×

Category: ServiceNow News

The ServiceNow Job Nobody Trained For Is The One Everybody Now Needs

Posted on by Dan Wells

In the last fortnight ServiceNow patched three vulnerabilities in its AI Platform that each scored a perfect 10.0, none of which required authentication to exploit. In the same window it expanded the AI Control Tower to govern AI across any system in the enterprise, whoever built it. I think those two events point at the same career opportunity, and at a profile the market is short of.

What happened

The advisory came out on 27 August. CVE-2026-18885 allowed arbitrary code execution. CVE-2026-18886 allowed privilege escalation through improper access control. CVE-2026-74820 was a SQL injection flaw against the underlying database. All three scored 10.0, none required authentication or user interaction, and all three were rated low complexity. A fourth, a sandbox escape, scored 8.7.

ServiceNow patched hosted instances directly and released hotfixes for self-hosted deployments across Xanadu, Yokohama, Zurich and Australia.

Separately, coverage in early September described the AI Control Tower being expanded to discover, observe, govern, secure and measure AI deployed across any system, not just ServiceNow’s own. I have not pinned the exact announcement date, so take the timing loosely. Alongside that, this year’s acquisitions tell a consistent story: Armis for asset visibility, Veza for identity governance, and Sweep, which ServiceNow confirmed as completed on 1 September, for a governance layer spanning ServiceNow, Salesforce and HubSpot.

Read those together

ServiceNow is becoming the place enterprises govern all their AI. Which makes the ServiceNow platform itself a very high-value target, and makes the person who secures it a very hard person to replace.

The role that is forming

There is a gap opening between two established professions and it does not yet have a settled job title.

Security teams own vulnerability management but frequently lack depth on the ServiceNow platform itself. Platform teams own the instance but sit inside IT service management, where security advisories are not the daily rhythm. Advisories land in the space between and both sides assume the other has it.

The people who can occupy that gap need three things at once: real hands-on platform knowledge, enough security literacy to read an advisory and work out what it touches in a specific configuration, and enough standing to force an out-of-cycle change when it matters. That is an unusual combination. My expectation is that scarcity of that kind gets priced eventually, though I am not going to pretend I can show you a published benchmark for a role that does not yet have a settled title.

It is also getting broader. When agents hold credentials and act autonomously inside your environment, they become identities that need governing like any other. The controls we built over two decades for human insider risk mostly have not been applied to them, because attention has been on the productivity gain. Somebody has to close that, and it will not be a pure security person or a pure platform person.

How to move towards it

1. Start with what you already have. If you are a platform person, you are closer to this than a security generalist is. Platform depth is the harder half to acquire. Security literacy on top of real ServiceNow experience is a shorter journey than the reverse.

2. Learn the machine identity side. The Zurich release documentation covers capability for securing machine-to-machine integrations, including the Vault and Machine Identity consoles. Check the release notes for what is in your version, then get hands-on. This is the concrete, learnable part of the agent governance problem, and it comes up far less often in conversations than the strategy layer does.

3. Read the advisories, properly. Not the headline. Go and understand which components each CVE touched and why. Doing that four times will teach you more about the platform’s attack surface than any course, and it costs nothing.

4. Build one governance story. How you handled access, auditability, or the decision not to automate something. Even small. Hiring managers are nervous about exactly this and hardly any candidate raises it unprompted.

5. Learn to talk about risk in business terms. The question that decides these interviews is some version of: an agent takes a wrong action against customer data at 2am on a Sunday, what happens? If you can answer that with a clear account of accountability, detection and rollback, you are ahead of nearly everyone.

A realistic word on timing

I am not going to tell you this is an easy pivot or that a certification unlocks it. It is a genuinely senior profile and it usually forms out of an architect or senior developer who has been pulled into governance work informally and then made it their identity.

What I will say, and I want to be clear this is my read rather than a measured finding, is that the demand side is visible in what ServiceNow is buying and building, while the supply side looks thin to me from where I sit. If that is right, it is a good window. If I am wrong about the supply side, the worst case is that you have gone deep on security and governance skills on a platform that is becoming the enterprise control plane for AI, which is not a bad place to be wrong.

If you are three or four years into ServiceNow and wondering where to go deep, this is the most defensible direction I can point you at.

Thinking about your next move? We speak to ServiceNow professionals across the UK, Europe and North America every day and we are happy to give you an honest read on your profile, whether or not you are actively looking. Start a conversation.

Sources: ServiceNow security advisory, 27 August 2026 · SecurityWeek, 31 August 2026 · ServiceNow newsroom

Three CVSS 10.0 Flaws, No Authentication Needed. Who In Your Organisation Is Applying That Patch?

Posted on by Dan Wells

On 27 August, ServiceNow published a security advisory covering four vulnerabilities in the AI Platform. Three of them scored a perfect 10.0. None of them need authentication, none need user interaction, and all three are rated low complexity to exploit. If you run ServiceNow self-hosted, the patch is your job, and the clock started two weeks ago.

What was disclosed

  • CVE-2026-18885, CVSS 10.0. Code injection allowing arbitrary code execution, with potential access to and modification of data.
  • CVE-2026-18886, CVSS 10.0. Improper access control allowing an attacker to create or modify arbitrary data and elevate privileges.
  • CVE-2026-74820, CVSS 10.0. SQL injection allowing arbitrary SQL statements against the underlying database, and access to instance data beyond what was intended.
  • CVE-2026-6876, CVSS 8.7. A sandbox escape, also exploitable without authentication.

ServiceNow patched its hosted instances directly. Hotfixes were released for self-hosted deployments across the Xanadu, Yokohama, Zurich and Australia release families. The company says it has no evidence of exploitation and that the issues came out of its own research and responsible disclosure programmes.

The split that matters

ServiceNow states it patched hosted instances. Self-hosted deployments need the hotfix applied by you. Either way, confirm remediation status against your own instance list rather than assuming it, particularly if you have multiple instances or any inherited from an acquisition.

The gap between disclosure and patching

Jason Brown, director of counter fraud operations at iCOUNTER, made the point sharply in SecurityWeek’s coverage. Self-hosted organisations now have to find, schedule and apply the patch themselves, and in many organisations that takes weeks rather than days. During those weeks an unauthenticated attacker with a working exploit has a real shot at systems sitting next to HR records, vendor onboarding and finance approvals. His advice was not to wait for the normal patch cycle and to confirm it is applied this week.

That advice was published on 31 August. It is nine days old.

Why I’m writing about this on a recruitment blog

Because “find, schedule and apply” is not a technical instruction. It is a description of a person, and in a lot of ServiceNow estates that person does not clearly exist.

ServiceNow platform security tends to fall between two teams. The security function owns vulnerability management but often has limited depth on the platform itself. The platform team owns the instance but sits inside IT service management, where security advisories are not the daily rhythm. So the advisory lands, both teams assume the other is handling it, and the patch cycle quietly absorbs something that needed to be treated as urgent.

The organisations that handle this well have one named person who owns ServiceNow platform security specifically. Not security in general. Not the platform in general. The overlap. And that is a genuinely awkward role to fill, because it needs someone who can read a ServiceNow advisory, understand what it touches in your configuration, and have the authority to force an out-of-cycle change.

Four questions worth asking this week

1. Are we hosted or self-hosted, and does everyone in the room agree? It sounds trivial. In organisations with multiple instances and a history of acquisitions, it frequently is not.

2. Who received the 27 August advisory, and what did they do with it? Not who should have received it. Who did.

3. Do we have a route to apply an emergency ServiceNow patch outside the normal change window? If the answer involves a CAB meeting three weeks out, you have found your problem.

4. Is ServiceNow platform security in anyone’s objectives? If it is not written down as someone’s responsibility, it is nobody’s.

The wider pattern

This is the third time this year the same shape has appeared. ServiceNow ships capability at pace, and the operational burden of running it safely lands on customers who have not resourced for it. The AI Platform is now the layer holding your workflow logic, your identity data and your audit trail. Three unauthenticated 10.0s in that layer is a serious thing, and the fact that it was found and fixed responsibly is genuinely reassuring. What is less reassuring is how many organisations will not have applied the hotfix by the end of this month.

If you are self-hosted and you cannot say with confidence that the patch is in, that is today’s job, not this quarter’s.

Need someone who owns the overlap between ServiceNow and security? It is one of the harder profiles in the market and we recruit for it regularly. We can tell you what it pays and how long it takes before you commit to a requisition. Talk to us.

Sources: ServiceNow security advisory, 27 August 2026 · SecurityWeek, 31 August 2026 · BankInfoSecurity, 1 September 2026

ServiceNow’s June 2026 Layoffs: What We’re Hearing

Posted on by Dan Wells
For most ServiceNow professionals, getting a role there was the goal. Not a goal. The goal. I’ve had that conversation hundreds of times with TCs, AEs, and developers across the ecosystem: “If anything comes up at ServiceNow, let me know.”

This past week, I’ve been speaking to a lot of those same people. Most of them are now on the outside.

Here’s what we’re hearing.

The scale

On the morning of 10 June 2026, thousands of ServiceNow employees joined what they thought were routine meetings and found HR on the call. Within minutes, roles were eliminated. By the time the call ended, laptops were locked.

Numbers internally range from 300 to 2,500. California WARN notices filed with the California EDD confirm significant cuts at both the Santa Clara HQ and San Diego office. Multiple directors told us that even VPs were given less than 24 hours’ notice and a script. Nobody below SVP level knew who was on the list or why.

Who got cut, and there’s no clean pattern

This is the part that keeps coming up in every conversation we’re having. Normally in a restructuring, you can find the logic: a product being wound down, a layer of management being removed. Here, nobody can.

The cuts hit sales, solution consulting, marketing, engineering, training, product, CEG, and ServiceNow University. In India, 70% of the DemoHub organisation went in a single Zoom call. In ANZ, entire SSE teams were eliminated. In LATAM, top-performing SC managers got the call.

People with 10 years at the company were let go alongside people who started 90 days ago. Directors were cut on the same calls as junior ICs. One person we spoke to was mid-treatment for a serious illness with strong performance reviews. Another was on maternity leave.

The consistent message from management: “This is not performance related.”

The consistent reality: managers couldn’t explain who was chosen or why. One director summed it up well: “There is no logic, and there is no communication coming from the top.”

The acquisitions

This is almost certainly part of it. ServiceNow acquired Moveworks for around $3 billion (600-plus employees), Armis for a reported figure that brought in over 1,300 people, and Veza on top of that. One well-placed partner contact put it plainly: “They’re offsetting the headcount from the acquisitions. The 2,500 number makes sense when you add it up.”

The Moveworks deal has taken a lot of the heat internally. ServiceNow paid an enormous amount for an AI service management tool that many people we speak to think overlaps heavily with existing platform capability, and that some argue Microsoft will simply replicate through Teams within a couple of years. The view we keep hearing: it was a bad call made at scale.

What people are most frustrated about is that the people paying the price for that decision are not the people who made it.

And for those wondering whether staff who came across from the acquired companies were affected: some appear to have survived, while long-serving ServiceNow employees did not.

What this does to ServiceNow as a place to work

This is the question that matters most to us, because it affects everyone in the ecosystem.

For a long time, working at ServiceNow carried real weight. The culture under founder Fred Luddy was well regarded. People stayed. Loyalty felt like it went both ways. That reputation was a big part of why the company could attract strong talent away from bigger names.

What we’re hearing now is that the culture has been shifting for a while, and this is the moment people are naming as confirmation of something they’d already sensed. There’s frustration about spending on celebrity endorsements and sports hospitality while the people doing the actual work get cut. There’s frustration about an influx of leadership from Salesforce, a company with a notoriously volatile culture, and the sense that some of that has been imported.

One person who ran a team at ServiceNow for nearly a decade said it simply: “I recognised this wasn’t the company I joined eight years ago.”

The employer brand has taken a hit. Whether that’s recoverable depends on what happens next and how quickly.

The general feel

Shocked. Angry at the manner of it, more than the fact of it. But not beaten.

What stings most in the conversations we’re having isn’t the job loss. It’s being locked out of a laptop before the call finished. It’s a manager who had no idea it was coming and had nothing to offer. It’s 14-hour days and years of work, then a Tuesday morning Zoom with HR on the invite.

One person, nearly ten years in and a consistent top performer, said: “People got rich off my dedication. Shame on me for letting them use me like that.”

That’s the tone of a lot of conversations right now.

For what it’s worth: ServiceNow experience carries genuine weight in the market. The calls we’re already having from partners and customers looking to bring people in confirm that. If you’ve been affected, you’re not starting from scratch.

If you’ve been impacted

Get in touch. We know who’s hiring in the ServiceNow space, we’ll give you a straight conversation, and we won’t waste your time.

And if your organisation is looking at a market with a lot of exceptional ServiceNow talent suddenly available, we can help you move quickly on the right people.

What ServiceNow’s New President and CLO Means for Your Career (and Your Business)

Posted on by Thmida Miah

What ServiceNow’s New President and CLO Means for Your Career (and Your Business)

ServiceNow just made a significant leadership appointment that tells us a lot about where the platform is heading, and if you’re a ServiceNow professional or a business relying on the platform, it’s worth paying attention to.

Hossein Nowbar has joined ServiceNow as President and Chief Legal Officer, coming directly from Microsoft, where he spent over 25 years navigating some of the biggest challenges in enterprise technology: AI regulation, data privacy, cross-border compliance, and geopolitical complexity. This isn’t a standard legal hire. It’s a signal.

Why This Matters for ServiceNow Professionals

When a company brings in someone with Nowbar’s profile (trusted advisor to senior Microsoft leadership, expert in AI governance, deep experience in global regulatory environments), it’s because they’re preparing for scale and complexity that requires that level of expertise.

AI integration is accelerating, not slowing down. ServiceNow has been aggressive about positioning itself as the “AI control tower for business reinvention.” Bringing in someone who’s been at the centre of Microsoft’s AI strategy and regulation efforts suggests ServiceNow is doubling down on AI-powered workflows, agentic capabilities, and automation at enterprise scale. For professionals, this means the demand for skills in AI integration, Virtual Agent, Predictive Intelligence, and workflow automation will only intensify.

Governance and compliance are becoming core differentiators. Nowbar’s background in ethics, compliance, risk, and policy isn’t incidental. As ServiceNow moves deeper into highly regulated industries (financial services, healthcare, government), businesses need assurance that the platform meets stringent compliance and security standards. For professionals with expertise in GRC (Governance, Risk, and Compliance), SecOps, or platform security, this trend creates a significant opportunity. Companies will need specialists who understand not just how to build on the platform, but how to build responsibly and compliantly.

Global expansion means more opportunities, not fewer. Nowbar’s experience navigating complex regulatory landscapes across different regions signals ServiceNow’s intention to continue growing internationally. For professionals, this could mean more demand for multi-region implementations, localisation expertise, and understanding of how ServiceNow deployments need to adapt to different compliance frameworks (GDPR in Europe, data sovereignty requirements in APAC, etc.).

The platform is maturing, and so are the roles. When a company hires someone to oversee legal, ethics, governance, compliance, risk, sustainability, and corporate affairs, they’re signalling that they’re playing a longer game. ServiceNow isn’t a scrappy startup anymore. It’s positioning itself as an enterprise infrastructure that will be around for decades. For professionals, this means career stability. The skills you’re building now aren’t just relevant for the next two years; they’re foundational for the next ten.

What This Means for Businesses Using ServiceNow

If you’re a business that’s invested in ServiceNow or considering a deeper commitment to the platform, this appointment should reinforce confidence in a few key areas.

ServiceNow is preparing for regulatory scrutiny. As AI becomes embedded in business operations, regulators are paying closer attention. The EU AI Act, evolving data privacy laws, and increasing scrutiny of automated decision-making mean that platforms like ServiceNow need to demonstrate compliance at every level. Nowbar’s hire suggests ServiceNow is getting ahead of this rather than reacting to it. For businesses, this reduces risk. You’re building on a platform that’s taking governance seriously.

Enterprise-grade trust is the priority. Bill McDermott’s comments in the announcement emphasised trust, governance, and accountability. This isn’t just rhetoric. ServiceNow is making structural decisions to ensure that as they scale globally and integrate more AI capabilities, they’re doing so in ways that enterprise clients can rely on. If you’re in a regulated industry or managing sensitive data, this should matter to you.

Innovation won’t slow down, but it will be responsible. Bringing in someone with Nowbar’s profile doesn’t mean ServiceNow is becoming cautious or conservative. It means they’re ensuring that innovation happens within a framework that protects customers, partners, and shareholders. For businesses, this is ideal. You get the cutting-edge capabilities (AI agents, workflow automation, integration across systems) without the Wild West approach that creates compliance headaches down the line.

Partnerships and integrations will deepen. Nowbar’s relationship with Microsoft and his experience fostering strategic partnerships suggests ServiceNow will continue strengthening its ecosystem. We’re already seeing tight integration between ServiceNow and major cloud providers, enterprise applications, and AI models. Expect that to continue and expand, which means better interoperability for businesses and more opportunities for professionals who understand multi-platform architectures.

The Bigger Picture

Leadership appointments like this aren’t just about filling a role. They’re strategic decisions that reveal where a company is heading and what challenges they’re preparing to navigate. ServiceNow is clearly positioning itself not just as a platform, but as critical enterprise infrastructure that needs to meet the highest standards of governance, compliance, and trust.

For professionals, this creates opportunity. The skills that will be most valuable in the next few years are the ones that align with where ServiceNow is going: AI integration, compliance and governance expertise, cross-platform architecture, and the ability to implement responsibly at scale.

For businesses, it’s reassurance. The platform you’re investing in is being built to last, led by people who understand the complexities of operating at enterprise scale in a heavily regulated, rapidly changing environment.

ServiceNow is betting on AI, compliance, and global scale. The professionals and businesses that understand these priorities will be the ones who benefit most from where the platform is headed.

Want to discuss how these shifts in the ServiceNow ecosystem impact your hiring strategy or career progression? Get in touch. We specialise exclusively in ServiceNow recruitment and stay close to these market dynamics so our clients and candidates can make informed decisions.

ServiceNow Eyes $7 Billion Acquisition of Cybersecurity Startup Armis

Posted on by Dan Wells

ServiceNow is reportedly in advanced discussions to acquire Armis, a San Francisco-based cybersecurity startup, in a deal valued at approximately $7 billion. This acquisition would mark one of ServiceNow’s most significant strategic moves as the workflow automation giant continues to expand its security capabilities and strengthen its position in the enterprise technology market.

About Armis

Founded in 2015 by Yevgeny Dibrov and Nadir Izrael, both Israel Institute of Technology graduates with backgrounds in the Israel Defence Forces software units, Armis has become a leader in cybersecurity asset management. The company’s flagship Centrix platform provides real-time visibility, risk assessment, and protection across an organisation’s entire digital attack surface.

Armis has demonstrated impressive growth, reaching $300 million in annual recurring revenue earlier this year, up from $200 million the previous year. The company was last valued at $6.1 billion following a $435 million funding round in November 2024. Its client roster includes major organisations such as Colgate-Palmolive, United Airlines, and NHS South Wales.

Strategic Implications

This acquisition aligns with ServiceNow’s aggressive expansion strategy in the security space. Earlier this month, ServiceNow acquired identity security startup Veza for an undisclosed sum, and in March, the company purchased AI firm Moveworks. The potential Armis deal represents ServiceNow’s commitment to building a comprehensive security portfolio that complements its workflow automation platform.

For ServiceNow professionals and organisations invested in the ecosystem, this acquisition signals continued innovation and expansion of security capabilities within the platform. As the deal nears completion, industry watchers expect the integration of Armis’s technology to enhance ServiceNow’s security offerings and create new opportunities for implementation and specialisation.

The deal is expected to be announced within days, pending final negotiations.

Let's get started

Talk to one of our consultants todays, if you're looking to register a vacancy and apply for a role.

Upload your CV

Submit CV

This field is for validation purposes and should be left unchanged.
Name(Required)
Consent(Required)
Max. file size: 2 GB.