How to govern Security in ServiceNow

Steps

1. 1

   Inventory ServiceNow

   Connect ServiceNow and let Rencore build a continuous inventory of its resources, owners, and configuration, so governance starts from what exists rather than a stale export.

2. 2

   Detect with policies

   Turn on the pre-built policies that cover Security in ServiceNow to surface oversharing, sprawl, and misconfiguration on the first scan, before writing a single custom rule.

3. 3

   Review by owner and severity

   Use the ServiceNow reports to review findings by owner, category, and severity, and to share them with stakeholders who do not have a seat in the platform.

4. 4

   Remediate and automate

   Apply automations to fix findings at scale, route sensitive changes through approvals, and keep every action reversible and logged for the audit trail.

ServiceNow controls for Security

Grounded in the Rencore catalog. See the full ServiceNow catalog on the ServiceNow connector page.

• ServiceNow AI agent is live and callable

  Agents in an active state are callable, raising the likelihood that any weakness is exploited

  Severity: High

• ServiceNow AI skill is published and reachable

  Published Virtual Agent skills are live and exercised against real user input, raising the likelihood of exploitation

  Severity: Medium

• ServiceNow active user holds role assignments

  Active users holding one or more roles are privileged, reachable identities and a more likely compromise vector

  Severity: Medium

• ServiceNow AI agent is reachable through an active use case

  Active agents wired to a live use case are genuinely callable, raising the likelihood that any weakness is exercised

  Severity: Medium

• ServiceNow AI agents without approval

  Detects active AI agents that have not been through an approval workflow

  Severity: High

• ServiceNow AI agents without guardrails

  Detects active AI agents that have no guardrail configuration attached

  Severity: High

• ServiceNow AI models not in approved state

  Detects active AI model configurations that have not been explicitly approved

  Severity: High

• ServiceNow AI skills with unrestricted data access

  Detects published Virtual Agent skills that have no data access scope defined

  Severity: Medium

• Inactive ServiceNow users with assigned roles

  Detects deactivated users that still have role assignments

  Severity: High

• ServiceNow instance with too many role assignments

  Detects instances with more than 10 role assignments

  Severity: Medium

• ServiceNow AI guardrails with prompt injection protection disabled

  Detects active guardrail configurations where prompt injection protection is disabled

  Severity: High

• ServiceNow AI guardrails without PII protection enabled

  Detects active guardrail configurations where PII protection is disabled or in log-only mode

  Severity: High

• ServiceNow AI guardrails with all protections in log-only mode

  Detects active guardrails where all four protection categories are set to log-only rather than enabled

  Severity: Medium

• ServiceNow AI guardrails that are inactive

  Detects guardrail configurations that have been deactivated

  Severity: Medium

• ServiceNow AI agents with excessive tool assignments

  Detects active AI agents that have more than 10 tools assigned

  Severity: Medium

• ServiceNow AI agents active despite rejected approval

  Detects AI agents in active state whose approval was rejected

  Severity: High

• ServiceNow users by role

  Shows the top 10 most assigned roles and number of users per role

• ServiceNow AI Agents by approval status

  Shows the number of AI agents grouped by their approval status

• Locked Out ServiceNow Users

  Shows ServiceNow user accounts that are locked out

• Active ServiceNow AI Guardrails

  Shows guardrail configurations that are currently active