Before
Security teams had to query the vulnerability platform periodically, inspect findings one by one, retrieve asset details, research vulnerability information externally, and write reports manually. They then had to switch to ServiceNow or Jira and create each incident or issue separately.
How it works
- On a recurring schedule, the workflow retrieves the configured security perimeters and searches for matching open vulnerability findings.
- It processes each finding, retrieves its asset record, enriches it with external vulnerability intelligence, and generates a structured risk and remediation report.
- It creates the corresponding incident or issue in the selected service management platform using the format required by that destination.
Workflow details
- Scheduled collection: The workflow runs on a recurring schedule, retrieves the available vulnerability perimeters, and searches for configured findings such as open vulnerabilities from the recent reporting period with a high risk score.
- Finding and asset processing: Each returned vulnerability is processed individually, while the workflow retrieves the complete asset record associated with the finding to provide operational context.
- Threat enrichment: The vulnerability is cross-referenced with external vulnerability intelligence to add threat and exploit information, including details associated with the finding's CVE.
- Report generation: An AI analysis stage combines the finding, asset context, and vulnerability intelligence into a structured report covering the summary, technical vulnerability description, exposure and risk, available countermeasures, implementation guidance, implementation risks, and traceability information.
- Ticket delivery: A second AI stage sends the report to the selected service management destination. Jira receives the report in an appropriate structured description format, while ServiceNow receives a record with a short description and an attached report, allowing security teams to begin their existing remediation process from a prepared ticket.
What changed
Each matching finding is automatically enriched, documented, and handed off as a structured ticket in the selected service management platform before an analyst reviews it. Destination-specific formatting and delivery are handled automatically, while the security team retains responsibility for reviewing and acting on the ticket.
Work removed
Querying findings manually, reviewing vulnerabilities individually, cross-referencing asset records, researching CVE information in an external database, writing remediation reports, switching between tools, and opening tickets one by one.
Expected outcome
The workflow can conservatively save an estimated 15–25 minutes per finding while providing consistent documentation and reducing reporting delays.
