Vulnerability Response
Quick answer
Ingest scanner findings, group them into remediation work and prioritise by real business risk.
Key takeaways
- Vulnerable items are findings, remediation tasks are the work
- Risk score must include CI criticality, not just CVSS
- Exceptions need expiry dates and approvals
- Measure time to remediate, not backlog size
From finding to work
Scanner integrations create vulnerable items, one per vulnerability per CI. Because that is a huge volume, the platform groups them into remediation tasks by vulnerability, by CI group or by your own rules, so teams receive work rather than a spreadsheet.
Prioritisation
Risk score combines vulnerability severity with CI business criticality and exposure. A critical CVE on a decommissioned test box should not outrank a medium on an internet facing payment service, and the risk calculator is what makes that true.
Operating it
Volume is the enemy.
- Agree an SLA per risk band with infrastructure teams before go live
- Use exception requests with expiry dates instead of silent deferral
- Report on mean time to remediate, not on raw open counts
- Feed patching results back so closed items stop reappearing
Want to learn this properly?
Our live, instructor-led ServiceNow Training covers this hands-on, with real projects and a certification path.
Check your understanding
What groups findings into assignable work?
- A. Vulnerable items
- B. Remediation tasks
- C. Change requests
- D. Problems
Show answer
B. Remediation tasks
Remediation tasks batch related vulnerable items for a team.
What should influence priority besides CVSS?
- A. Scanner vendor
- B. CI business criticality and exposure
- C. Discovery schedule
- D. Ticket age
Show answer
B. CI business criticality and exposure
Business context turns raw severity into real risk.