Health Insurance Provider Automates Remediation Using ServiceNow's Security Incident Response

50%

security incidents converted to actionable cases

40%

reduction in resolution times

Existing remediation process was handled using ITSM incidents without much automation. The organisation’s tools at the time required optimisation and upgrades to achieve a higher and more successful response rate.

It was difficult identifying resolution groups due to lack of standardised data from scanners. This resulted in some incidents never being resolved.

Vulnerabilities were being routed to teams manually in recurring meetings. Known unfixable vulnerabilities were excluded via reporting consequently becoming unapproved exceptions.

ServiceNow Security Incident Response
SIR was used to consolidate security incidents from Splunk and KnowBe4, providing data privacy for security incidents across the organisation.

Threat Intelligence

Used observables (Indicators of Compromise) table and prioritisation to improve resolution decisions by identifying shared security incident attributes and parent-child relationships.

Remediation Routing

Vulnerability classification, assignment and grouping enabled automatic routing of vulnerable items to the correct remediation teams for faster resolution.

Exception Handling

Automatic exception rules enabled known approved exceptions to be deferred without manual intervention.