Securing ServiceNow: A CISO Field Guide

If a regulator asked you tomorrow to demonstrate control over the system holding your employee data, your HR cases, your security incidents, your vendor contracts, and your AI agents - could you? For most CISOs, that system is ServiceNow. And for most of them, the honest answer is no. Most CISOs still treat ServiceNow as an IT ticketing platform. But your instance now holds your most sensitive operational data, runs your most critical workflows, hosts AI agents acting on your behalf, and sits squarely in scope under NIS2, DORA, the Cyber Resilience Act, and the EU AI Act. Most security teams cannot evidence the controls a regulator will ask to see. This book is the briefing your team should have had three years ago. Written by a former Principal Security Advisor at ServiceNow, Securing ServiceNow: A CISO's Field Guide is built for decision-makers, not implementers. It reframes ServiceNow as the custom application platform it actually is - not the SaaS app it looks like - and shows you exactly where your real exposure lives. What you'll learn: - Why ServiceNow is an aPaaS, not a SaaS - and why your SaaS security mental model fails - The five attack surfaces inside your instance: identity, data, scripting, integrations, and APIs - How AI agents and Now Assist change your attack surface - and what CVE-2025-12420 ("BodySnatcher") taught us - What NIS2, DORA, CRA, and the EU AI Act actually require from your ServiceNow configuration - article by article - The shared responsibility gap between you and ServiceNow - and what stays in your lap - A 90-day program a 3-person team can execute, with named deliverables for every week - The regulator-ready evidence package you produce when an auditor asks Who this book is for: CISOs, Heads of Information Security, Security Architects, and Risk & Compliance leaders responsible for an enterprise ServiceNow deployment in financial services, energy, healthcare, telecom, public sector, or any industry under EU operational-resilience regulation. Fully updated for the Australia release (May 2026) and the Knowledge 2026 announcements - including the Veza acquisition close, Armis integration, and the launch of Autonomous Security & Risk. Currency commitment: updated with each ServiceNow major release. If you have a ServiceNow instance and a CISO mandate, this is the field guide you've been missing.