ServiceNow delivers Autonomous Security

- ServiceNow unveiled six security solutions with AI agents called AI Specialists to enable prevention-first, AI-native cyberdefence

- ServiceNow's risk and security business unites exposure management, identity, cyber-physical, incident response, and compliance as one governed motion 

ServiceNow, the AI control tower for business reinvention, has accelerated its Autonomous Security vision with six solutions that help deliver prevention-first, AI-native cyberdefence. The aspects of security covered include unified exposure management, continuous vulnerability detection, cyber-physical security, identity and access security, agentic incident response, as well as cyber risk and compliance. 

With new AI specialists that complete security workflows autonomously, including the Vulnerability Resolution AI Specialist, these capabilities enable enterprises to prevent, contain, and remediate risk at machine speed, before threats become breaches, ServiceNow said.

According to the company, security teams face an emerging challenge with agentic AI: every new agent, identity, and line of code multiplies exposure faster than any human team, or any patchwork of disconnected tools, can respond to. Closing that gap will require governed autonomy at the same machine speed, ServiceNow said. 

The average enterprise runs more than 70 security tools, fragmenting insights across the extended attack surface, including endpoints, networks, cloud environments, and identities. With the launch, ServiceNow said it has consolidated the complexity into a single system and become "one of the most complete and fastest-growing security companies built for the AI era". 

ServiceNow's autonomous security philosophy features assets, identities, and agents that are visible, contextualised, secured, governed and auditable in a single motion. This is achievable through Shift Zero: the move from fragmented, reactive security to prevention embedded at every layer, where every system, identity, and agent is governed and secured in real-time as threats move at AI speed. 

In Shift Zero, ServiceNow said, the goal is zero exposure at all times with an enterprise able to answer, with proof, what every system is doing, why, and who is accountable, while AI moves as fast as the business needs it to.

“As AI exposures compound exponentially, security teams operate on a human clock," said Yevgeny Dibrov, SVP and GM, cybersecurity and risk, ServiceNow. 

"Machine identities double every 18 months. Fragmented security tools can’t match the curve AI is creating. Organisations need autonomous security and governance that matches the scale, velocity, and unpredictability of the threats coming: where all assets, identities, AI agents, critical infrastructure, cloud environments and code are protected, and can adapt as fast as the ecosystem moves to detect and remediate threats in real-time. Security becomes an accelerant, not the brake.” 

Autonomous Security moves companies from reactive, fragmented security to prevention-first, autonomously governed security that operates faster than AI creates risk, ServiceNow said, with the six new solutions integrating into ServiceNow’s AI Control Tower.

Unified Exposure Management

Exposures pile up in silos, with security teams seeing vulnerabilities but not the assets that matter or which ones could be easily exploited. ServiceNow consolidates findings from any source and enriches data with business context and exploitation intelligence, enabling autonomous remediation at scale. 

- Agentic Exposure Management consolidates vulnerability findings from every source into a single stream enriched by Early Warning threat intelligence and Fix Intelligence prioritised remediation. 

- Vulnerability Resolution AI Specialist orchestrates triage and remediation at enterprise scale, executes low-risk patches, and turns exposure backlogs into closure pipelines.

Continuous Vulnerability Detection

The attack surface spans code, cloud, and infrastructure, but traditional tools only see one layer at a time. ServiceNow closes these gaps, enabling security teams to govern code, cloud, and infrastructure risks from a unified platform. Application Security extends threat modeling to AI-generated code and model dependencies with a new version that surfaces supply chain vulnerabilities before deployment. 

- Dynamic Application Security Testing (DAST) validates runtime vulnerabilities in live applications and APIs. 

- External Attack Surface Management (EASM) surfaces infrastructure exposure that attackers can exploit, showing a footprint the way threat actors see it.

Cyber-Physical Security

Operational technology (OT), medical devices, and Internet of Things (IoT) systems can be blind spots because legacy tools disrupt production and lack the behavioural understanding needed to catch risky activity. ServiceNow brings continuous visibility and compliance monitoring to operational environments without disruption. 

- Agentic AI for Cyber Physical Security delivers agentless discovery across OT and medical networks, establishes behavioural baselines, validates compliance continuously in real time, and models attack paths. Automated remediation workflows execute across brownfield environments without custom engineering.

Identity & Access Security

Non-human identities, service accounts, cloud identities, and AI agents are everywhere and almost entirely ungoverned. ServiceNow enables security teams to see, control, and govern every identity across the enterprise under consistent least-privilege principles. 

- AI Agent Access Security unifies access control for AI agents across any platform or model provider, closing the threat vector of ungoverned agents with escalated permissions. 

- Non-Human Identity Remediation moves beyond risk scoring into active action: automated key rotation, deprovisioning, and permission revocation at scale across IT, OT, IoT, and medical networks. It also enables AI agents and service accounts to operate under identical identity governance to human users.

Agentic Incident Response

Incident response teams can lose hours stitching together threat intelligence, asset ownership, and identity data when they should be stopping threats. ServiceNow automates triage and investigation, freeing analysts to focus on sophisticated threats. 

- Agentic Incident Response enables ServiceNow's Tier 2 SOC AI Specialist to autonomously build and execute multi-phase response plans for complex incidents, performing actions like enrichment, correlation, containment and blocking while escalating only high-risk decisions to human analysts. The specialist can go from analysis to containment in under 5 minutes, which is 48x faster than the industry average.

Cyber Risk and Compliance

Compliance remains a pre-audit scramble. Evidence collection is manual, controls are monitored quarterly, and organisations are stuck playing catch-up. ServiceNow transforms compliance from a seasonal event into a continuous operational signal. 

- Agentic AI for Continuous Control Monitoring transforms control evidence into a continuous operational signal. Automated agents evaluate segregation of duties, access rights, and configuration state across ServiceNow and external systems in real time, surfacing violations the moment they occur. 

Compliance-ready reports exist on demand across regulatory frameworks, including SOC 2, ISO 27001, PCI-DSS, and HIPAA. 

- Cryptographic Asset Compliance enables rapid migration from legacy cryptographic algorithms to quantum-resistant standards before the quantum threat window closes. ServiceNow delivers comprehensive discovery, AI-powered risk profiling, and guided migration workflows across on-premises and cloud environments, with full integration to ServiceNow Integrated Risk Management and Governance, Risk, and Compliance (IRM/GRC) products.

“For organisations operating complex industrial environments, effective cybersecurity starts with understanding risk and maintaining visibility across the enterprise,” said Brandon Glaze, Sr Director, Cybersecurity (OT/ICS) at Baker Hughes, a global energy technology company. 

“We've appreciated the collaboration and innovation from the ServiceNow (Armis) team as we continue working together to improve cyber resilience and support secure, reliable operations.”

The announcements are powered by ServiceNow’s track record in security and risk and the depth of Armis and Veza now inside ServiceNow. Armis provides continuous, non-invasive visibility across every connected asset, tracking billions of devices in real time. Veza's Access Graph maps effective permissions across human, machine, and AI identities. 

Together, they feed ServiceNow's AI Control Tower, Context Engine, and orchestration layer with the unified business and operational intelligence that enables autonomous remediation with governance and auditability.

Details

Agentic Exposure Management, Autonomous Remediation Agents, Application Security, Dynamic Application Security Testing (DAST), External Attack Surface Management (EASM), Agentic AI for Cyber Physical Security, AI Agent Access Security, and Non-Human Identity Remediation are available now. 

Tier 2 SOC AI Specialist, Vulnerability Resolution AI Specialist, Agentic AI for Continuous Control Monitoring, and Cryptography Asset Compliance are expected to be available in December 2026.