ServiceNow reintroduces itself as an AI 'security company'
ServiceNow pulls ahead of other agent orchestrators with expanded AI security features, experts say, as enterprises proceed cautiously toward agent autonomy.
ServiceNow is seeking to bring enterprise CISOs onto its platform by expanding AI security monitoring and alerting features, following two recent acquisitions.
An access graph from Veza and asset intelligence from Armis were among a series of new features in the Australia release of the ServiceNow AI platform this week. IP from both companies, whose acquisition deals ServiceNow closed in March and April, respectively, surfaced in updates to the AI Control Tower agent governance tool and ServiceNow's Autonomous Risk and Security portfolio.
ServiceNow officials demonstrated the new integrations during a press briefing on April 28, showing AI Control Tower workflows in which Veza's access graph alerted an administrator to a prompt injection and displayed the blast radius of affected systems. The new workflow, which can run autonomously or with human approval, disabled the agent and its tools through a new ServiceNow AI gateway and generated a security incident and audit documentation. These features will enter preview this month and ship in August.
John Aisien
Another press demo previewed how Armis IP will be integrated into AI Control Tower to automatically detect AI assets using agentless network monitoring and add them, through its cyber asset graph, to the ServiceNow Context Engine. The Context Engine will also correlate the asset's access permissions in Veza with activities on the corporate network, using the AI observability tools ServiceNow acquired with Traceloop. This expanded Context Engine will encompass security data from third-party tools, including Microsoft's Agent 365 and Palo Alto Networks.
These updates position ServiceNow to target a new audience, according to John Aisien, senior vice president and general manager of central product management, security and risk at ServiceNow, during the press demonstration.
"This is a representative example of what makes ServiceNow a security company uniquely built for the agentic era based on … three axes: … cyber assets, access and decision context," Aisien said. "We can govern every agent, every identity and permission, every asset, every in-flight or historical process and policy. We can correlate business risk. We can stop exposures in real time, and we can drive remediation before damage is done."
ServiceNow expands from CMDB roots
The AI control tower battle is ServiceNow's to lose.
Charles BetzAnalyst, Forrester Research
Adding security data into the knowledge graph that provides context to AI agents is a natural extension of ServiceNow's existing configuration management database (CMDB), said Charles Betz, an analyst at Forrester Research.
It's an area with many competitors, including cloud hyperscalers and other large vendors such as SAP and Salesforce. But "the AI control tower battle is ServiceNow's to lose," Betz said. "I can't think of anybody else who's better positioned than them.
"There's a lot of posturing, a lot of posing. But I just don't see an SAP or a Salesforce having any relevance there. They've not done the homework of understanding the digital infrastructure. Now they're going to jump in and be AI control towers -- maybe an AI walled garden to build an agent or two in. But if you're talking about truly agentic workloads running across a large-scale digital estate, ServiceNow has more than 20 years of struggling and fighting with the CMDB problem."
Another analyst said the proactive alerting features in ServiceNow's AI Control Tower stand out among enterprise agent orchestration platforms.
"I haven't seen anything near the kind of alerts that we saw in the demo from anybody else," said Rebecca Wettemann, CEO at independent research firm Valoir. "ServiceNow already had Impact, which gave a telemetry-infused view of how customers were actually using the platform, and is a great foundation for AI Control Tower and the monitoring capabilities that they built around it."
ServiceNow's John Aisien demonstrated Armis and Veza integrations with AI Control Tower during a press briefing April 28.
Taking the pulse of enterprise agent adoption
ServiceNow touted customer wins for its AI Control Tower and Risk and Security Management products, including HDFC Bank, Rossmann, the National Hockey League, and Fortinet. ServiceNow reported strong Q1 2026 earnings on April 22, with revenue of $3.77 billion, up 22% from last year. It also raised 2026 subscription revenue guidance to $15.74–$15.78 billion. ServiceNow wasn't alone in riding a recent wave of AI adoption: AWS, Microsoft and Google also reported gaudy revenue growth in recent earnings calls, attributed to AI services.
But while enterprises are buying in, production AI autonomy remains an aspiration for most so far, Betz said.
Charles Betz
"People want deterministic and auditable workflows, and those are hard enough to govern," he said. "We do see well-choreographed and well-specified multi-agent architectures that are not that complicated. You simply say, 'I've got an agent that actually creates the thing, and I have another distinct agent that QAs the thing.' And right there, you have a multi-agent architecture."
One enterprise consultant said he's seen similarly limited AI agent adoption among clients so far.
"It's scenario-based usually, and some of them even have success," said Thomas Wieberneit, co-founder, CEO and principal at AheadCRM, a consulting firm specializing in customer resource management, customer experience and AI. "Most of them start with service scenarios, where they want to go beyond [AI assistants] so that the customer actually gets something that helps them instead of a bunch of links that they can sift through."
Rolls-Royce eyes agentic expansion
That's the scenario that has played out at Rolls-Royce, which has ServiceNow's Now Assist agent in production internally as part of its help desk, according to Phil Priest, head of global business services at the industrial manufacturer, during an appearance at the April 28 press briefing. The company has seen a return on that investment in the form of a 54% deflection rate for help desk requests, which has saved human help desk agents 5,000 hours since August 2025, Priest said.
Rolls-Royce plans to expand the Now Assist agents to the rest of the 45,000-employee company, beginning with its HR department, and use the EmployeeWorks portal ServiceNow introduced in February.
However, AI expansion faces further challenges at the company. For example, as other enterprise Now Assist adopters attested during last year's ServiceNow Knowledge conference, getting AI to work autonomously in that context requires careful attention to underlying knowledge base data, Priest said.
"We've realized that as we expand AI assistants beyond our IT to other functions, we really have to almost rewrite our knowledge articles to make them AI-ready," Priest said.
The company is working on an agentic automation system for its accounts payable (AP) area, but must ensure the system maintains strict governance, including the separation of duties required by regulations.
"We have to think very carefully about building these agents in a way that assures that fraud can't happen, for example," Priest said. "And there are numerous laws in the AP space affecting payments, anti-money laundering, bribery and corruption -- we have to use the right oversight of third parties with the right checks when we use AI to do all these tasks."
Beth Pariseau, senior news writer for Informa TechTarget, is an award-winning veteran of IT journalism. Have a tip? Email her or connect on LinkedIn.
Dig Deeper on Systems automation and orchestration
John Aisien
Charles Betz
