{"id":568347,"date":"2025-03-21T17:19:43","date_gmt":"2025-03-21T16:19:43","guid":{"rendered":"https:\/\/www.devoteam.com\/expert-view\/servicenow-yokohama-release-supercharging-security-operations-with-genai\/"},"modified":"2025-06-12T14:29:33","modified_gmt":"2025-06-12T12:29:33","slug":"servicenow-yokohama-release-supercharging-security-operations-with-genai","status":"publish","type":"expert-view","link":"https:\/\/devoteam.info\/en-nl\/expert-view\/servicenow-yokohama-release-supercharging-security-operations-with-genai\/","title":{"rendered":"ServiceNow Yokohama release: Supercharging Security Operations with GenAI"},"content":{"rendered":"\n

The ServiceNow Yokohama<\/a> release is here with exciting new features, and as you might expect, it places a strong emphasis on GenAI\u2014bringing automation to streamline your security workflows and reduce unnecessary overhead. In addition, we\u2019ll highlight some practical enhancements from a platform perspective. Let\u2019s dive in!<\/p>\n\n\n\n

Vulnerability Response<\/h2>\n\n\n\n

The Vulnerability Response application (v25.0.x) introduces a long-awaited feature that allows vulnerability managers and analysts to create Remediation Tasks directly from the list view<\/strong> in the Vulnerability Manager Workspace or the IT Remediation Workspace. <\/p>\n\n\n\n

This manual task creation capability provides granular control over remediation management, enabling you to dynamically group vulnerable items into remediation tasks in real-time. This applies to infrastructure, application, and container vulnerabilities, as well as configuration test results. A much-appreciated addition\u2014thank you, ServiceNow!<\/p>\n\n\n\n

\"\"
Source: ServiceNow<\/figcaption><\/figure>\n\n\n\n

Additionally, the Vulnerability Response integration with the National Vulnerability Database (NVD)<\/strong> now supports entries for Common Vulnerability Scoring System (CVSS) v4.0<\/strong> values. This latest scoring system reflects a modern approach to vulnerability management, helping you stay ahead of evolving adversary tactics. You can leverage these values within your own custom risk score calculator to prioritise the most critical vulnerabilities effectively.<\/p>\n\n\n\n

Security Posture Control – Mitigation Control Detection<\/h3>\n\n\n\n

To help teams better prioritise security actions, ServiceNow enables the detection of assets with mitigation controls<\/strong> in place. This reduces the final risk score for such assets, effectively freeing up remediation owners<\/strong> to focus on more pressing threats.<\/p>\n\n\n\n

ServiceNow has implemented two initial use cases:<\/p>\n\n\n\n

    \n
  1. Web application firewalls (WAF) protecting certain configuration items (CIs)<\/li>\n\n\n\n
  2. Endpoint Detection and Response (EDR) agents configured to block exploits<\/li>\n<\/ol>\n\n\n\n

    More mitigation control mechanisms will be introduced in future releases. The diagram below illustrates how mitigation controls connect to your ServiceNow instance via API. Security Posture Control then leverages IT Operations Management (ITOM) to map MITRE ATT&CK mitigation techniques to vulnerabilities within your environment.<\/p>\n\n\n\n

    \"\"
    Source: ServiceNow<\/figcaption><\/figure>\n\n\n\n

    Scalability: Handling 300M Vulnerable Items in Workspaces<\/h4>\n\n\n\n

    ServiceNow Vulnerability Response now supports 300 million Vulnerable Items<\/strong> (VIT), ensuring a high-performance experience in Workspaces. This enhancement improves scalability, allowing security teams to manage large volumes of vulnerability data efficiently and with confidence.<\/p>\n\n\n\n

    Security Incident Response<\/h2>\n\n\n\n

    Now Assist for SIR<\/h3>\n\n\n\n

    There are several Out Of The Box functionalities for the Now Assist in SIR Workspace. Using AI, the investigation phase of Security Incidents can be quicker and easier as it reduces the manual labour done by the analysts. On the Security Incident form, analysts can use the new tab Recommended Actions<\/strong> which can help them with the next steps of the resolution by generating actions from existing Security Incidents and Knowledge articles. <\/p>\n\n\n\n

    Now Assist itself can be used for anything you predefine. Some of the already implemented functionalities are Correlation Insight<\/strong> and the generation of Post Incident Analysis<\/strong> or Resolution Notes<\/strong>.<\/p>\n\n\n\n

    \"\"
    Source: ServiceNow<\/figcaption><\/figure>\n\n\n\n

    Relationship Graph<\/h3>\n\n\n\n

    Were you missing some graphical overview of the entities connected to the incident? Not anymore! It was just added with the ServiceNow Yokohama release. The brand new related list was added for the Security Incident Workspace. You can see all the items and records related to the current incident. <\/p>\n\n\n\n

    The graph can be improved by adding several category nodes, like: <\/p>\n\n\n\n