ServiceNow launches autonomous security suite for firms

ServiceNow has launched Autonomous Security, a suite of six security products that brings together security, identity, incident response and compliance functions.

The launch marks a push to expand its position in cybersecurity as companies contend with a rising number of machine identities, software agents and connected assets.

At the centre of the announcement is what ServiceNow describes as a prevention-first model for cyber defence. It argues that existing security operations are too fragmented, with large organisations often relying on dozens of separate tools across networks, cloud systems, applications and identity management.

The new package combines unified exposure management, continuous vulnerability detection, cyber-physical security, identity and access security, incident response, and cyber risk and compliance. The products are designed to work together through ServiceNow's existing platform rather than as separate point tools.

ServiceNow also introduced a set of AI Specialists that can carry out security tasks without manual intervention. These include a Vulnerability Resolution AI Specialist for triaging and remediating vulnerabilities, and a Tier 2 SOC AI Specialist to support incident response teams by building and executing response plans for more complex cases.

It said the growth of AI systems is changing the security workload for enterprise technology teams. It cited a rise in non-human identities, including service accounts, cloud identities and AI agents, as a source of additional risk that many companies do not yet closely govern.

Yevgeny Dibrov, Senior Vice President and General Manager of Cybersecurity and Risk at ServiceNow, said the shift in the threat environment was outpacing conventional teams and toolsets.

"As AI exposures compound exponentially, security teams operate on a human clock. Machine identities double every 18 months. Fragmented security tools can't match the curve AI is creating. Organisations need autonomous security and governance that matches the scale, velocity, and unpredictability of the threats coming: where all assets, identities, AI agents, critical infrastructure, cloud environments and code are protected, and can adapt as fast as the ecosystem moves to detect and remediate threats in real-time. Security becomes an accelerant, not the brake," Dibrov said.

Six areas

The unified exposure management element is intended to consolidate vulnerability findings from different sources into a single stream, then rank them using threat and remediation data. ServiceNow said this should help companies address backlogs by automating lower-risk fixes and narrowing the list of issues that require human review.

For software and infrastructure security, the continuous vulnerability detection set includes application security, dynamic application security testing and external attack surface management. These products are meant to give security teams a broader view across code, live applications, APIs and internet-facing infrastructure.

Cyber-physical security is another focus. Its tools are intended to provide visibility across operational technology, medical devices and internet-of-things systems without interrupting production environments, a long-standing concern in industrial settings where standard IT security tools can be difficult to deploy.

On identity, ServiceNow is seeking to address what it describes as widespread gaps in oversight of non-human access. The new functions include AI Agent Access Security and Non-Human Identity Remediation, which are intended to manage permissions, rotate keys and revoke access across IT, OT, IoT and medical networks.

Incident response and compliance round out the package. Its agentic incident response offering can automate parts of triage, enrichment, correlation and containment, while its compliance tools aim to turn evidence gathering and control monitoring into a continuous process rather than a periodic audit exercise.

Armis and Veza

The launch also highlights the role of Armis and Veza technology within ServiceNow's broader security approach. Armis adds visibility across connected assets, while Veza contributes identity permission mapping across human, machine and AI identities.

That combination reflects a wider trend in cybersecurity towards consolidation, as large software vendors seek to offer broader platforms spanning asset discovery, exposure management, identity governance and automated response. Many security buyers have been trying to reduce the number of products they use, both to control costs and simplify operations.

Baker Hughes was cited as a customer working with ServiceNow in industrial cybersecurity. Its comments focused on operational resilience and visibility across complex environments.

"For organizations operating complex industrial environments, effective cybersecurity starts with understanding risk and maintaining visibility across the enterprise. We've appreciated the collaboration and innovation from the ServiceNow (Armis) team as we continue working together to improve cyber resilience and support secure, reliable operations," Glaze said.