Session Overview

 

The session focused on how ServiceNow customers can assess, improve, and demonstrate the security of their ServiceNow instances , especially as organizations adopt agentic AI.

 

The key message throughout the session was: 

      Security is not just about doing the right things, it is about being able to prove you did them. 

 

Shared Security Model

 

Securing a ServiceNow instance is a shared responsibility between ServiceNow and the customer.

 

For a detailed breakdown of responsibilities, refer to the official ServiceNow Shared Responsibility Model :

https://www.servicenow.com/content/dam/servicenow-assets/public/en-us/doc-type/resource-center/white-paper/wp-shared-responsibility-model.pdf

 

Three Layers of ServiceNow Security

 

The session introduced three layers for understanding platform security:

 

                   - Invisibles: Built-in protections provided by the platform

                   - Configurables: Security controls customers enable and manage 

                   - Enhanceables: Advanced security capabilities for additional requirements

 

Invisibles

 

These are protections built into the platform, including:

 

• Infrastructure security 

• Physical security 

• Patch management 

• Network protections

• Compliance controls 

 

Configurables

 

Security Center

 

Security Center was highlighted as the starting point for reviewing security posture.

 

Key capabilities:

 

• Hardening score 

• Security recommendations 

• Risk acceptance tracking

 

 

Access Management Console (within Security Center)

 

The Access Management Console provides centralized access analysis capabilities, including:

 

Access Analyzer

 

Used for:

 

• Comparing user access 

• Troubleshooting permission differences 

• Simulating the impact of role or group roles 

 

Access Findings

 

Provides automated checks to identify issues such as:

 

• Dormant accounts 

• Excessive permissions 

• External users accessing sensitive data 

 

Log Export Service

 

Log Export Service is a standalone platform capability and is not part of Security Center.

 

It provides forensic-quality platform logs that can be exported to SIEM platforms such as:

 

• Splunk 

• Elastic 

-Dynatrace

 

Benefits include:

 

• Long-term retention

• Investigation support 

• Visibility into authentication, access, and configuration changes 

 

Log Export Service is included with the platform with throughput limits and is also available through Vault with unlimited throughput.

 

Vault Suite (Enhanceables)

 

Vault provides advanced security capabilities for organizations with stronger privacy and regulatory requirements.

 

Data Privacy

 

Helps organizations:

 

• Discover sensitive data 

• Remove or anonymize unwanted information 

• Protect data in non-production environments

 

Platform Encryption

 

Provides:

 

• Encryption at rest 

• Field-level encryption 

• Customer-controlled keys 

• Advanced encryption controls 

 

Zero Trust Access

 

Enables dynamic access adjustments based on security context, such as device posture or location.

 

Agentic AI Security

 

The session emphasized that AI security requires more than prompts and instructions.

 

The key principle:

 

                System prompts are not security controls.

 

Secure AI requires a strong runtime environment, often referred to as a harness , which includes:

 

• Permissions 

• Approval workflows 

• Observability 

• Execution boundaries 

• Policy enforcement

 

AI Security Capabilities

 

Now Assist Guardian

 

Helps protect AI interactions from:

 

• Prompt injection

• Unsafe content 

• Policy violations 

 

 

Data Privacy for Now Assist

 

Protects sensitive information by masking personal data before it reaches AI models and restoring it afterward.

 

 

AI Agent Controls

 

Additional controls include:

 

• AI Agent User Types

• Agent Role Masking 

• Granular admin roles 

 

These capabilities support least-privilege access and reduce the potential impact of autonomous agents.

 

AI Control Tower

 

AI Control Tower extends AI governance across ServiceNow and external AI environments.

 

Key areas:

 

• Discover 

• Govern 

• Secure 

• Observe 

• Measure 

 

Recommended Next Steps

 

The session recommended three immediate actions:

 

1. Review Security Center. 

       - Check your hardening score and address improvements areas. 

1. Review Access Management Console. 

       - Use Access Analyzer and Access Findings to identify access risks. 

1. Enable Log Export Service. 

       - Ensure logs are exported, retained, and available for investigation. 

 

Final Takeaway

 

ServiceNow security is built through a combination of:

 

• Platform protections 

• Customer-configured controls 

• Advanced security capabilities

 

As AI adoption grows, organizations need secure foundations built around least privilege, data protection, observability, and controlled execution,  enabling innovation while maintaining security and compliance.

 

Watch the Full Session

Want to dive deeper into the concepts, examples, and security capabilities discussed in this session?

 

Watch the full session recording:

 

https://cdn.embedly.com/widgets/media.html?src=https%3A%2F%2Fwww.youtube.com%2Fembed%2Fd9Q2dXWsn9A%3Ffeature%3Doembed&display_name=YouTube&url=https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3Dd9Q2dXWsn9A&image=https%3A%2F%2Fi.ytimg.com%2Fvi%2Fd9Q2dXWsn9A%2Fhqdefault.jpg&type=text%2Fhtml&schema=youtube