ServiceNow is expanding its cybersecurity portfolio around what it calls Autonomous Security, connecting six security areas through its AI Platform and letting AI agents handle detection, investigation, remediation and governance work. The company is linking exposure data, identities, assets, incidents and compliance activity through a common operational layer built on its existing footprint across IT and security operations.
Building security around a shared context
ServiceNow is constructing that model on data from its CMDB and Workflow Data Fabric, supplemented by capabilities from recent acquisitions Armis and Veza. Simon Mouyal, chief marketing officer at ServiceNow, described the combined foundation as a "synthetic world model of the enterprise across assets, identities, workflows, and business context." He said that "deep knowledge powers an agentic system of action that lets defense run autonomously."
Exposure management is central to the approach. The platform combines vulnerability findings from multiple sources with business context and exploitation intelligence, then uses its Vulnerability Resolution AI Specialist to triage issues, execute lower-risk patches and clear remediation backlogs. The platform also covers application security, dynamic application security testing and external attack surface management.
Mouyal said: "What makes this different is that we're not just helping customers detect threats faster. We're helping them prevent them by drastically reducing their exposure." ServiceNow calls the broader strategy Shift Zero: "governed, autonomous security operating at machine speed."
AI moves from analysis into action
The more significant shift is what ServiceNow now lets AI do after a risk or incident has been identified. Its AI Specialists can handle vulnerability prioritization, incident enrichment, threat correlation, approved low-risk patching, credential rotation, permission revocation and compliance validation. In incident response, the Tier 2 SOC AI Specialist can also develop and execute multi-stage response plans involving enrichment, correlation, containment and blocking.
Where autonomy stops depends on the risk and business impact of an action. "When decisions involve higher risk or broader business impact, humans remain in control," Mouyal said. "For example, the Tier 2 SOC AI Specialist can investigate, correlate, enrich, and contain incidents autonomously, but escalates high-risk decisions to human analysts for approval."
The goal is speed without sacrificing governance. "The outcome isn't to remove people from security. It's to eliminate manual work where AI can safely operate while ensuring governance, accountability, and human oversight where judgment matters most," Mouyal said. "That's how enterprises achieve machine-speed defense without sacrificing trust or control."
Identity and cyber-physical systems
Identity is folded into the model as companies add more service accounts, machine identities and AI agents. ServiceNow's AI Agent Access Security is designed to govern AI agent access across platforms and model providers. Non-Human Identity Remediation can take actions including key rotation, deprovisioning and permission revocation across IT, OT, IoT and medical environments.
The company is applying a similar model to cyber-physical systems and compliance. Its cyber-physical security capabilities cover agentless discovery, behavioral baselining and continuous compliance monitoring across OT and medical networks. On the governance side, AI agents can continuously evaluate access rights, segregation of duties and configuration states and surface violations as they happen.
What this means for Operations
For operations teams, ServiceNow is pushing deeper into the security-engine room - connecting security findings directly to remediation through its workflow and operational data. That means AI is now making more decisions about patching, incident containment, and access changes - areas that operation staff once had to manually coordinate across separate consoles. For operations leaders managing distributed environments, the platform claims to offload routine security tasks so teams can focus on critical incidents. The AI for Operations context here is direct: the model is designed to scale security operations without scaling headcount at the same rate, prioritizing exposures based on business context and automating investigation and remediation workflows.
For operations professionals, the shift means learning to work with AI agents that can execute on findings, not just alert on them. "The result is faster response, greater operational consistency, and the ability to scale security operations without scaling headcount at the same rate," Mouyal said.
Your membership also unlocks:
