I like how ServiceNow Security Operations offers us visibility across security incidents, affected configuration items, and remediation work in one place. The integration with the CMDB is particularly valuable, as it provides context and helps route tasks to the right teams, making ownership and progress easier to track. It significantly simplifies the management of security alerts and findings by connecting with ITSM, which really streamlines coordination compared to relying on emails and spreadsheets. I also appreciate the automation that identifies affected CIs, calculates business impact, and routes remediation tasks correctly, replacing slow, manual processes with efficiency. Overall, it provides a comprehensive overview and smooth handling of security processes, all in one integrated platform. Review collected by and hosted on G2.com.

The platform is really powerful, but the initial configuration can be demanding. Integrations, assignment rules, discovery channels, reconciliation, and remediation workflows usually need careful tuning before they work smoothly, and small changes may require admin support. Handling a high volume of security findings can be cumbersome, especially when reviewing technical details or making bulk updates. Reporting and historical trend analysis could also be more flexible without requiring additional configuration. Some integrations and customized workflows need regular administrator support, which can make small changes take longer than expected. The initial setup was not simple; it was a major undertaking, especially due to CMDB data, and required significant effort to clean up asset lists and tune automated assignment rules. Review collected by and hosted on G2.com.