated routing decision, every dashboard mentioned in this piece depends on the CMDB accurately reflecting business criticality. Instances that skip that step tend to end up with Security Operations that generates plenty of automation and not much better prioritisation, because the platform is scoring risk against a map of the environment that's already out of date.
The second most common gap is playbook and integration design. Out-of-the-box playbooks cover common scenarios like phishing and malware well, but the real value shows up when they're built around an organisation's actual runbook, its actual vendor stack, and its actual escalation paths, which takes hands-on configuration work, not just enabling a plugin. That's where an experienced implementation partner tends to matter more than any single feature on the product page.
SYSUSA has spent more than a decade doing exactly that kind of implementation work across the ServiceNow platform, and Security Operations rollouts follow the same pattern as everything else: start with the data model, build the workflows around how the team actually works, and only then start layering in the automation and AI capabilities that make the headlines. If you're evaluating SecOps for the first time, or you already run it and want a clear-eyed look at whether your instance is ready for what ServiceNow just shipped, that's a conversation worth having before the next release lands.
