ServiceNow is adding AI agents to Integrated Risk Management (IRM) that set up control checks, explain failures, open tickets, and fix some problems automatically across ServiceNow and more than 100 other systems. Buyers want to use agents for this kind of internal work first. Customer value will depend on how many systems customers connect and whether auditors accept the evidence the agents produce.
What Is Covered in This Article:
- ServiceNow announced agentic continuous control monitoring for ServiceNow IRM, with general availability expected in Q1 2027.
- AI agents set up control checks, read the results, flag controls that are failing or drifting, open tickets, and can fix problems automatically within policies the customer sets.
- More than 100 prebuilt integrations extend monitoring to cloud, container, identity, SaaS, on-premises, OT, IoT, and medical device tools.
- Access Graph tracks access for people, machines, and AI agents, and Compliance Graph links risk signals across systems.
- Futurum survey data shows where buyers plan to use agents first, how they are consolidating software, and how they want to pay for AI.
The News: On November 10, 2026, ServiceNow announced agentic continuous control monitoring for ServiceNow Integrated Risk Management (IRM). AI agents help set up compliance checks, read the results, and find controls that are failing or drifting. When a control fails, ServiceNow flags it, opens a ticket, and can fix it automatically within policies the customer defines. General availability is expected in Q1 2027.
IRM already monitors controls in security operations, IT service management, IT asset management, and the configuration management database (CMDB). More than 100 prebuilt integrations extend that monitoring to third-party cloud, container, AI, SaaS, on-premises, and business tools, plus OT, IoT, and medical devices. Two parts of ServiceNow’s Context Engine feed the monitoring. Access Graph tracks access for people, machines, and AI agents, so ServiceNow can confirm that access is removed when an employee leaves or an agent is retired. Compliance Graph links signals across systems to show what is at risk.
ServiceNow maps each control to the tools that enforce it. One control can also count toward several frameworks, including SOX, PCI-DSS, ISO 27001, HIPAA, and the EU AI Act. For example, an access control tested for SOX also counts toward the matching PCI-DSS and ISO 27001 requirements. Business units, risk and compliance teams, and internal audit each see results in the collaboration and project tools they already use, and internal audit gets full test results with evidence. ServiceNow presents the capability as part of its Super Intelligence Control Tower. CNA Insurance is the only customer named in the announcement.
ServiceNow’s Agentic Continuous Control Monitoring Turns Failed Controls Into Tickets and Fixes
Analyst Take: ServiceNow is targeting a real problem. Most companies still test controls on a schedule. Teams pull samples each quarter, collect screenshots for auditors, and end up with proof that a control worked on the day someone checked it. Agentic continuous control monitoring checks controls all the time, and when one fails, it opens a ticket and starts the fix on the same platform. Vasant Balasubramanian, who leads ServiceNow’s risk business, said the goal is to close the gap between what the last audit showed and what is true today. Most compliance surprises come from that gap.
Two issues will decide how much customers get from it. Monitoring covers only the systems a customer connects. Automatic fixes help only if risk owners and auditors trust what the agents do and the evidence they record.
ServiceNow Fixes Failed Controls Where IT Teams Already Work
Other vendors already monitor controls. Vanta and Drata built their businesses on collecting compliance evidence automatically, and GRC platforms such as AuditBoard, Archer, and MetricStream offer their own control testing. ServiceNow’s advantage is that the fix happens in the system where IT and security teams already work. A failed access control becomes a ticket on the platform that runs IT service management, security operations, and the CMDB, and the ticket goes to the team that owns the asset.
That helps ServiceNow most with its existing customers. Companies that run IT service management and security operations on ServiceNow can add control monitoring without connecting a separate GRC tool to their ticketing system. Companies that run GRC on another platform now have a reason to consider moving it to ServiceNow.
Identity Controls Will Be the First Real Test
Access Graph is the most important part of the announcement. ServiceNow closed its acquisition of identity security vendor Veza on March 2, 2026, and Veza’s main product is an access graph that maps which people, machines, and agents can reach which data. With that data in IRM, access reviews, which are among the most time-consuming SOX and PCI-DSS controls, can run continuously rather than once a quarter. Access Graph also covers AI agents. As companies give agents ongoing permissions, removing an agent’s access becomes a control that needs testing, and few GRC tools track it today.
The integrations for OT, IoT, and medical devices fit with the asset data ServiceNow gained when it completed its $7.75 billion acquisition of Armis in April 2026. Together, Veza and Armis give IRM its own data on identities and assets. Most standalone GRC platforms get that data from other vendors.
Buyers Plan to Use Agents in IT and Security Work First
Futurum’s 2H 2026 Enterprise Applications Decision Maker Survey (N=833, published August 2026) found that buyers plan to deploy agents first in internal work where results are easy to measure. IT operations and observability (21.6%) and cybersecurity (16.4%) lead first-rank deployment plans, ahead of sales, marketing, and service (12.8%) and customer engagement (10.4%). Control monitoring fits that pattern: the results are measurable, and mistakes stay inside the company.
The same survey shows buyers are willing to consolidate. Among enterprises consolidating applications, 47.3% are replacing point tools with suites or platforms, and 34.9% list streamlining the use of AI agents as a top-three reason. That supports ServiceNow’s case for running monitoring, tickets, and fixes on one platform.
Automatic Fixes and Auditor Trust Will Set the Pace
Risk teams will be slow to turn on automatic fixes. Removing access or changing a setting to fix a failed control can break a production process. The agents also work from the customer’s written control descriptions, so a poorly written control can lead to a poor fix. Most customers will likely start with detection and tickets, then allow automatic fixes for a few low-risk controls, such as removing accounts that no longer have an owner.
Auditor trust is the other issue. Internal audit will welcome testing every record. External auditors will need to see how the evidence was collected and how an agent reached its conclusion. ServiceNow should publish how its agents record their reasoning and actions, and work with audit firms to get that evidence accepted for SOX and PCI-DSS testing. Counting one test toward several frameworks is where customers will save money first, and auditors will check that mapping closely.
ServiceNow did not disclose pricing. Among Futurum survey respondents paying for generative AI as an add-on (n=645), 36.6% prefer consumption pricing and 21.1% prefer outcome-based pricing, while only 11.2% say their preferred vendor offers outcome pricing today. Continuous monitoring across more than 100 connected systems could mean a lot of agent activity, so buyers will want predictable costs before they connect everything.
ServiceNow has the pieces to make control monitoring part of daily IT work, with tickets, owners, and fixes. General availability is not expected until Q1 2027, which gives rival GRC vendors time to add their own remediation workflows and gives ServiceNow time to show external auditors that evidence from its agents is reliable.
What to Watch:
- Whether external auditors accept ServiceNow’s agent logs and evidence for SOX and PCI-DSS testing. If they do, customers can reduce sample-based testing.
- How many customers turn on automatic fixes at general availability, and for which controls. If most stop at detection and tickets, trust in agent actions is still low.
- Whether companies running GRC on AuditBoard, Archer, MetricStream, or similar platforms move to ServiceNow IRM, or whether those vendors build deeper ServiceNow integrations.
- How ServiceNow prices agentic monitoring across third-party systems: by seat, by usage, or by the number of controls monitored.
- How Access Graph handles AI agents created outside ServiceNow. This will test ServiceNow’s claim that the Super Intelligence Control Tower can govern AI across the enterprise.
See the complete press release on the ServiceNow website.
Sources
- ServiceNow Brings Agentic Monitoring to Every Control in the Enterprise at Machine Speed, ServiceNow
Declaration of generative AI and AI-assisted technologies in the writing process: This content has been generated with the support of artificial intelligence technologies. Due to the fast pace of content creation and the continuous evolution of data and information, The Futurum Group and its analysts strive to ensure the accuracy and factual integrity of the information presented. However, the opinions and interpretations expressed in this content reflect those of the individual author/analyst. The Futurum Group makes no guarantees regarding the completeness, accuracy, or reliability of any information contained herein. Readers are encouraged to verify facts independently and consult relevant sources for further clarification.
Disclosure: Futurum is a research and advisory firm that engages or has engaged in research, analysis, and advisory services with many technology companies, including those mentioned in this article. The author does not hold any equity positions with any company mentioned in this article.
Analysis and opinions expressed herein are specific to the analyst individually and data and other information that might have been provided for validation, not those of Futurum as a whole.
Read the full Futurum Group Disclosure.
Other Insights From Futurum:
ServiceNow Launches Control Tower Alliance
ServiceNow Q3 FY 2026: AI Consumption Expands the Workflow Model
ServiceNow’s AI Passport Closes the Agentic Governance Gap
Author Information
Keith Kirkpatrick is VP & Research Director, Enterprise Software & Digital Workflows for The Futurum Group. Keith has over 25 years of experience in research, marketing, and consulting-based fields.
He has authored in-depth reports and market forecast studies covering artificial intelligence, biometrics, data analytics, robotics, high performance computing, and quantum computing, with a specific focus on the use of these technologies within large enterprise organizations and SMBs. He has also established strong working relationships with the international technology vendor community and is a frequent speaker at industry conferences and events.
In his career as a financial and technology journalist he has written for national and trade publications, including BusinessWeek, CNBC.com, Investment Dealers’ Digest, The Red Herring, The Communications of the ACM, and Mobile Computing & Communications, among others.
He is a member of the Association of Independent Information Professionals (AIIP).
Keith holds dual Bachelor of Arts degrees in Magazine Journalism and Sociology from Syracuse University.
