Vulnerability Response in ServiceNow for a Member-Owned Credit Union
Every critical vulnerability now has an owner from the CMDB and a fix scheduled through change control, and the overdue backlog is down 88%.
Client name withheld by agreement- Client
- Federally insured credit union, 410,000 members
- Region
- Allentown, Pennsylvania
- Year
- 2026 · Ongoing
- Duration
- 14 weeks
- Scope
- 6,300 assets · 58 branches · scanner, CMDB and change management in ServiceNow
- Practice
- Offensive Security & Resilience
The challenge
What was at stake.
A credit union with 410,000 members and 58 branches scanned its network every week and produced reports that nobody owned. Findings went to a shared inbox, and the infrastructure team patched what it could between projects.
NCUA examiners had noted the aging backlog, and the board’s risk committee wanted a measure it could track. The credit union already ran ServiceNow for IT service management but had never connected it to its scanner.
What we did
The approach, step by step.
- 01
CMDB cleaned up first
We reconciled scanner results against the ServiceNow CMDB, added 1,260 missing assets and assigned every server, workstation and network device to a support group.
- 02
Findings routed to owners
ServiceNow Vulnerability Response now imports scan results, groups them by fix, and assigns each group to the support group that owns the affected assets.
- 03
Fixes scheduled through change
Remediation tasks create standard change records in approved patch windows, so branch systems are patched without interrupting tellers mid-day.
- 04
Risk-based deadlines
Due dates are set by known exploitation, internet exposure and access to member data, and exceptions require a documented risk acceptance from the asset owner.
- 05
Reporting for the board
A monthly dashboard shows open exposure, time to fix and accepted risks, written for the risk committee and NCUA examiners as well as IT.
Outcomes
What changed, in numbers.
- 88%
- fewer overdue critical and high findings
- 1,260
- assets added to the CMDB
- 9 days
- median time to fix critical findings
- 100%
- of remediation tracked through change records
We had the scanner and we had ServiceNow. Connecting them is what finally gave every finding an owner.
Services delivered
Related engagements
More work in Offensive Security & Resilience.
-
Edison, New Jersey · 6 weeks
Offensive Security & Resilience · 2025Online Ordering and Pickup Penetration Test for a Regional Grocery ChainA flaw that exposed any shopper’s order history and saved address, closed before the holiday ordering peak.
-
Albany, New York · 16 weeks
Offensive Security & Resilience · 2024Ransomware Resilience for a Gas and Electric Distribution UtilityIdentity, outage management and billing rebuilt from clean infrastructure in 19 hours during a full-scale exercise.
-
Stamford, Connecticut · 28 weeks
Offensive Security & Resilience · 2026 · OngoingUnified Controls in ServiceNow IRM for a Payroll and Earned-Wage Platform537 requirements reduced to 126 controls in ServiceNow IRM, with 61% of control tests now running automatically.
Let’s talk about your version of this.
Share what you are up against. A senior practitioner who has delivered this kind of work will reply within one business day.