The pace of threat analysis and remediation is constantly accelerating. To keep security teams ahead of the curve, ServiceNow’s Zurich release delivers a powerful suite of updates across Security Incident Response (SIR), Security Posture Control (SPC), and Vulnerability Response (VR). This release is engineered to tackle two core problems facing security teams: manual overhead and prioritisation fatigue. So, let’s have a look in detail at the most interesting updates.
Security Incident Response
Closing multiple incidents at once
ServiceNow Zurich release introduces a brand new feature that allows analysts to efficiently close multiple security incidents at once. In the Security Incident Response Workspace, using the new “Close” button on the Security Incident list view, analysts can review the incidents and apply Close codes and notes to several incidents in bulk. This significantly reduces manual effort, especially when managing incidents with a common root cause.
Ultimately, this enhancement streamlines case management, ensures consistent documentation, and frees up security teams to focus on proactive threat mitigation.
Core enhancements
The release also brings key core enhancements to the Security Incident Response workspace, designed to improve efficiency, visibility, and collaboration across teams. One of the desired requests was to link multiple ITSM records to a single SIR record. That is now possible, enabling richer context and stronger correlation between incidents, changes, and service requests.
Additionally, the new user presence feature provides real-time visibility into who is actively viewing or working on SIR or SIT records within the workspace, helping teams avoid duplicate efforts and improve collaboration. These core updates enhance situational awareness, streamline workflows, and strengthen coordination across security and IT operations, empowering analysts to respond faster and more effectively to security incidents.
Integration updates
Another new addition to SIR is the new CrowdStrike Falcon Next-Gen SIEM Integration, creating security incidents in ServiceNow from high-value CrowdStrike detections. It supports bidirectional data synchronisation, ensuring security teams always have complete context for faster, smarter action across both platforms.
The new release also presents Splunk enhancements, like adding a new role to manage profiles in SIEM integrations (sn_si ingestion_profile_admin), Splunk Sighting Search integration enhancements and other Splunk ES integration enhancements.
AI-assisted Shift Handover Reports
One of the Now Assist features is the Manage Shift Handover Records feature to significantly improve continuity and efficiency across security shifts. Analysts can now create, edit, and manage structured handover records directly tied to specific shift names, replacing previous manual, unstructured notes.
This enhancement standardises the transfer of incident history, open actions, and priorities, making past handovers fully traceable and preventing information loss or duplicate work. Furthermore, Now Assist for SIR provides intelligent automation by adding relevant incident details to these reports, ensuring comprehensive context transfer and elevating overall shift-to-shift collaboration.
Security Posture Control
Maintaining a strong security posture isn’t a one-time task; it’s a continuous journey. Organisations struggle with a constantly shifting attack surface, an influx of new vulnerabilities, and the pressure to comply with an array of regulatory standards. Traditional, fragmented security tools often lead to blind spots, manual overhead, and delayed remediation, ultimately increasing the risk of breaches.
ServiceNow’s Security Posture Control was designed to address these challenges by providing a unified platform for security teams. With Zurich, the capabilities have been expanded to offer even greater automation and actionable intelligence.
Editable policies and automated closures
In previous versions, managing security policies could be a rigid process. Zurich changes this by making policies always editable. This new flexibility allows security teams to adapt quickly to changes in security standards, business needs, or regulatory requirements. More importantly, this feature comes with robust version tracking, giving you a complete audit trail of every change made to a policy.
The true game-changer, however, is the automated closure of related test results. When a new policy version is published or a policy is deleted, the system can be configured to automatically close all associated security findings (test results).
This functionality streamlines policy management and ensures that your security findings are always aligned with the latest policies. It eliminates the manual, time-consuming task of cleaning up outdated findings, allowing your security team to focus on relevant, high-priority issues.
Enhanced asset search and CMDB filtering
One of the most notable improvements that came with the ServiceNow Zurich release for security analysts is definitely an enhanced asset search and CMDB filtering. The CMDB connection condition builder now includes powerful new criteria, such as:
- Host Name Regex: This allows for flexible and advanced searches using regular expressions to find assets based on naming patterns, such as “prod-web-[0-9]+” to locate all production web servers.
- First Seen Timestamp: You can now filter assets by the date they were first discovered, helping you quickly identify newly added assets that may not yet be properly secured or configured.
These new search capabilities are a massive productivity booster, enabling analysts to narrow down their focus to the most critical or recently discovered assets, accelerating investigations and vulnerability analysis.
Software Asset Management (SAM) integration
One of the most common security blind spots is unmanaged software. Organisations often have a clear view of their hardware assets but lack insight into the software running on them, particularly unauthorised or “shadow IT” applications. Zurich release directly addresses this by integrating with your Software Asset Management (SAM) data.
This new feature allows you to query the Security Posture Control module for discrepancies between software discovered by your vulnerability scanners and the software already managed and tracked in your SAM.
It brings a crucial layer of visibility, helping your team quickly identify and address unmanaged software that may pose a security risk. By correlating data from your security scans with your SAM inventory, you can uncover unauthorised applications, unpatched legacy software, and other unmanaged assets that could be a gateway for attackers.
Vulnerability Response
In the current era of relentless digital expansion, safeguarding critical assets has become more complex than ever. Threats evolve daily, demanding smarter, faster, and more integrated security approaches. The ServiceNow Zurich release delivers on this need with innovative features that empower teams to detect vulnerabilities earlier, manage risks more effectively, and respond with confidence.
Granular VITs for Microsoft TVM
With the new Zurich release, you can now configure Microsoft Threat & Vulnerability Management (TVM) recommendations as a Vulnerable Item (VIT) key. This creates individual VITs for each recommendation, which gives you better ownership and accountability for remediation activities. The granular approach also improves workload distribution across teams and enables faster, more effective vulnerability resolution by enhancing the tracking of specific recommendations.
CI Lookup Rules Enhancements
CI Lookup Rules Enhancements bring a refined level of precision to the configuration management process, ensuring that only relevant and up-to-date data is taken into account. By intelligently excluding Discovered Items that have not been scanned for more than 90 days when lookup rules are reapplied, the platform streamlines the way CIs are evaluated and maintained. This targeted approach reduces noise and unnecessary licensing costs, while significantly improving processing efficiency.
For organisations that do not follow Common Service Data Model (CSDM) standards, a new system property (sn_sec_cmn.ci_lifecycle_status_source) ensures that DIs and associated VITs are properly marked as Decommissioned and excluded from the CI Lookup. Additionally, the previously scheduled job for reconciling Unmatched Discovered Items is now deprecated. Users can instead “Reapply Lookup Rules” for selected or filtered items directly in the discovered items table, simplifying workflows and giving teams a more streamlined platform to manage CI-vulnerability mapping efficiently.
Vulnerability Response Integration with Wiz
The new Vulnerability Response integration with Wiz expands ServiceNow’s visibility into your cloud environment, importing host vulnerability findings for virtual machines and serverless assets. This powerful integration creates a unified platform for tracking and remediating vulnerabilities across your hybrid infrastructure, strengthening your cloud security posture and streamlining workflows by bringing critical cloud insights directly into ServiceNow.
Modify the severity for a CVE or TPE
A key improvement in the ServiceNow Zurich release is the introduction of a new feature within the VR module that allows security professionals to manually adjust the Severity level of Common Vulnerability Entries (CVEs) and Third-Party Entries (TPEs). This capability is critical because traditional prioritisation based solely on the static Common Vulnerability Scoring System (CVSS) fails to incorporate organisational context or real-world threat intelligence, often leading teams to waste resources on low-impact, yet technically challenging issues.
The manual modification feature is a post-ingestion action that enables users to override the Normalised Severity of a record to reflect its actual risk to the business. This functionality is a core enabler of Risk-Based Vulnerability Management (RBVM). The change is managed by a sophisticated asynchronous workflow; when the Severity is modified, a business rule sets a flag, triggering a scheduled job – “Run severity calculator after vuln entry promotion” – to recalculate the risk score of all related Vulnerable Items (VIs). This batched process ensures system responsiveness while accurately applying updated Risk Scores across the environment.
This offers significant business value by enabling precise risk prioritisation. By allowing users to manually adjust the normalised severity to reflect actual business risk, organisations can more effectively focus resources on the vulnerabilities that pose the greatest threat.
Tenable.cs integration for cloud and container vulnerabilities
The Zurich release features a native integration of Tenable.cs (Tenable Cloud Security) for managing vulnerabilities across complex, fragmented cloud-native and containerised environments. This improvement is a strategic leap forward, as it unifies vulnerability data from cloud and container assets with findings from traditional IT infrastructure, providing a single, holistic view within the ServiceNow platform.
The integration leverages the Service Graph Connector for Tenable to bring Tenable’s rich cloud vulnerability data directly into ServiceNow’s Configuration Management Database (CMDB) and VR modules. This unified data model is essential for the platform’s advanced features, as new AI-powered capabilities like Now Assist for Vulnerability Response require a complete and consolidated dataset to function effectively. Furthermore, the integration enables a “closed-loop remediation process,” which automates the entire lifecycle from detection and prioritisation to the assignment of remediation tasks and subsequent validation via re-scan, significantly improving operational efficiency.
Qualys integration for SecOps – detection splitting
To solve the challenge of ambiguous vulnerability ownership, ServiceNow introduced the vulnerability Detection Splitting capability for Qualys integration. Previously, if the same vulnerability (e.g., Log4j) appeared in multiple applications on a single server, all instances were consolidated into one Vulnerable Item (VI), hindering clean assignment to the correct application owners.
The Detection Splitting feature resolves this by leveraging Proof data (such as the specific file path or directory) from the Qualys scanner payload and incorporating it into the Vulnerable Item Key. This results in the creation of a unique Vulnerable Item for each specific vulnerability instance. This enhanced granularity allows Vulnerability Assignment Rules to route work automatically and precisely to the correct remediation team.
This shift from a consolidated to a granular model is expected to decrease the Mean Time to Remediate (MTTR) by eliminating the manual triage and internal friction associated with unclear ownership.
Activate the Qualys QVS Score integration
Last but not least, Zurich release significantly elevates prioritisation by allowing for the seamless import of Qualys’s proprietary risk scores, including the Qualys Vulnerability Score (QVS), Qualys Detection Score (QDS), and the holistic Qualys TruRisk Score.
The TruRisk score is a critical improvement, providing an overall risk metric (typically 0-1000) for an asset. It dynamically combines granular technical vulnerability scores (QDS) with the Asset Criticality Score (ACS) from the CMDB. This multi-dimensional scoring moves beyond the static nature of CVSS, allowing security teams to filter out low-risk “vulnerability noise” and hyper-focus remediation efforts on the issues that pose the greatest danger to the organisation’s most valuable assets.
By incorporating this high-fidelity, threat-informed intelligence, ServiceNow’s workflow engine can facilitate automation that can lead to an estimated 60% reduction in MTTR and an 85% reduction in the number of critical vulnerabilities teams must contend with.
Conclusion
The ServiceNow Zurich release delivers a unified, high-impact update across the entire security operations suite. It is engineered to boost efficiency and shift teams from reactive measures to proactive risk mitigation.
Core SIR features like bulk incident closure and AI-assisted Shift Handover reduce manual effort and eliminate context loss. Simultaneously, enhancements to Security Posture Control (SPC) and Vulnerability Response (VR) – especially the new ability to import the high-fidelity Qualys TruRisk Score – empower analysts to cut through the noise.
By providing clearer visibility and allowing for risk-based prioritisation, the Zurich release ensures security teams focus their limited time on the most critical threats to the business, achieving a tangible reduction in Mean Time to Remediate (MTTR).