Designing Security Products at ServiceNow

Overview

ServiceNow is recognized as a "World’s Most Admired Company" by Fortune and is trusted by ~30,000 enterprise customers worldwide. The company transforms manual workflows into digital experiences that unlock productivity and enhance efficiency.

Security Products

ServiceNow Security Operations is a suite of tools aimed at strengthening an organization's security posture. It structures IT incident cyber data using intelligent workflows, automation, and prioritization to mitigate cyber threats efficiently. The suite includes:

• Threat Intelligence

• Security Incident Response

• Vulnerability Response

  
  

Vulnerability Response App (VR)

I worked on Vulnerability Response App of Security operations portfolio. Enabling enterprises to focus - On the most critical risks Respond faster and efficiently across security and IT teams  Provide real-time visibility.

My Role

I was an individual contributor for this project, but design approvals were led by my design manager. I worked with 2 product managers, 1 technical lead, 3 frontend developers, and 4 backend engineers. Duration- 7 Months

Current Problem

Product Adoption;

Bigger companies with much more data to secure do not use existing VR as it didn’t meet their complex information security needs. The team was looking to improve the overall user experience of VR.

Strategic Approach:

To redefine VR's app experience, architecture and relevant user flows, I adopted a top-down strategic approach by aligning product decisions with long-term business objectives. The focus was on improving product adoption within large organizations and strengthening its competitive position in the enterprise security market.

My design process

Reviewing prior research to supporting developers through launch, my design process for this project was not linear. I was more involved in the second diamond of the double diamond process, focusing on creating, testing, and refining designs. As I worked on multiple overlapping projects, I continuously incorporated new insights to ensure my work stayed adaptive and aligned with evolving project needs.

Steps involved

1. Reviewed prior user research

ServiceNow is a complex product. To understand it better, I took two mandatory platform training and one LinkedIn course related to the Vulnerability Response application. While going through the training and courses, I translated my learnings into Flows, Personas, and Information Architecture.

Vulnerability Response Cycle

Persona

Vulnerability response application is for chief information security officer, Vulnerability Manager, and IT Remediation Owner. Whatever we design, would need to be universal in the IT and security ecosystem as switching roles is quite possible . To cover as much of the demographic as possible, we looked at three extreme personas

Persona- CISO, Vulnerability Manager, IT Remediation Owner

2. Analyse competitors

For instance, InsightVM and Qualys VMDR excel in providing clear risk indicators and streamlined workflows, while allowing personalized dashboards and reports. Wiz and Tenable focus on cloud-first approaches and customizable views, offering users tailored insights and efficient task management, while Cisco emphasizes data-driven design and adaptable workflows to enhance remediation efforts.

3. Identify areas

Understanding the problem

After defining the personas, I reviewed existing zoom calls with users and had multiple discussions with SMEs and using bottom up approach, I identified themes and presented to the team

What users are saying?

• "If everything is critical, nothing is critical."

• "I can't see what is important to me, too much noise on the existing dashboard."

• "There is no point in giving them more when they can't fix what's assigned to them."

• "If you throw a million vulns over the wall, nothing will be done."

• "We are not trying to boil the ocean."

• "We encourage working at the group level, but they still work at the VIT level."

• "We are abandoning the use of Vuln groups altogether."

01 Tackling Noise

Current approach for reducing noise and effective grouping of Vulnerabilities 

Filters? But what about existing platform filters?
Problem: Existing filters on do not cater to personalised security needs

Strategy Shift: Personalised Approach for Noise Reduction and Bundling

"Watch Topics" for Personalization

A personalized filtering mechanism, "Watch Topics," enables vulnerability managers to:

• Reduce noise by focusing only on vulnerabilities relevant to their needs.

• Bundle remediation tasks effectively based on specific risk criteria.

How It Works

Step 1: Define Watch Topics

• Vulnerability managers can create watch topics to help them quickly identify risky vulnerabilities, such as a high risk score, specific critical CVE, or overdue tasks.

• Filters allow for precise tracking of relevant security threats.

Step 2: Automated Monitoring & Alerts

• The system continuously monitors vulnerabilities within selected Watch Topics.

• Users receive notifications or updates when critical issues arise.

Step 3: Strategic Remediation & Assignment

• Watch Topics help security teams group related vulnerabilities.

• Remediation tasks can be created and assigned efficiently.

• Stakeholders gain a clear view of priorities through structured dashboards.

Conceptualisation: Watch Topics

Key questions I tackled:

1. Where should Watch Topics be placed for ease of access?

2. Should progress tracking be integrated into Watch Topics?

3. What permissions should govern Watch Topics visibility?

4. Can users add items to existing remediation efforts?

5. What is the best way to visualize Watch Topics within the workbench?

   
   

Iteration and stakeholder review

I led design crits with product managers and developers to review ideas and align the team on VR’s new direction

These weekly design reviews and crit sessions proved invaluable to make my designs well-rounded from all perspectives (desirability, feasibility, and business viability) while also getting a go-ahead from everyone in the team.

Feedback for my designs: how to reduce noise and making remediation efforts easy 

This is a very early stage wireframe. Some of the feedback from the team: 

1. There can be better placement of watch topics, it would be difficult for the user to create and edit.

2. Showing both dashboard and watch topic in the same list will take too much time to populate.

3. Fields on the form

Final solution

Watch topics- ” Personalised Filters”

Developer handoff and support

I worked with the developers to address feasibility issues and edge cases I missed during the iterative phase.

I oversaw the design and development of the new VR workflows, and an all-new visualisation approach. I also designed features for patch orchestration

While everyone signed off on the high-fi mocks for the designs, there were feasibility issues and edge cases that came up once the developers began to build them. Along with addressing these, I also answered questions and talked through my designs regularly.

For instance, missing filter interactions

Closing thoughts

From coordinating with multiple stakeholders to defending my designs and taking accountability for my mistakes, my this stint as a user experience designer taught me many critical skills required to excel in the industry as a designer.

I had the unique opportunity to work on the redesign of a product from scratch. I had the chance to see how products are built from the ground up, the constraints I have to work with, and how I can positively influence change.

These are anonymised peer reviews I received one year into the job:

“Ashita is an exceptionally talented designer who is thorough with her design process and delivers quality work on core products like VR watch topic flow…”

“Ashita is autonomous in her work as she learns from others very quickly and takes complete ownership of the work…”

“…She has also showcased ability to dive deep in on some complex projects like VR independently…”

Learnings-

1. I learned how to advocate for my design in large organisational structures.

2. Working on projects with existing research and constraints also made me adept at making the most of the resources I have available.

3. I became great at explaining ideas at the correct level of complexity and abstraction and improved my overall communication skills.

4. Collaborating closely with the PMs and Product folks at ServiceNow allowed us to take a research data-driven approach to some design decisions.

5. I also learnt a lot about how a design system works in a large organisation such as ServiceNow, using Figma components.

Team leadership @ ServiceNow

1. Nurtured a user-centered design culture by engaging peers in the design process and collaborating to drive UX outcomes.

2. Improved processes by building sprint dashboards and capacity planning tools. Coordinated with the team as well as DesignOps members to design the right processes to maximize the output of the team.

Product adoption

Public

Product Documentation | ServiceNow
Now Community Developer Site Knowledge Base Product Information ServiceNow.com Training Customer Success Center…docs.servicenow.com