SecOps in ServiceNow is the discipline that unites security and IT on a single platform, with two core modules: Vulnerability Response, which prioritizes and coordinates vulnerability remediation, and Security Incident Response, which manages incidents from alert to closure. Both use the CMDB to know what is at risk and who is responsible for each asset. This guide shows how each module works, how they connect, and how to operate them.
What is SecOps in ServiceNow and how is the solution organized?
ServiceNow's SecOps (Security Operations) brings together security applications running on the same platform that supports ITSM and CMDB. According to ServiceNow itself, the solution consolidates signals from SIEM, EDR, scanners, and the cloud., Maps each signal to the CMDB to provide business context. and applies threat intelligence and AI to prioritize and act.
In terms of architecture, SecOps is divided into two flows. The first is preventative: finding, prioritizing, and correcting exposures before they are exploited, the role of Vulnerability Response (VR). The second is reactive: handling incidents that are already in progress, the role of Security Incident Response (SIR). Complementary applications within the family, such as Threat Intelligence Security Center, Configuration Compliance, and DLP Incident Response, extend these two flows, but this guide focuses on the two central ones.
The premise underlying both is the same: security only makes good decisions when it knows what business service, who owns, and what criticality is behind an asset. This information resides in the CMDB (Centralized Management Database), and that is why SecOps and asset governance are inseparable.
Vulnerability Response: From the list of CVEs to the task of remediation.
In vulnerability management, Vulnerability Response imports data from third-party scanners and the National Vulnerability Database (NVD), reconciles this data with CMDB assets, and enriches each finding with exploit context, threat intelligence, and business criticality. Vulnerable items are automatically grouped into remediation tasks, receive a risk score, and are assigned to the responsible teams, as described in the [reference to relevant documentation/documentation]. Official documentation regarding the CSDM tables used by VR..
Who does what in the vulnerability flow?
Two profiles divide the work. The vulnerability analyst or administrator operates in the Vulnerability Manager Workspace, where they monitor risk and can manually create remediation tasks. The remediation owner, typically IT operations, DevOps, or the service owner, works in the IT Remediation Workspace, where they execute the tasks and log change or exception requests when necessary. This design removes security from the paperwork of sending spreadsheets and places remediation in the work queue of those who execute it.
Application Vulnerability Response and SBOM
The Application Vulnerability Response feature, also part of the same product, imports application vulnerabilities and, since version 19.0, ingests data from Software Composition Analysis (SCA) and Software Bill of Materials (SBOM). When loading SBOM files, the platform attempts to associate product models and business applications with existing records in the CMDB, thus linking code risk to the service that uses it.
The name has changed: Unified Security Exposure Management
On October 23, 2026, the official Vulnerability Response product page on ServiceNow will display the name Unified Security Exposure Management (USEM), described as the next evolution of Vulnerability Response. USEM unifies findings from scanners, cloud, containers, and code into a single stream, maps to the CMDB, applies threat intelligence and AI scoring, and orchestrates remediation with SLAs. Technical documentation and certifications still use the name Vulnerability Response, so the two terms coexist. As VR is sold as a separate subscription, confirm licensing scope with ServiceNow before comparing offers.
Security Incident Response: From Alert to Lesson Learned
In incident response, the Security Incident Response team tracks the incident from discovery and initial analysis, through containment, eradication, and recovery, to post-incident review, knowledge article creation, and closure, as per the... official SIR documentation. According to product page, It ingests alerts from SIEMs, EDRs, and endpoints, adds asset and risk context from the CMDB, and creates responses that automate tasks between security and IT teams.
The Security Incident Response Workspace is the work interface for SOC analysts and managers. Pre-configured dashboards display metrics such as new incidents and the average age of open incidents, helping to identify bottlenecks in procedures. Incidents can also automatically trigger IT change requests, reducing back-and-forth between teams during containment. In cases of data breaches, the DLP Incident Response application logs policy violations and maintains an audit trail.
The family also includes NowAssist for Security Incident Response, and the product page mentions AI-powered incident summarization and risk-based prioritization. Treat these features as a layer on top of already organized processes and data: AI on top of an outdated CMDB accelerates the wrong decision. Validate availability and licensing with ServiceNow for your release.
Vulnerability Response and Security Incident Response: differences and points of contact.
| Criterion | Vulnerability Response | Security Incident Response |
|---|---|---|
| Objective | Reduce exposure by prioritizing and correcting vulnerabilities. | Contain and resolve ongoing incidents. |
| Kitten | Scanner finding, NVD or SBOM | SIEM, EDR, endpoint alert or report |
| Main user | Vulnerability analyst and patch owner | SOC Analyst and SOC Manager |
| Typical exit | Grouped correction task, with change or exception. | Incident with tasks, post-incident review, and knowledge article. |
| Role of CMDB | Define criticality and ownership of the vulnerable asset. | It shows the service affected and the impact of the incident. |
| Common indicators | Critical vulnerability backlog and remediation time | MTTD, MTTR and age of open incidents |
CMDB and CSDM: What underpins SecOps?
The Vulnerability Response documentation lists the CSDM tables that the application references: Configuration Item, Business Service, Technical Service, Product Model, and Application Model, in addition to CMDB Group and Dynamic CI Group. The imported data undergoes a CI search that looks for the corresponding record in the CMDB, and attributes that scanners don't discover, such as support group and classification, come from the registry. In SIR, the logic is equivalent: the asset and service context transforms an isolated alert into an incident with business impact.
Therefore, each gap in the CMDB reappears as an operational failure in SecOps. The table below summarizes the four that most affect work prioritization and assignment.
| Gap in CMDB | Effect on SecOps | Recommended action |
|---|---|---|
| CI without a support group or owner. | Correction task without a clear recipient. | Make ownership mandatory and audit the field periodically. |
| Asset missing from CMDB | Unreconciled finding and underestimated risk. | Integrate Discovery and asset sources and handle orphan findings in their own queue. |
| Business service without mapped CIs | Inability to prioritize based on criticality. | Map Business Service, Technical Service and CIs according to CSDM |
| Duplicate CIs | Inflated counts and repetitive tasks | Apply identification and reconciliation rules (IRE) |
To learn more about the database that SecOps uses, see the... CMDB implementation guide in ServiceNow with CSDM and the page of CMDB services. The asset management that feeds these records is described in ITAM.
How to operate SecOps in practice: end-to-end workflow
A mature SecOps program treats VR and SIR as a cycle, not as two separate projects. The sequence below organizes the operational flow into seven steps.
- Integrate scanners, SIEM, and EDR, and define the authoritative source for each asset type.
- Reconcile the findings with the CMDB and process what does not find CI in a separate queue.
- Define scoring rules that combine severity, known exploitation, exposure, and criticality of the service.
- Group findings into tasks and assign them to support groups, with SLAs per risk level.
- Handle exceptions and changes through ITSM, with approval and expiration dates.
- Escalate to the SIR when a vulnerability is exploited or an alert is confirmed, inheriting the asset's context.
- Close the incident with a post-incident review and knowledge article, and provide feedback to the VR prioritization rules.
The final step is what differentiates a program from a set of tools: learning from the incident changes the prioritization rule, and the new rule reduces the chance of the next incident.
Common mistakes in SecOps implementation
The errors below stem from the product design and CMDB dependency, and are architectural observations, not results from a sample of projects.
- Integrating scanners before organizing the CMDB (Centralized Mail Database) leads to unclaimed items and queues that no one is working on.
- Using only the severity of the scan as a priority, without considering known exploitation and service criticality.
- Not defining who performs the fix, leaving security responsible for a task that belongs to IT.
- Using SIR as a simple ticketing system, without playbooks, standardized tasks, and post-incident review.
- Measuring only the volume of vulnerabilities and incidents, without tracking remediation time and response time.
Indicators to monitor SecOps
| Indicator | What does it show? | Origin |
|---|---|---|
| Correction time per risk range | Actual speed of exposure closing | VR |
| Critical vulnerabilities with expired SLA. | Backlog that represents an immediate risk. | VR |
| Percentage of findings reconciled with CI | Quality of the foundation that supports prioritization | VR and CMDB |
| MTTD and MTTR | Time to detect and respond to incidents | SIR |
| Average age of reported incidents | Bottlenecks in response procedures | SIR |
| Incidents handled by playbook | Degree of standardization and automation of the response | SIR |
Define the goals based on the baseline of your own operation. Market benchmarks without a primary source, such as MTTR reduction percentages, should not be used as an internal target.
Where Armis and Veza enter SecOps
In 2026, ServiceNow completed the acquisition of Armis on 20/04/2026 and Veza's in March of the same year. Armis tracks approximately 7 billion devices in OT, IoT, and cloud, and its data enriches the CMDB records, while Veza's Access Graph maps access relationships of human and non-human identities. The effect for SecOps is to broaden what the CMDB sees, and therefore what VR and SIR can prioritize. The full context is in ServiceNow, Armis, and Veza: asset management and cybersecurity..
4MATT is a ServiceNow Elite Partner in Brazil, with over 180 certified specialists and expertise in ITAM, CMDB, ITOM, and Professional Services. A well-modeled asset and service base is the starting point for any SecOps initiative, and it is on this base that business risk prioritization begins to function.
Frequently asked questions about SecOps in ServiceNow
What is SecOps in ServiceNow?
SecOps in ServiceNow is the platform's suite of security operations applications, centered on Vulnerability Response and Security Incident Response. It connects scanners, SIEM, and EDR to the CMDB and ITSM workflows to prioritize vulnerabilities and coordinate incident response between security and IT.
What is the difference between Vulnerability Response and Security Incident Response?
Vulnerability Response acts preventively, prioritizing and coordinating the remediation of vulnerabilities. Security Incident Response acts reactively, managing incidents from initial analysis to recovery and post-incident review. Both share the CMDB as a source of asset and service context.
Are Vulnerability Response and Unified Security Exposure Management the same thing?
According to ServiceNow, Unified Security Exposure Management is the next evolution of Vulnerability Response, consolidating findings from scanners, cloud, containers, and code. Technical documentation and certifications continue to use the Vulnerability Response name, and licensing scope should be confirmed with ServiceNow.
How does ServiceNow support vulnerability management?
Vulnerability Response imports findings from scanners and the NVD, reconciles the data with the CMDB, calculates risk within a business context, and generates remediation tasks assigned to those who execute them. Vulnerability management then follows the same workflow and SLA as the rest of IT, instead of relying on spreadsheets and emails.
Does SecOps work without CMDB?
Applications can import data without a mature CMDB, but prioritization by business impact and assignment to the correct owner depend on reconciliation with the CMDB. Without it, findings lose service context, and the work queue becomes ordered solely by the severity of the scan.
Which ServiceNow certifications cover SecOps?
The credentials most directly linked to the two modules are the Certified Implementation Specialist – Vulnerability Response (CIS-VR) and the Certified Implementation Specialist – Security Incident Response (CIS-SIR). An overview of the certifications and the market value of each track are available in [reference to relevant documentation]. ServiceNow certifications in 2026.
Does ServiceNow SecOps replace SIEM, EDR, and scanners?
No. According to ServiceNow, SIR ingests alerts from SIEMs, EDRs, and endpoints, while VR imports data from scanners. The platform functions as a context layer, prioritizing and orchestrating work on top of these tools, not as a replacement for detection or scanning.