Here is the short version before the detail. ServiceNow sells Security Operations as Security Incident Response (SIR), Vulnerability Response (VR), Configuration Compliance, and Threat Intelligence. Each is counted differently, and none of them ride free on your ITSM contract. The cost lives in three places: how many analyst seats you license for SIR, how wide you scope VR across the estate, and how much metered AI you attach through Now Assist for Security Operations. This article explains each licensing basis from the buyer seat and where the give is. For the wider context on extending the platform past IT, start with the buyer guide to ESM expansion pricing.
Book a contract negotiation reviewHow is each SecOps SKU actually counted?
The single most common buyer mistake is treating SecOps as one line. It is four, and they do not share a meter. Security Incident Response is a named or fulfiller user model, so the cost scales with how many analysts you license, not how many incidents you handle. Vulnerability Response is the outlier: it is usually priced against the footprint it covers, so the lever is scope, not headcount. Configuration Compliance and Threat Intelligence sit on top as add-ons, each with its own basis. Knowing which meter you are on tells you which lever moves the number.
| SecOps module | Typical licensing basis | What drives the cost | Buyer lever |
|---|---|---|---|
| Security Incident Response (SIR) | Per analyst / fulfiller user, packaged tiers | Number of security analyst seats | Right-size analyst seats; reuse ITSM fulfillers where rights allow |
| Vulnerability Response (VR) | Scoped to estate (assets / CIs in scope) | Breadth of the asset footprint covered | Scope to assets actually in remediation, not the whole CMDB |
| Configuration Compliance | Add-on, scoped to assets tested | Number of assets under policy testing | Phase rollout; confirm overlap with VR scope |
| Threat Intelligence | Add-on package | Feeds and enrichment scope | Buy only if a feed integration is genuinely used |
| Now Assist for Security Operations | Metered AI assists | Volume of AI actions analysts trigger | Negotiate an assist cap and overage rate before signing |
Pricing on every one of these varies by deal size and by how ServiceNow has packaged your agreement, so confirm the exact unit against your order form rather than a list rate. The point for a buyer is the model, not a quoted number you cannot verify.
Why do buyers end up paying twice for the same people?
Because the security analysts who work incidents in SIR often already hold an ITSM fulfiller license, and the two are sold as separate rights. A vendor account team has no reason to point out the overlap. When you map the named users on the SIR order line against the named fulfillers on the ITSM line, you frequently find the same people counted on both, paid for on both. The lever is not a discount request. It is a reconciliation: produce the user list, show the overlap, and require that the SecOps entitlement reflects only the seats that need rights the ITSM license does not already grant. The same discipline that drives our Jira Service Management pricing beyond IT work applies here: count the humans once, not once per workflow.
How should you scope Vulnerability Response?
Vulnerability Response is where estates overspend the most, because the natural instinct is to scope it to the whole configuration management database. That is the wrong anchor. VR earns its keep on the assets you actually triage and remediate, which is a subset of every CI ServiceNow has discovered. Scoping VR to the full CMDB pays for coverage of devices that never enter a remediation workflow. Before you sign, define the in-scope asset set: the systems your security team will genuinely run through detection, prioritization, and patch orchestration with a scanner such as Qualys, Tenable, or Rapid7 feeding the data. Then license to that set, with a defined path to expand if scope grows, rather than buying the maximum on day one.
What changes under the 2026 ServiceNow packaging?
ServiceNow is consolidating its commercial tiers into Foundation, Advanced, and Prime, with AI capabilities bundled in from April 2026 and legacy SKUs going end of sale on 1 July 2026. For Security Operations buyers, the practical effect is that Now Assist for Security Operations is increasingly presented as part of the package rather than a clean optional add-on. AI is metered in assists, roughly 25 for a small action and up to about 150 for a large agentic action, with overage top-ups beyond your allowance. Treat that meter as its own negotiation: ask for the included assist allowance in writing, a capped overage rate, and the right to true down if consumption comes in low. The discipline mirrors what we cover in the ServiceNow renewal playbook white paper, which lays out the assist mechanics and the protective clauses in full.
Book a contract negotiation reviewThe five questions to answer before you sign a SecOps line
- Who needs SIR rights they do not already have? Reconcile the analyst list against your ITSM fulfiller list and license only the gap.
- What is the real VR remediation scope? Define the in-scope asset set and license to it, not to the full CMDB, with a costed expansion path.
- Does Configuration Compliance overlap VR? Confirm you are not paying twice to test the same assets under two modules.
- Is Now Assist metered, and is the cap written down? Get the included assist allowance, the overage rate, and a true-down right in the contract, not the quote.
- Is everything co-termed? Align SecOps renewal dates with the ITSM agreement so you negotiate one event with full leverage, not three scattered ones.
What to do next
Build the user and asset map before ServiceNow builds the quote, because the quote will be built off your current entitlement plus an uplift, and that entitlement almost always overstates both analyst seats and VR scope. Across more than 500 engagements and over $420M in ITSM contract value, the firm averages a 30% reduction, and on SecOps lines a large share of that comes from removing double-counted users and over-scoped Vulnerability Response rather than from headline discounting. When you are ready to run it, the platform hub is the ServiceNow platform page and the engagement runs through our contract negotiation service on fixed fee or gainshare.
Frequently asked questions
- Is ServiceNow SecOps included in an ITSM subscription?
- No. Security Operations is a distinct product line with its own SKUs. Security Incident Response and Vulnerability Response are licensed separately from ITSM fulfiller users, and an ITSM agent does not get SecOps rights by default. Confirm the exact entitlements against your order form.
- How is ServiceNow SecOps licensed?
- Security Incident Response is generally licensed per analyst or fulfiller user in packaged tiers. Vulnerability Response is usually scoped to the estate it covers, such as the number of assets or configuration items in scope, rather than per user. Threat Intelligence and Configuration Compliance are add-ons. Pricing varies by deal size.
- Where do buyers overpay on SecOps?
- Double counting users who already hold an ITSM fulfiller license, scoping Vulnerability Response to the whole CMDB instead of the assets actually in remediation scope, and accepting Now Assist for Security Operations on metered assists without a cap. Each is a defensible reduction.
Book a SecOps licensing review.
We separate SecOps from ITSM, right-size the analyst seats, scope Vulnerability Response to real assets, and cap the AI. Fixed fee or gainshare.
Book a contract negotiation review →