| \n\nZurich\n\n | \n\n- **[Remediation task rule execution mode](https://www.servicenow.com/docs/access?context=sem-grouping-multiple-findings-remediation-tasks-processing&family=zurich&ft:locale=en-US)**\n\nYou can now choose how remediation task rules are evaluated during ingestion. The new Match First execution mode evaluates rules sequentially and applies only the first matching rule, assigning each finding to exactly one remediation task. The default Match All mode continues to evaluate all applicable rules.\n\n- **[Unified Microsoft Defender Integration for Security Exposure Management](https://www.servicenow.com/docs/access?context=mstvm-integration&family=zurich&ft:locale=en-US)**\n\nThe Microsoft Defender for Cloud and Microsoft Threat and Vulnerability Management \\(MS TVM\\) integrations are now consolidated into a single plugin, Microsoft Defender Integration for Security Exposure Management. the standalone Microsoft Defender for Cloud Integration application is deprecated. The unified plugin also introduces container image vulnerability ingestion from Microsoft Defender for Cloud, creating Container Vulnerable items on your instance. The deprecated application are supported through a guided migration path to transfer existing data to the unified plugin.\n\n- **[Optimized Tenable.io Compliance Results ingestion](https://www.servicenow.com/docs/access?context=tenable-io-integrations-list&family=zurich&ft:locale=en-US)**\n\nStarting with v 6.1.3, the Tenable.io Compliance Results Integration is replaced by the Tenable.io Fixed Compliance Results Integration and Tenable.io Open Compliance Results Integration. Compliance results are now imported based on their status, optimizing ingestion performance and scalability for environments with large volumes of compliance data while keeping remediation and compliance tracking aligned with the current state of findings.\n\n- **[Improved vulnerability assessment workflows](https://www.servicenow.com/docs/access?context=vr-ws-vuln-assessment&family=zurich&ft:locale=en-US)**\n - CI filtering for vulnerability assessments: You can now filter which configuration items are included in a vulnerability assessment using a condition builder.\n - Business Application population on AVITs: AVITs created from SBOM assessment results now include Business Application information, helping you understand application impact and prioritize remediation.\n - Priority roll‑down from vulnerability assessments: Updates to the priority of a vulnerability assessment now automatically roll down to associated VITs and AVITs, ensuring consistent prioritization based on the highest severity.\n- **[Enhanced Compensatory controls](https://www.servicenow.com/docs/access?context=requesting-approving-risk-reduction&family=zurich&ft:locale=en-US)**\n\nWhen new vulnerable items are ingested and associated with a remediation task that already has an approved compensating control, the reduced risk rating is now automatically inherited by those new vulnerable items.\n\n\n - **[Qualys Integration – API enhancements](https://www.servicenow.com/docs/access?context=qualys-rest-messages&family=zurich&ft:locale=en-US)**\n\nQualys Integration has been upgraded to support newer Qualys API versions across Host Detection, Host List, Knowledgebase, PC Controls, PC Policies, and PCRS integrations. The integrations now ingest additional data fields, including vulnerability detection source, authentication privilege status, active status for controls and policies, and cloud metadata, giving you better visibility into your vulnerability and compliance data.\n\n\n - **[Enhancements to the Wiz Vulnerability Response Integration](https://www.servicenow.com/docs/access?context=vr-wiz-exploring-host-cf&family=zurich&ft:locale=en-US)**\n - The Universally Unique Identifier \\(UUID\\) that identifies detections for the Wiz Host Vulnerability integration will be mapped to a detection key.\n\n**Note:** This enhancement is supported for new customers only.\n\nFor existing customers, the detection key for the Wiz Host Vulnerability integration is created using the combination of vulnerability, asset\\_id, and proof.\n\n - You can configure the **First** parameter for the Wiz Asset Integration to help you resolve 504 errors. You can reduce the page size if you're having memory issues or generating errors. The default value is 500.\n\n - **[Enhancements to the Vulnerability Response Integration with Wiz](https://www.servicenow.com/docs/access?context=vr-wiz-exploring-host-cf&family=zurich&ft:locale=en-US)**\n\nThe Missing Assets \\[sn\\_vul\\_wiz\\_missing\\_asset\\] is deprecated. After updating to version 1.1, you must backdate your existing primary Wiz integrations by three days and run them.\n\nThe backfill integrations are activated by default.\n\nAfter you backdate and run your primary integrations, the following backfill integrations are no longer required:\n\n - Host Vulnerability Backfill Integration\n - Test Results Backfill Integration\n - Host Test Results Backfill Integration\n - Issues Backfill Integration\nResource types filters are supported on the Host Vulnerability, Host Test Results, Test Results, and Issues tabs on the Wiz Configuration page.\n\nAdditional attributes imported from Wiz that are not stored in the Discovered items \\[sn\\_sec\\_cmn\\_src\\_ci\\] table are stamped with `Asset Attributes` in this table.\n\nTest results from the Host misconfiguration integration are classified as result type 'host\\_misconfiguration'.\n\nData for resources that have the validated\\_at\\_runtime flag set to 'yes' is imported and populated on detections.\n\nThe is\\_ignored column is deprecated on the Host Test Results and Test Results Integrations. This column was replaced by the is\\_result\\_ignored column.\n\nThe CMDB internet-facing field on the discovered item is mapped to Limited Internet Exposure on findings.\n\nColumn length for the descriptions in the Host Vulnerability import table has been increased.\n\n- **[Improved remediation target date handling](https://www.servicenow.com/docs/access?context=sem-recalculate-rt-date&family=zurich&ft:locale=en-US)**\n\nRemediation target \\(RT\\) dates now dynamically recalculate when a finding’s risk rating changes. Administrators can configure how recalculation occurs to verify RT dates remain accurate and align with the latest risk updates, helping maintain consistent and reliable SLA tracking.\n\n\n - **[Identify Wiz Resource Types for import](https://www.servicenow.com/docs/access?context=wiz-assets-resources-tab&family=zurich&ft:locale=en-US)**\n\nIdentify the Resource Types \\(assets\\) that are reported by Wiz that you want to import with the Wiz Integration Resource Type configuration page in your ServiceNow AI Platform instance.\n\nThe Resource Types that you select apply to all the primary Wiz vulnerability and compliance integrations except the Wiz Container Vulnerability Integration. See the [Wiz Vulnerability Response Integrations](https://www.servicenow.com/docs/access?context=vr-wiz-exploring-host-cf&family=zurich&ft:locale=en-US) for more information about the vulnerability and compliance integrations.\n\n- **[Wiz Backfill Integrations](https://www.servicenow.com/docs/access?context=wiz-backfill&family=zurich&ft:locale=en-US)**\n\nRetrieve and process data stored on the Wiz Missing Assets \\[sn\\_vul\\_wiz\\_missing\\_asset\\] table for assets that were not processed by the primary Host Vulnerability Integration with a specialized Wiz Backfill Integration.\n\nThe Host Vulnerability Backfill Integration is activated by default.\n\n**Note:** The Wiz Asset Integration and the Wiz Container Vulnerability Integration do not have backfill integrations. The Wiz Asset Integration can discover assets and create and update discovered item records on the Discovered item \\[sn\\_sec\\_cmn\\_src\\_ci\\] table. The Wiz Container Vulnerability Integration imports and processes discovered container image records.\n\n\n - **[Enhancements to Detection Key Configurations for Vulnerability Response](https://www.servicenow.com/docs/access?context=detection-key-configurations-for-vr&family=zurich&ft:locale=en-US)**\n\nIntroduced configurable detection keys that enable you to choose between Asset ID and Configuration Item, with validations, UI controls. Enhanced an existing schedule job to update existing detections.\n\n- **[Import host vulnerability data with the Vulnerability Response Integration with Wiz](https://www.servicenow.com/docs/access?context=vr-wiz-exploring-host-cf&family=zurich&ft:locale=en-US)**\n\nImport host vulnerability findings related to virtual machines and serverless assets in your cloud environment with the Wiz Host Vulnerability Integration. These findings are mapped to Host Vulnerable Items \\(VITs\\) within the Vulnerability Response application to support remediation workflows.\n\n- **[Modify the severity for a CVE or TPE](https://www.servicenow.com/docs/access?context=vmws-modify-reset-severity&family=zurich&ft:locale=en-US)**\n\nVulnerability managers and vulnerability analysts can now adjust the severity of common vulnerabilities and exposures \\(CVEs\\) and third-party entries \\(TPEs\\) from the list view in the vulnerability manager workspace. The risk level of the associated vulnerabilities will be recalculated during the scheduled jobs based on the modified severity. You can also reset the severity to its original source value if required.\n\n- **[Questionnaire Support in Exception Management via Smart Assessment](https://www.servicenow.com/docs/access?context=vr-exception-management-smart-assessment&family=zurich&ft:locale=en-US)**\n\nConfigure advanced questionnaires as part of the exception management process using Smart Assessment. This enhancement enables remediation owners to provide detailed context for exception requests and enables approvers to configure conditional questions to gather information for informed decision making.\n\n - Collaboration and streamlined approval: Facilitate collaboration between your vulnerability management and remediation teams by streamlining the approval process with clear and complete exception justifications.\n - Mandatory questionnaires: Block the submission of exception requests until mandatory questionnaires are completed. If a questionnaire is marked as mandatory, the test results and its associated remediation tasks remain in the 'Open' state until the questionnaire is completed and submitted.\n - If the questionnaire is incomplete, the state change approval record is saved as 'Draft'. Only after completing the questionnaire can the user submit the exception request, which will then move the test results or remediation tasks to the 'In Review' state.\n- **[Lookup rules enhancements](https://www.servicenow.com/docs/access?context=working-unmatched-cis&family=zurich&ft:locale=en-US)**\n\nWhen you reapply Lookup rules, Discovered items \\(DIs\\) that have been inactive for more than 90 days are ignored. These Discovered items \\(DIs\\) are also excluded from licensing considerations. Removing them from the lookup logic can improve performance and reduce processing time.\n\n - Background job enhancements: New fields have been added to help you view successfully evaluate records, the time taken for processing, the time remaining, and an estimated number of records.\n - Improved accuracy for non-CSDM Vulnerability Response users: A system property \\(sn\\_sec\\_cmn.ci\\_lifecycle\\_status\\_source\\) has been introduced to help users who do not follow Common Service Data Model \\(CSDM\\) standards. This property verifies that Discovered items \\(DIs\\) and associated VITs are properly marked as Decommissioned and are excluded from the CI Lookup. Additionally, the Retired Configuration Items PA indicator has been updated to accurately reflect CIs based on the decommissioning flags.\n - The scheduled job to create reconcile unmatched discovered items feature is deprecated. You can \"Reapply Look up Rules\" for selected or filtered items in the discovered items table view.\n- **[Tenable.cs integrations with the Vulnerability Response and Container Vulnerability Response application](https://www.servicenow.com/docs/access?context=tenable-cs-integrations-list&family=zurich&ft:locale=en-US)**\n\nThe Vulnerability Response Integration with Tenable application now supports data ingestion from Tenable.cs, enabling you to bring in cloud and container vulnerabilities directly into ServiceNow. This integration enhances your ability to prioritize and remediate vulnerabilities identified in Tenable cloud resources and container images. Key capabilities are:\n\n - Importing vulnerabilities discovered by Tenable.cs in cloud hosts and container images into ServiceNow automatically.\n - Enabling remediation workflows to triage, assign, and resolve the most critical vulnerabilities across cloud-native and containerized environments.\n - Using the Setup Assistant to easily configure credentials and integration parameters—get started with minimal manual setup.\n - Scheduling jobs to run periodically to import findings from Tenable.cs, create vulnerable items \\(for cloud hosts\\), create container vulnerable items and associate them with the relevant cloud resources and container image records.\n- **[Assess vulnerability exposure by publisher](https://www.servicenow.com/docs/access?context=vr-ws-exposure-publisher&family=zurich&ft:locale=en-US)**\n\nStarting with v5.0 of Vulnerability Exposure Assessment, a publisher-based assessment is introduced that enables you to assess the vulnerability impact by vendor. For example, Microsoft, and Red Hat. By focusing on recently disclosed vulnerabilities from critical vendors, you can prioritize remediation and proactively address threats, improving your overall security posture.\n\n- **[View risk score details of a vulnerable item in the Work notes section](https://www.servicenow.com/docs/access?context=vuln-calculators-rules&family=zurich&ft:locale=en-US)**\n\nStarting with v25.0.3 of Vulnerability Response, the system property **sn\\_sec\\_cmn.risk\\_score\\_changes\\_add\\_worknotes** is inactive by default. If you enable it, only then you can see all the changes related to the risk score of a vulnerable item in the Work notes section. Additionally, the work notes are updated only if there’s a change in the risk score.\n\n- **[Quick Start Tests for Vulnerability Response](https://www.servicenow.com/docs/access?context=available-quick-start-tests&family=zurich&ft:locale=en-US)**\n\nAfter upgrades and deployments of new applications or integrations, run quick start tests to verify that Vulnerability Response works as expected. If you customized Vulnerability Response, copy the quick start tests and configure them for your customizations.\n\n- **[Enhancements to exception rules handling](https://www.servicenow.com/docs/access?context=direct-deferral-of-vits-by-exception-rules-without-remediation-task-creation&family=zurich&ft:locale=en-US)**\n - Exception rules are reevaluated with nightly scheduled jobs.\n - Vulnerable items that no longer match exception rule conditions are unlinked from remediation tasks.\n - A deferred vulnerable item \\(VIT\\) is reopened if it doesn’t match any active exception rules.\n - Exception rules don’t create remediation tasks. VITs are deferred directly and aren’t associated with a remediation task.\n- **[Tenable's endpoint scanning integration](https://www.servicenow.com/docs/access?context=tenable-io-integrations-list&family=zurich&ft:locale=en-US)**\n\nSupport for Tenable's endpoint scanning integration to retrieve scan metadata. The integration fetches scan details using the last\\_schedule\\_id from existing asset data in Tenable.io.\n\n- **Reopened Count field on vulnerable items**\n\nAdded the Reopened Count field on vulnerable items to track the number of times their states change from 'Closed' to 'Open' or to 'Active'.\n\n- **[Out-of-the-box vendor advisories via Common Security Advisory Framework \\(CSAF\\) integration](https://www.servicenow.com/docs/access?context=vuln-solution-mgmt&family=zurich&ft:locale=en-US)**\n\nThe following vendor advisories are configured by default and are automatically activated when the Solution Management plugin is enabled: Redhat and Suse.\n\n\n |
| \n\nAustralia\n\n | \n\n- **[Schedule patch deployments through Change Request approval](https://www.servicenow.com/docs/access?context=vr-ws-patch-schedule-change-request&family=australia&ft:locale=en-US)**\n\nRoute patch deployments scheduled from remediation tasks through Change Request approval for Microsoft SCCM and HCL BigFix integrations. This lets you align patch deployment for critical vulnerabilities with your organization's change management approval process, and optionally deploy the patch automatically once the change is approved.\n\n- **[Modify risk rating in bulk](https://www.servicenow.com/docs/access?context=sem-modify-risk&family=australia&ft:locale=en-US)**\n\nVulnerability Admins can now modify risk rating directly on individual or bulk findings across host, application, or container vulnerable item, or on a remediation task without an approval workflow. Remediation Owners can also modify risk ratings, with changes routed through a change approval process. Associating a compensating control with the change is optional for all roles.\n\n\n - **[Automatic re-evaluation of remediation tasks on preferred solution change](https://www.servicenow.com/docs/access?context=vulnerability-groups&family=australia&ft:locale=en-US)**\n\nRemediation tasks can now automatically re-evaluate vulnerable items when their Preferred solution changes, so items are regrouped into the appropriate remediation task without manual intervention. This helps keep remediation tasks accurate and reduces manual cleanup.\n\n- **[Automatically create vulnerable items and application vulnerable items during assessment](https://www.servicenow.com/docs/access?context=vr-va-ws-cve-exposure-assessment-api&family=australia&ft:locale=en-US)**\n\nVulnerability assessments now support an Auto-create VITs/AVITs option that automatically creates vulnerable items and application vulnerable items for their affected configuration items and products, removing the need for a separate manual create step. The new CVE Exposure Assessment REST API lets external systems set this option when creating a vulnerability assessment record, or trigger a CVE exposure assessment independently.\n\n\n - **[Streamline Microsoft SCCM data ingestion with JDBC](https://www.servicenow.com/docs/access?context=mspatch-integration&family=australia&ft:locale=en-US)**\n\nConnect to Microsoft SCCM using JDBC \\(Java Database Connectivity\\) to query the SCCM database directly for collection, device, patch update, and deployment status data. Opening a firewall port for WMI \\(Windows Management Instrumentation\\) RPCs \\(remote procedure calls\\) is no longer required for these queries. A WMI connection remains required to deploy patches, because patch deployment continues to use the Microsoft SCCM API over WMI.\n\n\n - **[Enhancements to the Invicti Vulnerability Integration](https://www.servicenow.com/docs/access?context=invicti-vuln-integration&family=australia&ft:locale=en-US)**\n\nAdded the Invicti Platform Integration. Support for the Invicti Platform APIs introduces three new integration jobs that connect directly to the Invicti Platform cloud service:\n\n - Application Integration — Imports the list of applications being scanned in Invicti Platform into your ServiceNow AI Platform® instance as discovered applications.\n - Scan Integration — Pulls scan records from Invicti Platform, providing scan metadata to correlate with vulnerability findings.\n - Vulnerability Integration — Imports application vulnerability findings from Invicti Platform and creates or updates application vulnerable items in Vulnerability Response in your ServiceNow AI Platform®.\nEnhancements to Application life-cycle management: When an application is deleted or decommissioned in Invicti Platform, your ServiceNow AI Platform® automatically deactivates the corresponding discovered application and closes all associated application vulnerable items \\(AVITs\\), keeping your vulnerability inventory accurate without manual cleanup.\n\n\n - **[Activate the Wiz Asset Integration and identify resource types for import](https://www.servicenow.com/docs/access?context=wiz-assets-resources-tab&family=australia&ft:locale=en-US)**\n\nEnhancements to the Wiz integration include:\n\n - Starting with version 32.1 \\(USEM\\) and version 4.1 \\(non-USEM\\), the Asset integration is deactivated by default and is not a mandatory prerequisite for the other Wiz integration imports.\n\nIf you choose to activate it, the Asset integration will retrieve assets for all resource types if you don't specify the ones you want on the **Asset Integration Configuration** tab. To avoid importing vulnerability data you don't need, identify only the resources \\(assets\\) that you want to import with this integration.\n\n - Resource Type is no longer a mandatory field for configuring the Vulnerability Response Integration with Wiz. You can now save Wiz configurations for the integrations without specifying a Resource Type, simplifying setup for use cases where specifying a Resource Type isn't appropriate.\n- **[Enhancement to Vulnerability Response CI lookup rule configuration](https://www.servicenow.com/docs/access?context=create-ci-identifier-rules&family=australia&ft:locale=en-US)**\n\nThe Applies to field is added to Configuration \\(CI\\) lookup rule records. For third-party and ServiceNow® integrations that support both Application Vulnerability Response \\(AVR\\) and Vulnerability Response \\(VR\\) lookup rules, like the Vulnerability Response Integration with Wiz, for example, select one for a rule:\n\n - **Discovered Application** for Application Vulnerability Response lookup rules.\n - **Discovered Item** for Vulnerability Response lookup rules.\n**Note:** The field is left empty by default. If you leave this field empty for lookup rules that support both VR and AVR integrations, background jobs for both applications apply changes on the same set of lookup rules. This state might cause a conflict and set the reapply flag incorrectly. With this distinction set, after the respective background jobs for AVR and VR are completed, the system resets the flag only for the lookup rules for the background job that was run.\n\n\n - **[AWS Integration for Security Exposure Management](https://www.servicenow.com/docs/access?context=aws-integration-for-security-exposure-management-overview&family=australia&ft:locale=en-US)**\n\nThe AWS Integration for Security Exposure Management supports integrations with the following AWS services:\n\n - AWS Inspector is an automated vulnerability management service that continuously scans EC2 instances, ECR container images, and Lambda functions for software vulnerabilities \\(CVEs\\) and unintended network exposure. The Vulnerability Response integration with AWS Inspector imports host and container vulnerability findings from AWS Inspector.\n - AWS Security Hub is a security service that is used to centralize and update security checks across AWS accounts. It provides a unified view of security alerts and compliance status by integrating with various AWS services. The Vulnerability Response integration with AWS Security Hub imports host, container vulnerabilities, and misconfigurations from AWS Security Hub.\n\n - **[Unified Microsoft Defender Integration for Security Exposure Management](https://www.servicenow.com/docs/access?context=ms-defender-sem&family=australia&ft:locale=en-US)**\n\nThe Microsoft Defender for Cloud and Microsoft Defender Threat and Vulnerability Management \\(MS TVM\\) plugins are now consolidated into a single plugin: Microsoft Defender Integration for Security Exposure Management. This consolidation deprecates the standalone Microsoft Defender for Cloud plugin. The unified plugin also introduces container image vulnerability ingestion from Microsoft Defender for Cloud, creating Container Vulnerable Items on your instance. A guided migration path is available to transfer existing data from the deprecated applications to the unified plugin.\n\n- **[Optimized Tenable.io Compliance Results ingestion](https://www.servicenow.com/docs/access?context=tenableIntegration&family=australia&ft:locale=en-US)**\n\nStarting with v 6.1.3, the Tenable.io Compliance Results Integration is replaced by the Tenable.io Fixed Compliance Results Integration and Tenable.io Open Compliance Results Integration. Compliance results are now imported based on their status, optimizing ingestion performance and scalability for environments with large volumes of compliance data while keeping remediation and compliance tracking aligned with the current state of findings.\n\n- **[Qualys Integration – API enhancements](https://www.servicenow.com/docs/access?context=c_QualysVulnIntegration&family=australia&ft:locale=en-US)**\n\nThe Qualys Vulnerability Integration has been upgraded to support newer Qualys API versions across Host Detection, Host List, Knowledgebase, PC Controls, PC Policies, and PCRS integrations. The integrations now ingest additional data fields, including vulnerability detection source, authentication privilege status, active status for controls and policies, and cloud metadata, giving you better visibility into your vulnerability and compliance data. Use the new `posture_api_version` integration instance parameter to choose between the default v2.0 APIs or the newer v5.0 streaming APIs for the PCRS Policy Host and PCRS Test Results integrations.\n\n- **[Vulnerability Data Management with Central Vulnerability Database \\(CVDB\\)](https://www.servicenow.com/docs/access?context=cvd-overview&family=australia&ft:locale=en-US)**\n\nThe Central Vulnerability Database \\(CVDB\\) introduces a unified, source-agnostic vulnerability data layer that consolidates data from multiple sources into a single authoritative record, improving accuracy, consistency, and traceability. Key capabilities include:\n\n - Unified vulnerability record: Correlates vulnerability data from multiple sources, supports sources including National Vulnerability Database \\(NVD\\), scanner intelligence, European Union Vulnerability Database, Japanese Vulnerability Database, and vulnerability intelligence feeds.\n - Priority-based data reconciliation configuration:\n - Field-level priority: Ensures each attribute \\(e.g., CVSS, remediation, exploit status\\) can be configured from the most reliable provider.\n - Source-level priority: Applies a global ranking when field-level rules are not defined.\n - Hybrid model: Field-level rules take precedence, with source-level fallback; all source data is preserved for full traceability.\n - Source attribution and traceability: Maintains detailed source metadata, timestamps, and change history to ensure full auditability and transparency.\n - Data enrichment: Combines CVSS scores, exploit intelligence, and remediation guidance to provide a richer and more actionable vulnerability context.\n\n |