Latest Articles

: Stop Confusing Users with Technical Jargon — Design for What They Want, Not How IT Works The Service Catalog Design Trap One of the most common challenges with Service Catalog adoption is that catalog items are often designed around internal team structures instead of user outcomes. Over time, this leads to confusion, misrouted requests, and a return to email or free-text tickets . Where things usually go wrong: Separate items for each support team or technology Technical language that makes sense to IT, but not to users Too many mandatory fields up front "just in case" Routing logic embedded in user choices rather than automation As a result, users struggle to select the "right" option, and fulfillment teams spend time correcting submissions instead of delivering value . A More Effective Design Mindset Start with what the user wants to achieve, not how IT fulfills it. Instead of This (Internal-Focused) Design This (Outcome-Focused) "Active Directory Group Request" "Request access to a system" "Application Incident – Tier 2" "Report an issue with an application" Separate laptop, desktop, and peripheral items "Request new equipment" The internal complexity should live behind the scenes, handled by workflows, flows, and assignment rules . Key Design Principles One Request, One Outcome Users should not need to understand internal ownership or team structures. Each catalog item should represent a single, clear outcome the user wants to achieve. Progressive Disclosure Ask for only what's needed at submission; gather the rest later if required . Users confronted with 15 mandatory fields abandon the request or guess, leading to misrouted tickets. Automated Routing Use category, service, CI, or logic to route — not user guesswork. Don't make users choose which team should handle their request . Consistent Language Use business terms users recognize, not platform or team names. "Order a laptop" is clearer than "Hardware Asset Request - North America Region." Benefits of Outcome-Based Design Benefit Impact Higher portal adoption Users find what they need quickly Fewer misrouted requests Automation handles routing correctly Faster fulfillment times Requests arrive at the right team with complete information Cleaner reporting Consistent categorization enables accurate analysis Easier maintenance Change automation, not dozens of catalog items Real-World Impact As one ServiceNow community expert noted: "A good catalog hides complexity instead of exposing it. When catalog items are designed around outcomes, users succeed faster and IT spends less time correcting mistakes" . Action Items for Your Organization Review your catalog items — do they use technical jargon? Test with real users — where do they get confused? Replace "team-based" items with "outcome-based" items Move routing logic from users to automation Apply progressive disclosure to reduce form abandonment  

Your Vendor's Security Is Your Security — Managing Cybersecurity Risk in Third-Party Relationships The Cybersecurity Risk Reality Third-party vendors with poor security practices pose a huge risk—regardless of an organization's internal security controls. A threat actor exploiting a vendor's weak cybersecurity eventually accesses an organization's sensitive data, making the third-party vendor's security risks the associated organization's security risks . Why Cybersecurity Risk Matters Third-party providers might introduce risks of malware infiltration or system hacks via unsecured access points . High-profile examples: Target data breach 2013: compromised third-party vendor exposed over 40 million credit card details  SolarWinds hack 2020: hackers infiltrated and severely compromised the Orion IT monitoring platform and many of its users  MoveIt breach 2023: threat actors exploited vulnerabilities to exfiltrate data from approximately 2,300 entities, costing more than $10 billion  Assessing Cybersecurity Risk Questionnaire focus areas : What security controls do you have in place? How do you store or process sensitive data? What is your authentication policy? Is MFA mandatory? How often do you conduct backups? Do you have an incident response plan? How do you communicate with customers and stakeholders in the event of a security incident? Security certifications : Does the vendor follow industry-recognized best practices? Does the vendor have security certifications (ISO 27001, SOC 2)? Have audit and assessment reports been reviewed? NIST Cybersecurity Framework can be used when designing questionnaires . Continuous Cybersecurity Monitoring Security rating services provide independent security posture assessments . Outside-in scanning can identify security posture without vendor cooperation . Threat intelligence provides real-time insights into emerging threats . The Fourth-Party Cybersecurity Risk A vendor's subcontractors may introduce significant vulnerabilities. Understanding inter- and intra-dependent activities (including those of subcontractors) is a significant facet of vendor supply chain risk . Cyber Risk Quantification Quantify cybersecurity risk in financial terms: Loss exposure: industry average data breach cost ($4.88M) Probability: based on vendor security rating Expected loss: Exposure × Probability Conclusion Third-party vendors with poor security practices pose a huge risk—regardless of an organization's internal security controls . Organizations that assess and monitor vendor cybersecurity risk will protect themselves from breaches that exploit vendor vulnerabilities. Action Items for Your Organization Assess vendor cybersecurity practices Review security certifications and audit reports Implement continuous security monitoring Quantify cybersecurity risk in financial terms Address fourth-party cybersecurity risk    

There May Be No Attacker Here — When Your Authorized AI Agent Is the Incident The Fundamental Shift in Incident Response Traditional incident response was built around a clear model: an attacker does something malicious, and defenders respond. But in the AI era, incidents often don't involve attackers at all. The incident is caused by an authorized AI agent acting exactly as it was designed to act—but creating risk in the process. There may be no attacker here. There may be no malicious intent. The incident may be entirely "internal." This is the fundamental shift in AI incident response: the source of the incident isn't maliciousness, it's unintended behavior. The AI Incident Categories Category 1: Model Drift The AI model's behavior changes over time without monitoring, leading to decisions that were not anticipated. Cause Impact Training data shifts AI makes decisions based on outdated patterns Environment changes AI decisions are correct for old environment, wrong for new Feedback loops AI learns to optimize the wrong metrics Category 2: Prompt Injection An external input manipulates the AI's behavior in unintended ways. Cause Impact User crafts prompt to get AI to reveal sensitive info Data leakage User crafts prompt to get AI to take unauthorized action Unauthorized access User crafts prompt to get AI to make incorrect decisions Operational impact Category 3: Autonomous Agent Misbehavior The AI agent acts in ways not anticipated by its design. Cause Impact AI "cleans up" knowledge base by deleting critical content Operational impact AI "optimizes" CMDB by consolidating entries Incident routing broken AI "improves" configuration by making changes System instability Category 4: AI Hallucination The AI generates incorrect information as fact. Cause Impact AI invents resolution steps that don't work Wasted time AI invents root causes that aren't real Wrong investigation path AI invents security policies that don't exist Security risk Category 5: Automation Cascade The AI triggers a chain of automated actions that compound the problem. Cause Impact AI "fixes" a false positive by scaling resources Cost overruns AI "remediates" a planned deployment System outage AI "optimizes" a workflow that was intentionally configured Operational impact The Shift in Incident Response Mentality Dimension Traditional Incident Response AI Incident Response Source of incident Attacker AI agent Intent Malicious Unintended Response target Attackers AI behavior Investigation focus Who attacked us Why did AI do this Remediation Patch vulnerability Retrain or reconfigure AI Prevention Security controls Governance and monitoring The Incident Response Taxonomy Expansion Adding AI Incident Categories Incident Type Description Response Model drift AI behavior changes without monitoring Retrain model, adjust thresholds Prompt injection External input manipulates AI Implement input validation Autonomous agent misbehavior AI acts outside design Update constraints, improve design AI hallucination AI generates incorrect information Improve training, add validation Automation cascade AI triggers chain of automated actions Add constraints, human checkpoints Adding AI Incident Roles Role Responsibility AI Incident Commander Coordinates AI incident response AI Technical Lead Investigates AI behavior and root cause AI Governance Lead Assesses policy violations and regulatory impact AI Communications Lead Manages AI incident communications Building AI Incident Response Capabilities 1. Understand AI Behavior To respond to AI incidents, you need to understand AI behavior. This means: AI agents should be explainable AI decisions should be traceable AI behavior should be monitored 2. Update Incident Response Playbooks Add AI-specific: Incident categories Response steps Roles and responsibilities Communication templates 3. Monitor AI Behavior Track what AI agents are doing: Actions taken Decisions made Systems accessed Data processed 4. Build AI Kill Switches Enable immediate halting of AI operations: Easy to use Multiple mechanisms Test regularly 5. Train Teams on AI Incidents Ensure teams understand: AI incident types AI incident response AI incident investigation Conclusion: The New Incident Response Reality AI incidents are different from traditional incidents. They may have no attacker, no malicious intent, and no "bad guy." But they still need to be responded to effectively. Organizations that update their incident response capabilities for AI incidents will be resilient. Those that don't will be caught unprepared. There may be no attacker here. But there's still an incident that needs to be managed. Action Items for Your Organization Understand AI behavior: Ensure AI agents are explainable and traceable Update incident response playbooks: Add AI-specific incident categories and response steps Monitor AI behavior: Track what AI agents are doing Build kill switches: Enable immediate halting of AI operations Train teams: Ensure teams understand AI incident response    

Headline: AI Adoption Fails Without Change Management — Here's Why The AI Adoption Challenge AI is creating rapid, high-stakes shifts that are triggering ripple effects across businesses . In the past year, just over half of organizations have redesigned or redefined roles because of AI. Yet the traditional change management model, built for linear workflows and finite initiatives, no longer fits the speed or complexity of today's work . Why AI Needs Change Management 1. AI Changes Work Design, Not Just Tools AI changes how work is designed, not just how tools are used. Without rethinking roles, workflows, and decisions, organizations often limit AI's impact . 2. Employees Need to Understand AI Employees need to understand how AI fits into their roles, what it means for their work, and how to succeed in a new environment . 3. Trust Must Be Built Without trust in AI systems, even the best-designed programs stall. Employees who trust their organization's AI solutions are 2.8 times more likely to use GenAI daily . 4. New Skills Are Required AI transforms the skills employees need. Organizations must provide training and support to help people adapt . 5. Resistance Must Be Managed AI often creates anxiety and resistance. Without proactive change management, this resistance can derail even the most sophisticated AI initiatives. The Cost of Poor Change Management Organizations that fail to adapt their change management strategies risk significantly undermining transformation efforts . Gartner predicts that organizations that fail to adapt their change management strategies risk significantly undermining transformation efforts. What Works Organizations that adapt change plans based on employee responses are four times more likely to achieve success with AI initiatives. Conclusion AI is not just a technology shift—it's a human shift. Organizations that invest in change management for AI adoption will see higher adoption, greater trust, and faster returns. Organizations that neglect change management risk AI failure. Action Items for Your Organization Assess your organization's AI change readiness Develop a change management strategy for AI adoption Build trust through transparency and reliability Provide training and support for AI adoption Adapt change plans based on employee responses  

Controls Cost Money — The Question Is Whether They're Worth It The Investment Reality Controls cost money. The question is whether they're worth it. Organizations need to justify controls investment through cost-benefit analysis. The challenge: Regulatory obligations are increasing year-on-year, and enforcement is tougher, which raises the risk and cost of non-compliance . At the same time, organizations face pressure to reduce costs. The Cost-Benefit Analysis Framework Identify Costs Cost Category Examples Implementation Design, configuration, development Operation Personnel, tools, processes Testing Audit, testing resources Maintenance Updates, changes, reviews Identify Benefits Benefit Category Examples Risk reduction Reduced likelihood and impact of incidents Compliance Avoided fines and penalties Efficiency Reduced manual effort, automation Trust Stakeholder confidence, customer trust Competitive advantage Differentiator for customers Calculate ROI ROI = (Benefits - Costs) / Costs The Business Case for Controls Direct Benefits: Benefit Measurement Avoided breach costs Incident frequency × Average cost Avoided fines Regulatory fines avoided Reduced audit costs Manual effort reduction × Hourly cost Efficiency savings Hours saved × Hourly cost Indirect Benefits: Benefit Description Customer trust More likely to win business Stakeholder confidence Board and investor confidence Operational resilience Less downtime and disruption The Cost of Controls Proliferation Excessive controls have costs that may outweigh benefits : Demonstrating effective risk management becomes difficult  Increased risk of non-compliance as controls are misaligned with regulatory expectations  Ineffective assurance and audit fatigue as excessive controls dilute testing capacity  Ineffective and complex change management as it's harder to update and embed controls  Optimization Strategies 1. Eliminate Redundant Controls Eliminate controls that don't add value. Rationalization can slash manual administrative burdens by up to 33% . 2. Automate Manual Controls Automate controls where possible. Organizations can automate over 50% of yearly assessed controls . 3. Implement a Common Controls Framework A CCF rationalizes overlapping standards by mapping a single control to multiple requirements simultaneously . 4. Focus on High-Value Controls Focus resources on controls that address the highest risks and regulatory obligations. Conclusion Controls cost money, but the benefits outweigh the costs when investments are targeted effectively. Organizations that rationalize, automate, and focus controls investment will achieve better returns. Action Items for Your Organization Calculate the cost of your current control environment Identify benefits of controls Calculate ROI for controls Rationalize redundant controls Automate manual controls Focus investment on high-value controls

Your Service Catalog Should Work Like the Starbucks App — Not a Government Form The Service Catalog Problem One of the most common challenges with service catalogs is the tendency to build "Swiss Army knife" service requests—over-engineered, over-scripted, and overstuffed with UI policies. The result? Users face forms with 15 mandatory fields, leading to guessing, giving up, or opening an incident instead. The Case for Bite-Sized Requests A ServiceNow community expert makes the case: "Bite-sized beats out catalog items that are over engineered, over scripted, and overstuffed with UI policies. Stop building 'Swiss Army knife' service requests and build the kind of experience you would get ordering a coffee from the Starbucks app" . The Problem with Consolidation When organizations try to consolidate too much into a single catalog item: Problem Impact Too many fields Users get overwhelmed and abandon Complex UI policies The form feels unpredictable Too many use cases The item tries to do everything for everyone Difficult to maintain Changes require extensive testing Hard to report One category covers too many request types Why Bite-Sized Works Simpler Reporting When each catalog item is specific, reporting is straightforward. You know exactly what was requested. Reduced Change Risk Smaller items are easier to update without breaking everything else. Higher Maintainability Changes to one item don't cascade through the entire catalog. Modularity Smaller items can be combined for more complex requests. Ease of Access = Frequency of Use Users are more likely to use a catalog item that's simple and clear. The User Experience Principle Design for outcomes, not internal processes . Instead of designing catalog items around internal team structures, design them around user outcomes. Ask "What does the user want to accomplish?", not "What is the technical process behind this?" Progressive Disclosure One of the most effective catalog design principles is progressive disclosure: ask for only what's needed at submission; gather the rest later if required. The wrong way: 15 mandatory fields 5 UI policies that change based on earlier selections Technical jargon users don't understand The right way: 3-5 fields at most Clear, plain language Additional information gathered during the fulfillment process What the Starbucks App Teaches Us The Starbucks app doesn't ask you 15 questions before you can order coffee. It offers a simple, streamlined experience. Your service catalog should work the same way: Simple interface: Clear options, not cluttered forms Predictable flow: Users know what to expect Minimal friction: Fewer steps to complete the request Quick feedback: Users know their request was received Principles for Better Catalog Design Principle Application One request, one outcome Each catalog item does one thing well Outcome-focused Ask what the user wants, not how IT works Progressive disclosure Only ask for what's needed upfront Consistent language Use terms users understand Automated routing Don't make users choose where to route Test with real users Observe how users actually interact Conclusion: Simplify, Simplify, Simplify A service catalog shouldn't feel like a government form. It should feel like ordering from the Starbucks app—simple, clear, and frictionless. Bite-sized beats Swiss Army knife every time. Action Items for Your Organization Review your most complex catalog items—are they over-engineered? Test with real users—where do they get stuck or abandon? Split complex items into multiple smaller ones Apply progressive disclosure principles Use plain language, not technical jargon Measure abandonment rates