Service accounts and AI agents can now be governed under the same least-privilege rules as human staff, with automated key rotation, deprovisioning and permission revocation. ServiceNow has announced Autonomous Security, six integrated solutions delivered through its AI Control Tower.
The release consolidates exposure management, vulnerability detection, cyber-physical security, identity and access security, incident response, and risk and compliance. ServiceNow says the average enterprise runs more than 70 security tools, fragmenting insight across endpoints, networks, cloud environments and identities.
AI Agent Access Security unifies access control for AI agents across any platform or model provider. Non-Human Identity Remediation moves from risk scoring to action, executing automated key rotation, deprovisioning and permission revocation across IT, OT, IoT and medical networks.
Yevgeny Dibrov, senior vice president and general manager for cybersecurity and risk at ServiceNow, put a figure on the growth curve. "Machine identities double every 18 months," Mr Dibrov said. "Fragmented security tools can't match the curve AI is creating."
The company frames the approach as Shift Zero, moving from fragmented, reactive security to prevention embedded at every layer. The stated goal is an enterprise able to answer, with proof, what every system is doing, why, and who is accountable.
Compliance evidence on demand
Agentic AI for Continuous Control Monitoring evaluates segregation of duties, access rights and configuration state across ServiceNow and external systems in real time. Compliance-ready reports are available on demand across SOC 2, ISO 27001 and PCI-DSS.
Cryptographic Asset Compliance covers migration from legacy cryptographic algorithms to quantum-resistant standards. It offers discovery, AI-powered risk profiling and guided migration workflows, integrated with ServiceNow Integrated Risk Management and GRC products.
ServiceNow argues that every new agent, identity and line of code multiplies exposure faster than a human team can respond. Non-human identities, service accounts, cloud identities and AI agents are described as almost entirely ungoverned.
Compliance is framed the same way. Evidence collection is manual, controls are monitored quarterly, and organisations are stuck playing catch-up before an audit.
The rest of the six
Agentic Exposure Management consolidates vulnerability findings into a single stream enriched by threat intelligence, with a Vulnerability Resolution AI Specialist that executes low-risk patches. Application Security extends threat modelling to AI-generated code and model dependencies, joined by dynamic application security testing and external attack surface management.
Agentic AI for Cyber Physical Security delivers agentless discovery across operational technology and medical networks, establishes behavioural baselines and models attack paths. Agentic Incident Response lets a Tier 2 SOC AI Specialist build and execute multi-phase response plans, escalating only high-risk decisions to human analysts.
The capabilities draw on Armis for asset visibility and Veza's Access Graph for effective permissions across human, machine and AI identities. Both companies are now inside ServiceNow.
Available now are Agentic Exposure Management, Autonomous Remediation Agents, Application Security, DAST and EASM. Agentic AI for Cyber Physical Security, AI Agent Access Security and Non-Human Identity Remediation are also available. The Tier 2 SOC AI Specialist, Vulnerability Resolution AI Specialist, Agentic AI for Continuous Control Monitoring and Cryptographic Asset Compliance are expected in December 2026.