Cranium AVR Connector brings the vulnerability findings Cranium discovers in your AI and machine-learning applications into ServiceNow Application Vulnerability Response, where your security team already works.

Findings arrive as native Application Vulnerable Items through the Vulnerability Response Integration Framework, and each one is correlated to the Business Application configuration item it affects. ServiceNow’s own risk scoring, business-criticality weighting and assignment rules then apply to Cranium findings exactly as they do to every other source, so analysts work a single prioritised backlog instead of watching a second console.

The connector keeps the lifecycle in step with Cranium — findings create, update, close and reopen as the source changes — while preserving closures an analyst has made in ServiceNow. Ingestion is delta-based and idempotent, so a re-run converges rather than duplicating.

Administrators get an operational dashboard showing connection status, run history, CI correlation coverage, the applications that matched no CI, and a diagnostics checklist that names the fix for each failing check.

The connector calls the Cranium API outbound over HTTPS using OAuth 2.0 credentials held in the platform credential vault. It registers no inbound endpoint and sends no instance data to Cranium. A Cranium subscription is required.

- Cranium findings arrive as native Application Vulnerable Items in one prioritised AVR queue.
- Every finding is correlated to its Business Application CI, so native risk scoring applies.
- Runs on the Vulnerability Response Integration Framework: data source, staging, transform map.
- Lifecycle tracks Cranium — create, update, close, reopen — and preserves manual closures.
- Dashboard shows connection status, run history, correlation coverage and diagnostics.