Security and risk · LessonBy Sneha I, ServiceNow Trainer, 8 yrs · Published · ServiceNow · all levels
Vulnerability Response
Ingest scanner findings, group them into remediation work and prioritise by real business risk.
Quick answer
Ingest scanner findings, group them into remediation work and prioritise by real business risk.
Key takeaways
- Vulnerable items are findings, remediation tasks are the work
- Risk score must include CI criticality, not just CVSS
- Exceptions need expiry dates and approvals
- Measure time to remediate, not backlog size
From finding to work
Scanner integrations create vulnerable items, one per vulnerability per CI. Because that is a huge volume, the platform groups them into remediation tasks by vulnerability, by CI group or by your own rules, so teams receive work rather than a spreadsheet.
Prioritisation
Risk score combines vulnerability severity with CI business criticality and exposure. A critical CVE on a decommissioned test box should not outrank a medium on an internet facing payment service, and the risk calculator is what makes that true.
Operating it
Volume is the enemy.
- Agree an SLA per risk band with infrastructure teams before go live
- Use exception requests with expiry dates instead of silent deferral
- Report on mean time to remediate, not on raw open counts
- Feed patching results back so closed items stop reappearing
Practice challenge
+0 XPStreak ×0
Question 1 of 2
What groups findings into assignable work?
Frequently asked questions
Which scanners integrate?
Tenable, Qualys, Rapid7 and others ship integrations, and the CI lookup rules matter more than the connector choice.
Why are items not matching CIs?
Scanner hostnames or IPs do not match CMDB identifiers. Fix CI lookup rules and CMDB data quality first.